mlme.c 165.6 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-only
2 3
/*
 * BSS client mode implementation
4
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
5 6 7 8
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9
 * Copyright 2013-2014  Intel Mobile Communications GmbH
10
 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
11
 * Copyright (C) 2018 - 2020 Intel Corporation
12 13
 */

14
#include <linux/delay.h>
15
#include <linux/fips.h>
16 17 18 19
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
20
#include <linux/moduleparam.h>
21
#include <linux/rtnetlink.h>
22
#include <linux/crc32.h>
23
#include <linux/slab.h>
24
#include <linux/export.h>
25
#include <net/mac80211.h>
26
#include <asm/unaligned.h>
J
Johannes Berg 已提交
27

28
#include "ieee80211_i.h"
29
#include "driver-ops.h"
J
Johannes Berg 已提交
30 31
#include "rate.h"
#include "led.h"
32
#include "fils_aead.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
37
#define IEEE80211_AUTH_TIMEOUT_SAE	(HZ * 2)
38 39 40
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
41
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
42 43
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
44

45 46 47 48 49 50 51 52 53
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
54 55

/*
56 57 58 59 60 61
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
62
 */
63 64 65 66
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
67

J
Johannes Berg 已提交
68 69 70 71
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
72
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
73 74 75 76 77
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
78 79 80 81 82
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
83

84 85 86 87 88 89
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
90 91 92 93 94 95 96 97 98 99
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
100 101
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
102
{
103
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
104

105 106 107
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
108 109
}

110
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
111
{
112
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
113 114
		return;

115
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
116 117
		return;

J
Johannes Berg 已提交
118
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
119
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
120 121
}

122 123
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
124 125
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

126
	if (unlikely(!ifmgd->associated))
127 128
		return;

129 130
	if (ifmgd->probe_send_count)
		ifmgd->probe_send_count = 0;
131

132
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
133 134
		return;

135
	mod_timer(&ifmgd->conn_mon_timer,
136 137 138
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

139
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
140
{
141
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
142 143
}

144 145 146 147 148 149
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
150
			     const struct ieee80211_he_operation *he_oper,
151
			     struct cfg80211_chan_def *chandef, bool tracking)
152
{
153
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
154
	struct cfg80211_chan_def vht_chandef;
155
	struct ieee80211_sta_ht_cap sta_ht_cap;
156 157
	u32 ht_cfreq, ret;

158 159 160
	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

161
	memset(chandef, 0, sizeof(struct cfg80211_chan_def));
162 163 164 165
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;

166
	if (!ht_oper || !sta_ht_cap.ht_supported) {
167 168 169
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
170 171 172 173 174 175 176 177
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
178
	if (!tracking && channel->center_freq != ht_cfreq) {
179 180 181 182 183 184 185
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
186 187 188 189
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
190 191 192
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
193 194 195 196
		goto out;
	}

	/* check 40 MHz support, if we have it */
197
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
198
		ieee80211_chandef_ht_oper(ht_oper, chandef);
199 200 201
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
202 203
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
204 205 206 207 208 209 210 211
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

212
	vht_chandef = *chandef;
L
Luca Coelho 已提交
213 214 215 216 217 218 219 220 221 222 223 224
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && he_oper &&
	    (le32_to_cpu(he_oper->he_oper_params) &
	     IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
		struct ieee80211_vht_operation he_oper_vht_cap;

		/*
		 * Set only first 3 bytes (other 2 aren't used in
		 * ieee80211_chandef_vht_oper() anyway)
		 */
		memcpy(&he_oper_vht_cap, he_oper->optional, 3);
		he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);

225 226
		if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
						&he_oper_vht_cap, ht_oper,
L
Luca Coelho 已提交
227 228 229 230 231 232 233
						&vht_chandef)) {
			if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
				sdata_info(sdata,
					   "HE AP VHT information is invalid, disable HE\n");
			ret = IEEE80211_STA_DISABLE_HE;
			goto out;
		}
234 235
	} else if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_oper,
					       ht_oper, &vht_chandef)) {
236
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
237
			sdata_info(sdata,
238
				   "AP VHT information is invalid, disable VHT\n");
239 240 241 242 243
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
244
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
245 246
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
247 248 249 250 251 252 253 254 255 256
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
257
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
258 259
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
260 261 262 263 264 265 266 267 268
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

291 292 293 294
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

295 296 297 298 299 300 301 302
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
303
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
304 305
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
306 307
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
308 309
			      IEEE80211_STA_DISABLE_VHT |
			      IEEE80211_STA_DISABLE_HE;
310
			break;
311 312
		}

313
		ret |= ieee80211_chandef_downgrade(chandef);
314 315
	}

316 317
	if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
						 IEEE80211_CHAN_NO_HE))
318 319
		ret |= IEEE80211_STA_DISABLE_HE;

320
	if (chandef->width != vht_chandef.width && !tracking)
321 322 323 324 325 326 327
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

328 329
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
330
			       const struct ieee80211_ht_cap *ht_cap,
331 332
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
333
			       const struct ieee80211_he_operation *he_oper,
334
			       const u8 *bssid, u32 *changed)
335 336
{
	struct ieee80211_local *local = sdata->local;
337
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
L
Luca Coelho 已提交
338 339 340
	struct ieee80211_channel *chan = sdata->vif.bss_conf.chandef.chan;
	struct ieee80211_supported_band *sband =
		local->hw.wiphy->bands[chan->band];
341
	struct cfg80211_chan_def chandef;
342
	u16 ht_opmode;
343 344 345
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
346

347 348
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
349 350
		return 0;

351 352 353 354
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

L
Luca Coelho 已提交
355 356 357 358 359
	/* don't check HE if we associated as non-HE station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HE ||
	    !ieee80211_get_he_sta_cap(sband))
		he_oper = NULL;

360 361 362
	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

363 364 365 366 367 368 369 370 371 372
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

L
Luca Coelho 已提交
373
	/* calculate new channel (type) based on HT/VHT/HE operation IEs */
374
	flags = ieee80211_determine_chantype(sdata, sband, chan,
L
Luca Coelho 已提交
375
					     ht_oper, vht_oper, he_oper,
376
					     &chandef, true);
377 378 379 380 381 382 383 384 385 386

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
387
		flags |= ieee80211_chandef_downgrade(&chandef);
388 389
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
390
		flags |= ieee80211_chandef_downgrade(&chandef);
391 392
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
393
		flags |= ieee80211_chandef_downgrade(&chandef);
394 395 396 397 398 399 400 401 402 403 404

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
		   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
		   chandef.center_freq1, chandef.center_freq2);

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
405
				      IEEE80211_STA_DISABLE_HE |
406 407 408 409 410 411 412 413 414 415 416 417 418 419 420
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
421
	case NL80211_CHAN_WIDTH_40:
422
		new_sta_bw = IEEE80211_STA_RX_BW_40;
423
		break;
424 425 426 427 428 429
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
430
		break;
431 432
	default:
		return -EINVAL;
433
	}
434

435 436
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
437

438 439 440 441 442
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
443

444 445 446 447 448 449 450
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
451

452 453 454 455
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
456
	}
457

458
	return 0;
459 460
}

J
Johannes Berg 已提交
461 462
/* frame sending functions */

J
Johannes Berg 已提交
463
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
464
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

482
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
483 484 485 486 487 488 489 490 491 492 493 494 495 496
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

497 498 499 500 501 502 503 504 505 506
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
507 508 509 510 511 512
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
513
		/* fall through */
J
Johannes Berg 已提交
514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

533 534 535 536
/* This function determines vht capability flags for the association
 * and builds the IE.
 * Note - the function may set the owner of the MU-MIMO capability
 */
537 538
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
539 540
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
541
{
542
	struct ieee80211_local *local = sdata->local;
543 544 545
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
546
	u32 mask, ap_bf_sts, our_bf_sts;
547 548 549 550

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
551
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
552 553 554 555

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
556
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
557 558 559 560 561 562
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
563 564 565 566
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
567
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
568 569
	}

570 571 572 573 574 575
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593
		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
	else if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

	/*
	 * If some other vif is using the MU-MIMO capablity we cannot associate
	 * using MU-MIMO - this will lead to contradictions in the group-id
	 * mechanism.
	 * Ownership is defined since association request, in order to avoid
	 * simultaneous associations with MU-MIMO.
	 */
	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
		bool disable_mu_mimo = false;
		struct ieee80211_sub_if_data *other;

		list_for_each_entry_rcu(other, &local->interfaces, list) {
594
			if (other->vif.mu_mimo_owner) {
595 596 597 598 599 600 601
				disable_mu_mimo = true;
				break;
			}
		}
		if (disable_mu_mimo)
			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
		else
602
			sdata->vif.mu_mimo_owner = true;
603
	}
604

605 606 607 608 609 610 611 612 613 614
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

615
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
616
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
617 618 619
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

L
Luca Coelho 已提交
620 621 622 623 624 625 626 627 628
/* This function determines HE capability flags for the association
 * and builds the IE.
 */
static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
				struct sk_buff *skb,
				struct ieee80211_supported_band *sband)
{
	u8 *pos;
	const struct ieee80211_sta_he_cap *he_cap = NULL;
629
	struct ieee80211_chanctx_conf *chanctx_conf;
L
Luca Coelho 已提交
630
	u8 he_cap_size;
631 632 633 634 635 636 637 638 639 640
	bool reg_cap = false;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!WARN_ON_ONCE(!chanctx_conf))
		reg_cap = cfg80211_chandef_usable(sdata->wdev.wiphy,
						  &chanctx_conf->def,
						  IEEE80211_CHAN_NO_HE);

	rcu_read_unlock();
L
Luca Coelho 已提交
641 642

	he_cap = ieee80211_get_he_sta_cap(sband);
643
	if (!he_cap || !reg_cap)
L
Luca Coelho 已提交
644 645 646 647 648 649 650 651 652 653 654 655 656 657 658
		return;

	/*
	 * TODO: the 1 added is because this temporarily is under the EXTENSION
	 * IE. Get rid of it when it moves.
	 */
	he_cap_size =
		2 + 1 + sizeof(he_cap->he_cap_elem) +
		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
		ieee80211_he_ppe_size(he_cap->ppe_thres[0],
				      he_cap->he_cap_elem.phy_cap_info);
	pos = skb_put(skb, he_cap_size);
	ieee80211_ie_build_he_cap(pos, he_cap, pos + he_cap_size);
}

J
Johannes Berg 已提交
659 660 661 662 663 664 665
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
666
	u8 *pos, qos_info, *ie_start;
J
Johannes Berg 已提交
667
	size_t offset = 0, noffset;
668
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
669 670
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
671 672
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
673
	u32 rates = 0;
674 675 676 677 678 679 680
	struct element *ext_capa = NULL;

	/* we know it's writable, cast away the const */
	if (assoc_data->ie_len)
		ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
						      assoc_data->ie,
						      assoc_data->ie_len);
J
Johannes Berg 已提交
681

682
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
683

J
Johannes Berg 已提交
684 685 686 687 688 689
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
690
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
691 692
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
693
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
694 695 696 697 698 699 700 701

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
702 703 704 705
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
706 707 708 709 710 711
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
712 713 714 715 716
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
717 718 719 720 721 722 723 724 725
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
726
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
L
Luca Coelho 已提交
727 728 729
			2 + 1 + sizeof(struct ieee80211_he_cap_elem) + /* HE */
				sizeof(struct ieee80211_he_mcs_nss_supp) +
				IEEE80211_HE_PPE_THRES_MAX_LEN +
J
Johannes Berg 已提交
730
			assoc_data->ie_len + /* extra IEs */
731
			(assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
J
Johannes Berg 已提交
732 733 734 735 736 737 738 739 740
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

741
	if (sband->band == NL80211_BAND_2GHZ) {
742 743
		capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
J
Johannes Berg 已提交
744 745 746 747 748 749
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
750
	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
J
Johannes Berg 已提交
751 752
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

753 754 755
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

756
	mgmt = skb_put_zero(skb, 24);
J
Johannes Berg 已提交
757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
781
	ie_start = pos;
J
Johannes Berg 已提交
782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
798 799 800
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
801 802 803 804 805 806 807 808 809 810 811 812
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
813 814 815 816
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
817 818 819 820
			}
		}
	}

821 822
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
823 824 825 826
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
827 828
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
829
	}
J
Johannes Berg 已提交
830

831 832 833 834 835 836 837 838 839
	/*
	 * Per spec, we shouldn't include the list of channels if we advertise
	 * support for extended channel switching, but we've always done that;
	 * (for now?) apply this restriction only on the (new) 6 GHz band.
	 */
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
	    (sband->band != NL80211_BAND_6GHZ ||
	     !ext_capa || ext_capa->datalen < 1 ||
	     !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
J
Johannes Berg 已提交
840 841 842 843 844 845 846 847 848 849 850
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

851 852
	/* Set MBSSID support for HE AP if needed */
	if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
853 854 855
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && assoc_data->ie_len &&
	    ext_capa && ext_capa->datalen >= 3)
		ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
856

J
Johannes Berg 已提交
857
	/* if present, add any custom IEs that go before HT */
858
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
859 860 861 862 863 864 865 866 867 868
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
869 870
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
871 872
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
873 874 875 876
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
877
			/* luckily this is almost always there */
878 879 880 881
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
882
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
883 884 885 886 887 888 889 890 891 892 893
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
894
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
895 896 897
		offset = noffset;
	}

J
Johannes Berg 已提交
898 899 900 901
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

902
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
903
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
904
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
905

906 907 908
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
909 910 911 912
			/*
			 * no need to list the ones split off before HT
			 * or generated here
			 */
913 914 915 916 917
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
918
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
919
		};
920 921

		/* RIC already taken above, so no need to handle here anymore */
922 923 924
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
925
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
926 927 928
		offset = noffset;
	}

L
Luca Coelho 已提交
929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955
	/* if present, add any custom IEs that go before HE */
	if (assoc_data->ie_len) {
		static const u8 before_he[] = {
			/*
			 * no need to list the ones split off before VHT
			 * or generated here
			 */
			WLAN_EID_OPMODE_NOTIF,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
			/* 11ai elements */
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
			/* TODO: add 11ah/11aj/11ak elements */
		};

		/* RIC already taken above, so no need to handle here anymore */
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_he, ARRAY_SIZE(before_he),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

956
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
957 958
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
959

960 961 962 963 964 965 966 967 968
	/*
	 * If AP doesn't support HT, mark HE as disabled.
	 * If on the 5GHz band, make sure it supports VHT.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT ||
	    (sband->band == NL80211_BAND_5GHZ &&
	     ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

L
Luca Coelho 已提交
969 970 971 972
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		ieee80211_add_he_ie(sdata, skb, sband);

	/* if present, add any custom non-vendor IEs that go after HE */
973
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
974 975 976
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
977
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
978 979 980
		offset = noffset;
	}

981 982
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
983 984
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
985 986 987 988 989
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

990
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
991 992 993
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
994
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
995
		noffset = assoc_data->ie_len;
996
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
997 998
	}

999 1000 1001 1002 1003 1004
	if (assoc_data->fils_kek_len &&
	    fils_encrypt_assoc_req(skb, assoc_data) < 0) {
		dev_kfree_skb(skb);
		return;
	}

1005 1006 1007 1008 1009
	pos = skb_tail_pointer(skb);
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
	ifmgd->assoc_req_ies_len = pos - ie_start;

1010
	drv_mgd_prepare_tx(local, sdata, 0);
J
Johannes Berg 已提交
1011

J
Johannes Berg 已提交
1012
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1013
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1014 1015
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
1016 1017 1018
	ieee80211_tx_skb(sdata, skb);
}

1019 1020 1021 1022 1023 1024
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

1025 1026
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
1027 1028
		return;

1029 1030
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1031

1032 1033
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
1034 1035
}

1036 1037
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
1038
			     bool powersave)
1039 1040
{
	struct sk_buff *skb;
1041
	struct ieee80211_hdr_3addr *nullfunc;
1042
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1043

L
Luca Coelho 已提交
1044 1045 1046 1047 1048
	/* Don't send NDPs when STA is connected HE */
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		return;

1049 1050
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
		!ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
1051
	if (!skb)
1052 1053
		return;

1054
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1055
	if (powersave)
1056
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1057

1058 1059
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1060

1061
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1062 1063
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

1064
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1065 1066
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

1067
	ieee80211_tx_skb(sdata, skb);
1068 1069
}

1070 1071 1072 1073 1074 1075 1076 1077 1078 1079
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

L
Luca Coelho 已提交
1080 1081 1082 1083
	/* Don't send NDPs when connected HE */
	if (!(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
		return;

1084
	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1085
	if (!skb)
1086
		return;
1087

1088 1089
	skb_reserve(skb, local->hw.extra_tx_headroom);

1090
	nullfunc = skb_put_zero(skb, 30);
1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

1103 1104 1105 1106 1107
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
1108
	struct ieee80211_local *local = sdata->local;
1109
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1110
	int ret;
1111

1112
	if (!ieee80211_sdata_running(sdata))
1113 1114
		return;

1115
	sdata_lock(sdata);
1116 1117 1118
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

1119 1120
	if (!ifmgd->associated)
		goto out;
1121

1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
1133 1134 1135 1136
		struct ieee80211_supported_band *sband = NULL;
		struct sta_info *mgd_sta = NULL;
		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;

1137 1138 1139 1140 1141 1142 1143 1144
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186
		if (sdata->vif.bss_conf.chandef.width !=
		    sdata->csa_chandef.width) {
			/*
			 * For managed interface, we need to also update the AP
			 * station bandwidth and align the rate scale algorithm
			 * on the bandwidth change. Here we only consider the
			 * bandwidth of the new channel definition (as channel
			 * switch flow does not have the full HT/VHT/HE
			 * information), assuming that if additional changes are
			 * required they would be done as part of the processing
			 * of the next beacon from the AP.
			 */
			switch (sdata->csa_chandef.width) {
			case NL80211_CHAN_WIDTH_20_NOHT:
			case NL80211_CHAN_WIDTH_20:
			default:
				bw = IEEE80211_STA_RX_BW_20;
				break;
			case NL80211_CHAN_WIDTH_40:
				bw = IEEE80211_STA_RX_BW_40;
				break;
			case NL80211_CHAN_WIDTH_80:
				bw = IEEE80211_STA_RX_BW_80;
				break;
			case NL80211_CHAN_WIDTH_80P80:
			case NL80211_CHAN_WIDTH_160:
				bw = IEEE80211_STA_RX_BW_160;
				break;
			}

			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
			sband =
				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
		}

		if (sdata->vif.bss_conf.chandef.width >
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1187 1188 1189 1190 1191 1192 1193 1194 1195 1196
		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

1197 1198 1199 1200 1201 1202 1203
		if (sdata->vif.bss_conf.chandef.width <
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1204 1205 1206 1207 1208
		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1209
		sdata_info(sdata,
1210
			   "failed to finalize channel switch, disconnecting\n");
1211 1212 1213 1214
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1215

1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1236

1237 1238 1239 1240 1241
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1242

1243 1244 1245
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1246 1247 1248 1249 1250 1251
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1252
		return;
1253
	}
1254 1255

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1256 1257
}

1258 1259
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1260 1261
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1262 1263 1264

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1265 1266 1267 1268 1269 1270
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1271 1272 1273 1274
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1275
static void ieee80211_chswitch_timer(struct timer_list *t)
1276 1277
{
	struct ieee80211_sub_if_data *sdata =
1278
		from_timer(sdata, t, u.mgd.chswitch_timer);
1279

1280
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1281 1282
}

1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308
static void
ieee80211_sta_abort_chanswitch(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;

	if (!local->ops->abort_channel_switch)
		return;

	mutex_lock(&local->mtx);

	mutex_lock(&local->chanctx_mtx);
	ieee80211_vif_unreserve_chanctx(sdata);
	mutex_unlock(&local->chanctx_mtx);

	if (sdata->csa_block_tx)
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);

	sdata->csa_block_tx = false;
	sdata->vif.csa_active = false;

	mutex_unlock(&local->mtx);

	drv_abort_channel_switch(sdata);
}

1309
static void
J
Johannes Berg 已提交
1310
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1311 1312
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1313
				 bool beacon)
1314
{
1315
	struct ieee80211_local *local = sdata->local;
1316
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1317
	struct cfg80211_bss *cbss = ifmgd->associated;
1318
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1319
	struct ieee80211_chanctx *chanctx;
1320
	enum nl80211_band current_band;
1321
	struct ieee80211_csa_ie csa_ie;
1322
	struct ieee80211_channel_switch ch_switch;
1323
	int res;
1324

1325
	sdata_assert_lock(sdata);
1326

1327
	if (!cbss)
1328 1329
		return;

1330
	if (local->scanning)
1331 1332
		return;

1333
	current_band = cbss->channel->band;
1334
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1335
					   ifmgd->flags,
1336
					   ifmgd->associated->bssid, &csa_ie);
1337 1338 1339 1340

	if (!res) {
		ch_switch.timestamp = timestamp;
		ch_switch.device_timestamp = device_timestamp;
1341
		ch_switch.block_tx = csa_ie.mode;
1342 1343 1344 1345 1346
		ch_switch.chandef = csa_ie.chandef;
		ch_switch.count = csa_ie.count;
		ch_switch.delay = csa_ie.max_switch_time;
	}

1347
	if (res < 0) {
1348
		ieee80211_queue_work(&local->hw,
1349
				     &ifmgd->csa_connection_drop_work);
1350
		return;
1351 1352
	}

1353 1354 1355 1356 1357
	if (beacon && sdata->vif.csa_active && !ifmgd->csa_waiting_bcn) {
		if (res)
			ieee80211_sta_abort_chanswitch(sdata);
		else
			drv_channel_switch_rx_beacon(sdata, &ch_switch);
1358 1359 1360 1361 1362
		return;
	} else if (sdata->vif.csa_active || res) {
		/* disregard subsequent announcements if already processing */
		return;
	}
1363

1364
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1365 1366 1367
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1368
			   ifmgd->associated->bssid,
1369 1370 1371
			   csa_ie.chandef.chan->center_freq,
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
			   csa_ie.chandef.center_freq2);
1372 1373 1374 1375 1376
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1377
	if (cfg80211_chandef_identical(&csa_ie.chandef,
1378 1379
				       &sdata->vif.bss_conf.chandef) &&
	    (!csa_ie.mode || !beacon)) {
1380 1381 1382 1383 1384 1385 1386 1387 1388
		if (ifmgd->csa_ignored_same_chan)
			return;
		sdata_info(sdata,
			   "AP %pM tries to chanswitch to same channel, ignore\n",
			   ifmgd->associated->bssid);
		ifmgd->csa_ignored_same_chan = true;
		return;
	}

1389 1390 1391 1392 1393 1394 1395 1396
	/*
	 * Drop all TDLS peers - either we disconnect or move to a different
	 * channel from this point on. There's no telling what our peer will do.
	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
	 * have an incompatible wider chandef.
	 */
	ieee80211_teardown_tdls_peers(sdata);

1397
	mutex_lock(&local->mtx);
1398
	mutex_lock(&local->chanctx_mtx);
1399 1400 1401 1402 1403
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
1404
		goto drop_connection;
1405 1406 1407 1408
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1409
	if (local->use_chanctx &&
1410
	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1411 1412
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
1413
		goto drop_connection;
J
Johannes Berg 已提交
1414 1415
	}

1416 1417 1418
	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
1419
		goto drop_connection;
1420 1421
	}

1422 1423 1424
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1425
		sdata_info(sdata,
1426 1427
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1428
		goto drop_connection;
J
Johannes Berg 已提交
1429
	}
1430
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1431

1432
	sdata->vif.csa_active = true;
1433
	sdata->csa_chandef = csa_ie.chandef;
1434
	sdata->csa_block_tx = csa_ie.mode;
1435
	ifmgd->csa_ignored_same_chan = false;
J
Johannes Berg 已提交
1436

1437
	if (sdata->csa_block_tx)
1438 1439
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1440
	mutex_unlock(&local->mtx);
1441

1442 1443 1444
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1445
	if (local->ops->channel_switch) {
1446
		/* use driver's channel switch callback */
1447
		drv_channel_switch(local, sdata, &ch_switch);
1448 1449 1450 1451
		return;
	}

	/* channel switch handled in software */
1452
	if (csa_ie.count <= 1)
1453
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1454
	else
1455
		mod_timer(&ifmgd->chswitch_timer,
1456 1457
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1458 1459
	return;
 drop_connection:
1460 1461 1462 1463 1464 1465 1466 1467
	/*
	 * This is just so that the disconnect flow will know that
	 * we were trying to switch channel and failed. In case the
	 * mode is 1 (we are not allowed to Tx), we will know not to
	 * send a deauthentication frame. Those two fields will be
	 * reset when the disconnection worker runs.
	 */
	sdata->vif.csa_active = true;
1468
	sdata->csa_block_tx = csa_ie.mode;
1469

1470 1471 1472
	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
1473 1474
}

1475 1476 1477 1478 1479 1480
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1481
{
1482 1483
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1484
	int i, chan_increment;
1485
	bool have_chan_pwr = false;
1486

1487 1488
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1489
		return false;
1490

1491 1492 1493 1494 1495 1496 1497
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
1498 1499
	case NL80211_BAND_2GHZ:
	case NL80211_BAND_60GHZ:
1500 1501
		chan_increment = 1;
		break;
1502
	case NL80211_BAND_5GHZ:
1503 1504
		chan_increment = 4;
		break;
1505
	}
1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1517
				*chan_pwr = triplet->chans.max_power;
1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1529
	if (have_chan_pwr && pwr_constr_elem)
1530
		*pwr_reduction = *pwr_constr_elem;
1531 1532 1533
	else
		*pwr_reduction = 0;

1534 1535 1536
	return have_chan_pwr;
}

1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1551 1552 1553 1554
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1555 1556
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1557
{
1558 1559 1560
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1561
	int new_ap_level;
1562
	__le16 capab = mgmt->u.probe_resp.capab_info;
1563

1564 1565 1566
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1567 1568 1569
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1570 1571 1572 1573 1574 1575 1576 1577
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1578
	}
1579

1580
	if (!has_80211h_pwr && !has_cisco_pwr)
1581
		return 0;
1582

1583 1584 1585 1586 1587
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1588 1589 1590 1591 1592
		new_ap_level = pwr_level_80211h;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1593 1594 1595 1596
		sdata_dbg(sdata,
			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			  sdata->u.mgd.bssid);
1597
	} else {  /* has_cisco_pwr is always true here. */
1598 1599 1600 1601 1602
		new_ap_level = pwr_level_cisco;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1603 1604 1605
		sdata_dbg(sdata,
			  "Limiting TX power to %d dBm as advertised by %pM\n",
			  pwr_level_cisco, sdata->u.mgd.bssid);
1606
	}
1607

1608 1609 1610 1611
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1612 1613
}

1614 1615 1616 1617 1618 1619
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1620 1621 1622 1623
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1624
	if (local->scanning)
J
Johannes Berg 已提交
1625 1626
		return;

1627
	if (conf->dynamic_ps_timeout > 0 &&
1628
	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1629 1630 1631
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
1632
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1633
			ieee80211_send_nullfunc(local, sdata, true);
1634

1635 1636
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1637 1638 1639 1640
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1658 1659 1660 1661
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1662
	bool authorized = false;
1663 1664 1665 1666

	if (!mgd->powersave)
		return false;

1667 1668 1669
	if (mgd->broken_ap)
		return false;

1670 1671 1672
	if (!mgd->associated)
		return false;

1673
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1674 1675
		return false;

1676
	if (!mgd->have_beacon)
1677 1678
		return false;

1679 1680 1681
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1682
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1683 1684
	rcu_read_unlock();

J
Johannes Berg 已提交
1685
	return authorized;
1686 1687
}

1688
/* need to hold RTNL or interface lock */
J
Johannes Berg 已提交
1689
void ieee80211_recalc_ps(struct ieee80211_local *local)
1690 1691 1692
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1693
	int timeout;
1694

1695
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1696 1697 1698 1699 1700
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1701
		if (!ieee80211_sdata_running(sdata))
1702
			continue;
1703 1704 1705 1706 1707 1708 1709 1710
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1711 1712 1713 1714 1715 1716
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1717
	if (count == 1 && ieee80211_powersave_allowed(found)) {
J
Johannes Berg 已提交
1718
		u8 dtimper = found->u.mgd.dtim_period;
1719

1720
		timeout = local->dynamic_ps_forced_timeout;
J
Johannes Berg 已提交
1721 1722
		if (timeout < 0)
			timeout = 100;
1723
		local->hw.conf.dynamic_ps_timeout = timeout;
1724

J
Johannes Berg 已提交
1725 1726 1727 1728 1729 1730
		/* If the TIM IE is invalid, pretend the value is 1 */
		if (!dtimper)
			dtimper = 1;

		local->hw.conf.ps_dtim_period = dtimper;
		local->ps_sdata = found;
1731
	} else {
1732
		local->ps_sdata = NULL;
1733
	}
1734 1735 1736 1737

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1738 1739 1740 1741 1742 1743 1744 1745 1746 1747
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1760
					IEEE80211_MAX_QUEUE_MAP,
1761 1762
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1763 1764 1765 1766 1767 1768 1769 1770
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1771
	struct ieee80211_if_managed *ifmgd;
1772 1773
	unsigned long flags;
	int q;
1774 1775 1776 1777 1778

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1779 1780
	ifmgd = &sdata->u.mgd;

1781 1782 1783
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1784
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1785 1786
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1787 1788 1789 1790 1791
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1810 1811
	}

1812
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1813
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1814
		if (drv_tx_frames_pending(local)) {
1815 1816 1817
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1818
		} else {
1819
			ieee80211_send_nullfunc(local, sdata, true);
1820
			/* Flush to get the tx status of nullfunc frame */
1821
			ieee80211_flush_queues(local, sdata, false);
1822
		}
1823 1824
	}

1825 1826
	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1827 1828 1829 1830 1831
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1832 1833
}

1834
void ieee80211_dynamic_ps_timer(struct timer_list *t)
1835
{
1836
	struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
1837

1838
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1839 1840
}

1841 1842
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
1843
	struct delayed_work *delayed_work = to_delayed_work(work);
1844 1845 1846
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1847
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1848

1849 1850 1851 1852 1853 1854 1855 1856
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1857 1858
}

1859 1860 1861 1862 1863
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1864
	bool ret = false;
1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
1909 1910 1911 1912 1913 1914
			/* Usually the loop will result in using BK even if it
			 * requires admission control, but such a configuration
			 * makes no sense and we have to transmit somehow - the
			 * AC selection does the same thing.
			 * If we started out trying to downgrade from BK, then
			 * the extra condition here might be needed.
1915
			 */
1916 1917
			if (non_acm_ac >= IEEE80211_NUM_ACS)
				non_acm_ac = IEEE80211_AC_BK;
1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1952
/* MLME */
L
Luca Coelho 已提交
1953 1954 1955 1956 1957
static bool
ieee80211_sta_wmm_params(struct ieee80211_local *local,
			 struct ieee80211_sub_if_data *sdata,
			 const u8 *wmm_param, size_t wmm_param_len,
			 const struct ieee80211_mu_edca_param_set *mu_edca)
1958
{
1959
	struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1960
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1961
	size_t left;
1962
	int count, mu_edca_count, ac;
J
Johannes Berg 已提交
1963 1964
	const u8 *pos;
	u8 uapsd_queues = 0;
1965

1966
	if (!local->ops->conf_tx)
1967
		return false;
1968

J
Johannes Berg 已提交
1969
	if (local->hw.queues < IEEE80211_NUM_ACS)
1970
		return false;
1971 1972

	if (!wmm_param)
1973
		return false;
1974

1975
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1976
		return false;
K
Kalle Valo 已提交
1977 1978

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1979
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
1980

1981
	count = wmm_param[6] & 0x0f;
1982 1983 1984 1985 1986 1987 1988
	/* -1 is the initial value of ifmgd->mu_edca_last_param_set.
	 * if mu_edca was preset before and now it disappeared tell
	 * the driver about it.
	 */
	mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
	if (count == ifmgd->wmm_last_param_set &&
	    mu_edca_count == ifmgd->mu_edca_last_param_set)
1989
		return false;
1990
	ifmgd->wmm_last_param_set = count;
1991
	ifmgd->mu_edca_last_param_set = mu_edca_count;
1992 1993 1994 1995 1996 1997

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
1998
	sdata->wmm_acm = 0;
1999 2000 2001
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
2002
		bool uapsd = false;
2003 2004

		switch (aci) {
2005
		case 1: /* AC_BK */
2006
			ac = IEEE80211_AC_BK;
J
Johannes Berg 已提交
2007
			if (acm)
Y
Yoni Divinsky 已提交
2008
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
2009 2010
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
L
Luca Coelho 已提交
2011 2012 2013
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2014
			break;
2015
		case 2: /* AC_VI */
2016
			ac = IEEE80211_AC_VI;
J
Johannes Berg 已提交
2017
			if (acm)
Y
Yoni Divinsky 已提交
2018
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
2019 2020
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
L
Luca Coelho 已提交
2021 2022 2023
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2024
			break;
2025
		case 3: /* AC_VO */
2026
			ac = IEEE80211_AC_VO;
J
Johannes Berg 已提交
2027
			if (acm)
Y
Yoni Divinsky 已提交
2028
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
2029 2030
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
L
Luca Coelho 已提交
2031 2032 2033
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2034
			break;
2035
		case 0: /* AC_BE */
2036
		default:
2037
			ac = IEEE80211_AC_BE;
J
Johannes Berg 已提交
2038
			if (acm)
Y
Yoni Divinsky 已提交
2039
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
2040 2041
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
L
Luca Coelho 已提交
2042 2043 2044
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_be;
2045 2046 2047
			break;
		}

2048
		params[ac].aifs = pos[0] & 0x0f;
2049

2050
		if (params[ac].aifs < 2) {
2051 2052
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2053 2054
				   params[ac].aifs, aci);
			params[ac].aifs = 2;
2055
		}
2056 2057 2058 2059 2060
		params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
		params[ac].txop = get_unaligned_le16(pos + 2);
		params[ac].acm = acm;
		params[ac].uapsd = uapsd;
K
Kalle Valo 已提交
2061

2062
		if (params[ac].cw_min == 0 ||
2063
		    params[ac].cw_min > params[ac].cw_max) {
2064 2065 2066 2067 2068
			sdata_info(sdata,
				   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
				   params[ac].cw_min, params[ac].cw_max, aci);
			return false;
		}
2069
		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2070 2071
	}

2072 2073 2074 2075 2076 2077 2078 2079 2080 2081
	/* WMM specification requires all 4 ACIs. */
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		if (params[ac].cw_min == 0) {
			sdata_info(sdata,
				   "AP has invalid WMM params (missing AC %d), using defaults\n",
				   ac);
			return false;
		}
	}

2082
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
J
Johannes Berg 已提交
2083
		mlme_dbg(sdata,
2084 2085 2086 2087 2088 2089 2090 2091
			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
			 ac, params[ac].acm,
			 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
			 params[ac].txop, params[ac].uapsd,
			 ifmgd->tx_tspec[ac].downgraded);
		sdata->tx_conf[ac] = params[ac];
		if (!ifmgd->tx_tspec[ac].downgraded &&
		    drv_conf_tx(local, sdata, ac, &params[ac]))
J
Johannes Berg 已提交
2092
			sdata_err(sdata,
2093 2094
				  "failed to set TX queue parameters for AC %d\n",
				  ac);
2095
	}
2096 2097

	/* enable WMM or activate new settings */
2098
	sdata->vif.bss_conf.qos = true;
2099
	return true;
2100 2101
}

2102 2103 2104 2105
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

2106
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2107 2108 2109 2110 2111 2112 2113 2114 2115 2116
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
2117 2118
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
2119
{
J
Johannes Berg 已提交
2120
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2121
	struct ieee80211_supported_band *sband;
2122
	u32 changed = 0;
J
Johannes Berg 已提交
2123 2124 2125 2126
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

2127 2128 2129 2130
	sband = ieee80211_get_sband(sdata);
	if (!sband)
		return changed;

J
Johannes Berg 已提交
2131 2132 2133 2134 2135 2136 2137 2138 2139
	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2140
	if (sband->band == NL80211_BAND_5GHZ)
2141
		use_short_slot = true;
2142

2143 2144 2145
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
2146
	}
2147

2148 2149
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
2150
		changed |= BSS_CHANGED_ERP_PREAMBLE;
2151
	}
2152

J
Johannes Berg 已提交
2153 2154 2155
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
2156 2157 2158 2159 2160
	}

	return changed;
}

2161
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2162
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2163
				     u32 bss_info_changed)
2164
{
2165
	struct ieee80211_bss *bss = (void *)cbss->priv;
2166
	struct ieee80211_local *local = sdata->local;
2167
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2168

J
Johannes Berg 已提交
2169
	bss_info_changed |= BSS_CHANGED_ASSOC;
2170
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
2171
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
2172

2173
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
2174
		beacon_loss_count * bss_conf->beacon_int));
2175

2176 2177
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2178

2179 2180
	ieee80211_check_rate_mask(sdata);

2181 2182
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

2183 2184
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2185
		const struct cfg80211_bss_ies *ies;
2186

2187 2188 2189 2190 2191 2192 2193 2194
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
2195 2196
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
2197
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
2198 2199
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
2200 2201
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
2202
		}
2203
		rcu_read_unlock();
2204 2205
	}

J
Johannes Berg 已提交
2206
	/* just to be sure */
2207
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
2208

2209
	ieee80211_led_assoc(local, 1);
2210

2211
	if (sdata->u.mgd.have_beacon) {
2212 2213 2214 2215 2216 2217 2218
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
2219
		bss_conf->beacon_rate = bss->beacon_rate;
2220
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
2221
	} else {
2222
		bss_conf->beacon_rate = NULL;
2223
		bss_conf->dtim_period = 0;
2224
	}
2225

2226
	bss_conf->assoc = 1;
2227

2228
	/* Tell the driver to monitor connection quality (if supported) */
2229
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2230
	    bss_conf->cqm_rssi_thold)
2231 2232
		bss_info_changed |= BSS_CHANGED_CQM;

2233
	/* Enable ARP filtering */
2234
	if (bss_conf->arp_addr_cnt)
2235 2236
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
2237
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
2238

J
Johannes Berg 已提交
2239
	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2240
	ieee80211_recalc_ps(local);
J
Johannes Berg 已提交
2241
	mutex_unlock(&local->iflist_mtx);
2242

2243
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
2244 2245
	ieee80211_recalc_ps_vif(sdata);

2246
	netif_carrier_on(sdata->dev);
2247 2248
}

2249
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2250 2251
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
2252
{
2253
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2254
	struct ieee80211_local *local = sdata->local;
2255
	u32 changed = 0;
2256

2257
	sdata_assert_lock(sdata);
2258

2259 2260 2261
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
2262 2263 2264
	if (WARN_ON(!ifmgd->associated))
		return;

2265 2266
	ieee80211_stop_poll(sdata);

2267
	ifmgd->associated = NULL;
2268 2269
	netif_carrier_off(sdata->dev);

2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2281 2282 2283
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2284 2285 2286
	/* make sure ongoing transmission finishes */
	synchronize_net();

2287 2288 2289 2290 2291 2292
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2293
	if (tx)
2294
		ieee80211_flush_queues(local, sdata, true);
2295

2296
	/* deauthenticate/disassociate now */
2297 2298 2299 2300 2301 2302 2303 2304 2305
	if (tx || frame_buf) {
		/*
		 * In multi channel scenarios guarantee that the virtual
		 * interface is granted immediate airtime to transmit the
		 * deauthentication frame by calling mgd_prepare_tx, if the
		 * driver requested so.
		 */
		if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
		    !ifmgd->have_beacon)
2306
			drv_mgd_prepare_tx(sdata->local, sdata, 0);
2307

2308 2309 2310
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid,
					       ifmgd->bssid, stype, reason,
					       tx, frame_buf);
2311
	}
2312

2313
	/* flush out frame - make sure the deauth was actually sent */
2314
	if (tx)
2315
		ieee80211_flush_queues(local, sdata, false);
2316

2317
	/* clear bssid only after building the needed mgmt frames */
2318
	eth_zero_addr(ifmgd->bssid);
2319

2320
	/* remove AP and TDLS peers */
2321
	sta_info_flush(sdata);
2322 2323

	/* finally reset all BSS / config parameters */
2324 2325 2326
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2327 2328
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2329

J
Janusz Dziedzic 已提交
2330 2331 2332
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2333

2334
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2335 2336
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2337 2338
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2339 2340 2341 2342 2343 2344 2345

	/* reset MU-MIMO ownership and group data */
	memset(sdata->vif.bss_conf.mu_group.membership, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.membership));
	memset(sdata->vif.bss_conf.mu_group.position, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.position));
	changed |= BSS_CHANGED_MU_GROUPS;
2346
	sdata->vif.mu_mimo_owner = false;
2347

2348
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2349

2350 2351 2352
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2353
	/* Disable ARP filtering */
2354
	if (sdata->vif.bss_conf.arp_addr_cnt)
2355 2356
		changed |= BSS_CHANGED_ARP_FILTER;

2357 2358 2359
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2360 2361
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2362
	ieee80211_bss_info_change_notify(sdata, changed);
2363

2364
	/* disassociated - set to defaults now */
2365
	ieee80211_set_wmm_default(sdata, false, false);
2366

2367 2368 2369 2370
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2371

2372
	sdata->vif.bss_conf.dtim_period = 0;
2373 2374
	sdata->vif.bss_conf.beacon_rate = NULL;

2375
	ifmgd->have_beacon = false;
2376

2377
	ifmgd->flags = 0;
2378
	mutex_lock(&local->mtx);
2379
	ieee80211_vif_release_channel(sdata);
2380 2381

	sdata->vif.csa_active = false;
2382
	ifmgd->csa_waiting_bcn = false;
2383
	ifmgd->csa_ignored_same_chan = false;
2384 2385 2386 2387 2388
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2389
	mutex_unlock(&local->mtx);
2390

2391 2392 2393 2394
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2395
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2396
}
2397

2398 2399 2400 2401 2402 2403 2404 2405
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2406 2407
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2408
	 */
J
Johannes Berg 已提交
2409 2410 2411
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2412
	ieee80211_sta_reset_conn_monitor(sdata);
2413
}
2414

2415 2416 2417
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2418
	struct ieee80211_local *local = sdata->local;
2419

2420
	mutex_lock(&local->mtx);
2421 2422
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2423

2424
	__ieee80211_stop_poll(sdata);
2425 2426

	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2427
	ieee80211_recalc_ps(local);
2428
	mutex_unlock(&local->iflist_mtx);
2429

2430
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2431
		goto out;
2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2443 2444
out:
	mutex_unlock(&local->mtx);
2445 2446
}

2447 2448 2449 2450 2451
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
S
Sara Sharon 已提交
2452
	u16 tid = ieee80211_get_tid(hdr);
2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2482
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2483
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2484
{
2485 2486
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2487
	if (!ieee80211_is_data(hdr->frame_control))
2488 2489
	    return;

2490
	if (ieee80211_is_any_nullfunc(hdr->frame_control) &&
2491
	    sdata->u.mgd.probe_send_count > 0) {
2492
		if (ack)
2493
			ieee80211_sta_reset_conn_monitor(sdata);
2494 2495
		else
			sdata->u.mgd.nullfunc_failed = true;
2496
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2497
		return;
2498
	}
2499 2500 2501

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2502 2503
}

2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517
static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
					  const u8 *src, const u8 *dst,
					  const u8 *ssid, size_t ssid_len,
					  struct ieee80211_channel *channel)
{
	struct sk_buff *skb;

	skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
					ssid, ssid_len, NULL, 0,
					IEEE80211_PROBE_FLAG_DIRECTED);
	if (skb)
		ieee80211_tx_skb(sdata, skb);
}

2518 2519 2520 2521
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2522
	u8 *dst = ifmgd->associated->bssid;
2523
	u8 unicast_limit = max(1, max_probe_tries - 3);
J
Johannes Berg 已提交
2524
	struct sta_info *sta;
2525 2526 2527 2528 2529 2530 2531 2532

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2533

2534 2535 2536 2537 2538 2539 2540
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2541 2542
	ifmgd->probe_send_count++;

J
Johannes Berg 已提交
2543 2544 2545 2546 2547 2548 2549 2550
	if (dst) {
		mutex_lock(&sdata->local->sta_mtx);
		sta = sta_info_get(sdata, dst);
		if (!WARN_ON(!sta))
			ieee80211_check_fast_rx(sta);
		mutex_unlock(&sdata->local->sta_mtx);
	}

2551
	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2552
		ifmgd->nullfunc_failed = false;
2553 2554 2555 2556
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
			ifmgd->probe_send_count--;
		else
			ieee80211_send_nullfunc(sdata->local, sdata, false);
2557
	} else {
2558 2559
		int ssid_len;

2560
		rcu_read_lock();
2561
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2562 2563 2564 2565 2566
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2567 2568 2569
		ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
					      ssid + 2, ssid_len,
					      ifmgd->associated->channel);
2570
		rcu_read_unlock();
2571
	}
2572

2573
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2574
	run_again(sdata, ifmgd->probe_timeout);
2575 2576
}

J
Johannes Berg 已提交
2577 2578
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2579 2580
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2581
	bool already = false;
2582

2583
	if (!ieee80211_sdata_running(sdata))
2584 2585
		return;

2586
	sdata_lock(sdata);
2587 2588 2589 2590

	if (!ifmgd->associated)
		goto out;

2591 2592 2593 2594 2595 2596 2597
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2598
	if (beacon) {
J
Johannes Berg 已提交
2599
		mlme_dbg_ratelimited(sdata,
2600 2601
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2602

2603
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2604
	}
2605

J
Johannes Berg 已提交
2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2617
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2618 2619
		already = true;

E
Eliad Peller 已提交
2620 2621
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2622 2623
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2624 2625 2626
	if (already)
		goto out;

2627
	mutex_lock(&sdata->local->iflist_mtx);
J
Johannes Berg 已提交
2628
	ieee80211_recalc_ps(sdata->local);
2629 2630
	mutex_unlock(&sdata->local->iflist_mtx);

2631 2632
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2633
 out:
2634
	sdata_unlock(sdata);
2635 2636
}

2637 2638 2639 2640 2641
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2642
	struct cfg80211_bss *cbss;
2643 2644
	struct sk_buff *skb;
	const u8 *ssid;
2645
	int ssid_len;
2646 2647 2648 2649

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2650
	sdata_assert_lock(sdata);
2651

2652 2653 2654 2655 2656 2657 2658
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2659 2660
		return NULL;

2661
	rcu_read_lock();
2662
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2663 2664
	if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
		      "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
2665 2666 2667 2668
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2669
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2670
					(u32) -1, cbss->channel,
2671
					ssid + 2, ssid_len,
2672
					NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
2673
	rcu_read_unlock();
2674 2675 2676 2677 2678

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696
static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
					const u8 *buf, size_t len, bool tx,
					u16 reason)
{
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
		.u.mlme.reason = reason,
	};

	if (tx)
		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
	else
		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);

	drv_event_callback(sdata->local, sdata, &event);
}

2697
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2698
{
2699
	struct ieee80211_local *local = sdata->local;
2700
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2701
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2702
	bool tx;
2703

2704
	sdata_lock(sdata);
2705
	if (!ifmgd->associated) {
2706
		sdata_unlock(sdata);
2707 2708 2709
		return;
	}

2710 2711
	tx = !sdata->csa_block_tx;

2712 2713 2714 2715 2716
	/* AP is probably out of range (or not reachable for another reason) so
	 * remove the bss struct for that AP.
	 */
	cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);

2717 2718
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2719
			       tx, frame_buf);
2720
	mutex_lock(&local->mtx);
2721
	sdata->vif.csa_active = false;
2722
	ifmgd->csa_waiting_bcn = false;
2723 2724 2725 2726 2727
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2728
	mutex_unlock(&local->mtx);
2729

2730
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
2731 2732
				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);

2733
	sdata_unlock(sdata);
2734 2735
}

2736
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2737 2738 2739
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2740
			     u.mgd.beacon_connection_loss_work);
2741 2742
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

2743 2744
	if (ifmgd->associated)
		ifmgd->beacon_loss_count++;
J
Johannes Berg 已提交
2745

2746
	if (ifmgd->connection_loss) {
2747 2748
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2749
		__ieee80211_disconnect(sdata);
2750
	} else {
2751
		ieee80211_mgd_probe_ap(sdata, true);
2752 2753 2754 2755 2756 2757 2758 2759 2760
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2761
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2762 2763
}

2764 2765 2766
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2767
	struct ieee80211_hw *hw = &sdata->local->hw;
2768

J
Johannes Berg 已提交
2769 2770
	trace_api_beacon_loss(sdata);

2771
	sdata->u.mgd.connection_loss = false;
2772
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2773 2774 2775
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2776 2777 2778 2779 2780
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2781 2782
	trace_api_connection_loss(sdata);

2783
	sdata->u.mgd.connection_loss = true;
2784 2785 2786 2787 2788
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2789 2790 2791 2792 2793
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2794
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2795 2796

	if (!assoc) {
2797 2798 2799 2800 2801 2802
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2803 2804
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

2805
		eth_zero_addr(sdata->u.mgd.bssid);
J
Johannes Berg 已提交
2806
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2807
		sdata->u.mgd.flags = 0;
2808
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2809
		ieee80211_vif_release_channel(sdata);
2810
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2811 2812
	}

2813
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2814 2815 2816 2817
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

2818
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2819
					 bool assoc, bool abandon)
2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

	sdata_assert_lock(sdata);

	if (!assoc) {
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		eth_zero_addr(sdata->u.mgd.bssid);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
		sdata->u.mgd.flags = 0;
2837 2838
		sdata->vif.mu_mimo_owner = false;

2839 2840 2841
		mutex_lock(&sdata->local->mtx);
		ieee80211_vif_release_channel(sdata);
		mutex_unlock(&sdata->local->mtx);
2842 2843 2844

		if (abandon)
			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
2845 2846 2847 2848 2849 2850
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

J
Johannes Berg 已提交
2851 2852 2853
static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2854
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2855 2856 2857
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2858
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2859 2860

	pos = mgmt->u.auth.variable;
2861 2862
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, auth_data->bss->bssid);
J
Johannes Berg 已提交
2863 2864 2865
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
2866
	drv_mgd_prepare_tx(sdata->local, sdata, 0);
2867
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2868 2869
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2870
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2871 2872 2873
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2874
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2875 2876
}

2877 2878 2879
static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
				    const u8 *bssid)
{
2880
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2881
	struct sta_info *sta;
2882
	bool result = true;
2883

2884 2885 2886 2887 2888 2889
	sdata_info(sdata, "authenticated\n");
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
	ifmgd->auth_data->timeout_started = true;
	run_again(sdata, ifmgd->auth_data->timeout);

2890 2891 2892 2893 2894
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2895 2896
		result = false;
		goto out;
2897 2898 2899
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2900 2901
		result = false;
		goto out;
2902 2903
	}

2904 2905 2906
out:
	mutex_unlock(&sdata->local->sta_mtx);
	return result;
2907 2908
}

2909 2910
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2911 2912 2913 2914
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
2915 2916 2917 2918
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = AUTH_EVENT,
	};
J
Johannes Berg 已提交
2919

2920
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2921 2922

	if (len < 24 + 6)
2923
		return;
J
Johannes Berg 已提交
2924 2925

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2926
		return;
J
Johannes Berg 已提交
2927 2928 2929

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2930
	if (!ether_addr_equal(bssid, mgmt->bssid))
2931
		return;
J
Johannes Berg 已提交
2932 2933 2934 2935 2936 2937

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2938 2939 2940 2941 2942
	    (auth_alg != WLAN_AUTH_SAE &&
	     auth_transaction != ifmgd->auth_data->expected_transaction) ||
	    (auth_alg == WLAN_AUTH_SAE &&
	     (auth_transaction < ifmgd->auth_data->expected_transaction ||
	      auth_transaction > 2))) {
2943 2944 2945 2946
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2947
		return;
2948
	}
J
Johannes Berg 已提交
2949 2950

	if (status_code != WLAN_STATUS_SUCCESS) {
2951 2952 2953 2954 2955 2956
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);

		if (auth_alg == WLAN_AUTH_SAE &&
		    status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED)
			return;

J
Johannes Berg 已提交
2957 2958
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2959
		ieee80211_destroy_auth_data(sdata, false);
2960 2961 2962
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
2963
		return;
J
Johannes Berg 已提交
2964 2965 2966 2967 2968 2969
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
2970
	case WLAN_AUTH_SAE:
2971 2972 2973
	case WLAN_AUTH_FILS_SK:
	case WLAN_AUTH_FILS_SK_PFS:
	case WLAN_AUTH_FILS_PK:
J
Johannes Berg 已提交
2974 2975 2976 2977 2978
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
2979
			return;
J
Johannes Berg 已提交
2980 2981 2982 2983 2984
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
2985
		return;
J
Johannes Berg 已提交
2986 2987
	}

2988 2989
	event.u.mlme.status = MLME_SUCCESS;
	drv_event_callback(sdata->local, sdata, &event);
2990 2991 2992 2993
	if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
	    (auth_transaction == 2 &&
	     ifmgd->auth_data->expected_transaction == 2)) {
		if (!ieee80211_mark_sta_auth(sdata, bssid))
2994
			return; /* ignore frame -- wait for timeout */
2995 2996 2997 2998
	} else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
		   auth_transaction == 2) {
		sdata_info(sdata, "SAE peer confirmed\n");
		ifmgd->auth_data->peer_confirmed = true;
2999 3000
	}

3001
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
J
Johannes Berg 已提交
3002 3003
}

3004 3005 3006
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

3007
const char *ieee80211_get_reason_code_string(u16 reason_code)
3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
3060

3061 3062
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
3063
{
3064
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3065
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3066

3067
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3068

3069
	if (len < 24 + 2)
3070
		return;
3071

3072 3073 3074 3075 3076
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3077 3078 3079
	if (ifmgd->associated &&
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
		const u8 *bssid = ifmgd->associated->bssid;
3080

3081 3082 3083
		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));
3084

3085
		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3086

3087 3088 3089 3090
		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
					    reason_code);
		return;
	}
3091

3092 3093 3094
	if (ifmgd->assoc_data &&
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
		const u8 *bssid = ifmgd->assoc_data->bss->bssid;
3095

3096 3097 3098 3099 3100
		sdata_info(sdata,
			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));

3101
		ieee80211_destroy_assoc_data(sdata, false, true);
3102 3103 3104 3105

		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
		return;
	}
3106 3107 3108
}


3109 3110
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
3111
{
3112
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3113 3114
	u16 reason_code;

3115
	sdata_assert_lock(sdata);
3116

J
Johannes Berg 已提交
3117
	if (len < 24 + 2)
3118
		return;
3119

J
Johannes Berg 已提交
3120
	if (!ifmgd->associated ||
3121
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3122
		return;
3123 3124 3125

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

3126 3127 3128 3129 3130
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3131 3132 3133
	sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
		   mgmt->sa, reason_code,
		   ieee80211_get_reason_code_string(reason_code));
3134

3135 3136
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

3137
	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
3138 3139
}

3140 3141 3142 3143
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
3144
				int *min_rate, int *min_rate_index,
3145
				int shift)
3146 3147 3148 3149
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
3150
		int rate = supp_rates[i] & 0x7f;
3151 3152
		bool is_basic = !!(supp_rates[i] & 0x80);

3153
		if ((rate * 5 * (1 << shift)) > 110)
3154 3155 3156
			*have_higher_than_11mbit = true;

		/*
3157 3158
		 * Skip HT and VHT BSS membership selectors since they're not
		 * rates.
3159
		 *
3160
		 * Note: Even though the membership selector and the basic
3161 3162 3163
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
3164 3165
		if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY))
3166 3167 3168
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
3169 3170 3171 3172 3173 3174 3175
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
3176 3177 3178
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
3179 3180
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
3181 3182 3183 3184 3185 3186 3187
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
3188

3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200 3201
static bool ieee80211_twt_req_supported(const struct sta_info *sta,
					const struct ieee802_11_elems *elems)
{
	if (elems->ext_capab_len < 10)
		return false;

	if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
		return false;

	return sta->sta.he_cap.he_cap_elem.mac_cap_info[0] &
		IEEE80211_HE_MAC_CAP0_TWT_RES;
}

3202 3203 3204 3205 3206 3207 3208 3209 3210 3211 3212 3213 3214
static int ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee802_11_elems *elems)
{
	bool twt = ieee80211_twt_req_supported(sta, elems);

	if (sdata->vif.bss_conf.twt_requester != twt) {
		sdata->vif.bss_conf.twt_requester = twt;
		return BSS_CHANGED_TWT;
	}
	return 0;
}

J
Johannes Berg 已提交
3215 3216
static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
3217 3218
				    struct ieee80211_mgmt *mgmt, size_t len,
				    struct ieee802_11_elems *elems)
3219
{
3220
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3221
	struct ieee80211_local *local = sdata->local;
3222
	struct ieee80211_supported_band *sband;
3223
	struct sta_info *sta;
J
Johannes Berg 已提交
3224
	u16 capab_info, aid;
J
Johannes Berg 已提交
3225
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3226 3227
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
J
Johannes Berg 已提交
3228
	u32 changed = 0;
3229
	int err;
3230
	bool ret;
3231

J
Johannes Berg 已提交
3232
	/* AssocResp and ReassocResp have identical structure */
3233 3234

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
3235
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3236

3237 3238 3239 3240 3241
	/*
	 * The 5 MSB of the AID field are reserved
	 * (802.11-2016 9.4.1.8 AID field)
	 */
	aid &= 0x7ff;
3242

3243 3244 3245
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
3246 3247
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
3248 3249 3250 3251
		aid = 0;
		ifmgd->broken_ap = true;
	}

3252
	if (!elems->supp_rates) {
J
Johannes Berg 已提交
3253
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
3254
		return false;
3255 3256
	}

3257
	sdata->vif.bss_conf.aid = aid;
3258
	ifmgd->tdls_chan_switch_prohibited =
3259 3260
		elems->ext_capab && elems->ext_capab_len >= 5 &&
		(elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
3261

3262 3263 3264 3265 3266 3267 3268
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
3269
	if ((assoc_data->wmm && !elems->wmm_param) ||
3270
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3271
	     (!elems->ht_cap_elem || !elems->ht_operation)) ||
3272
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3273
	     (!elems->vht_cap_elem || !elems->vht_operation))) {
3274 3275 3276 3277 3278 3279 3280 3281 3282 3283 3284 3285 3286
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
3287 3288 3289
				       false, &bss_elems,
				       mgmt->bssid,
				       assoc_data->bss->bssid);
3290
		if (assoc_data->wmm &&
3291 3292
		    !elems->wmm_param && bss_elems.wmm_param) {
			elems->wmm_param = bss_elems.wmm_param;
3293 3294 3295 3296 3297 3298 3299 3300
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
3301
		if (!elems->ht_cap_elem && bss_elems.ht_cap_elem &&
3302
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3303
			elems->ht_cap_elem = bss_elems.ht_cap_elem;
3304 3305 3306
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
3307
		if (!elems->ht_operation && bss_elems.ht_operation &&
3308
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3309
			elems->ht_operation = bss_elems.ht_operation;
3310 3311 3312
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
3313
		if (!elems->vht_cap_elem && bss_elems.vht_cap_elem &&
3314
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3315
			elems->vht_cap_elem = bss_elems.vht_cap_elem;
3316 3317 3318
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
3319
		if (!elems->vht_operation && bss_elems.vht_operation &&
3320
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3321
			elems->vht_operation = bss_elems.vht_operation;
3322 3323 3324 3325 3326
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

3327 3328 3329 3330 3331
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3332
	    (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
3333
		sdata_info(sdata,
3334 3335 3336
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
3337 3338 3339
	}

	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3340
	    (!elems->vht_cap_elem || !elems->vht_operation)) {
3341
		sdata_info(sdata,
3342 3343 3344
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
3345 3346
	}

3347 3348 3349 3350 3351
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
3352
	sta = sta_info_get(sdata, cbss->bssid);
3353 3354
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
3355 3356
		ret = false;
		goto out;
3357
	}
3358

3359 3360 3361 3362 3363 3364
	sband = ieee80211_get_sband(sdata);
	if (!sband) {
		mutex_unlock(&sdata->local->sta_mtx);
		ret = false;
		goto out;
	}
3365

L
Luca Coelho 已提交
3366
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3367
	    (!elems->he_cap || !elems->he_operation)) {
L
Luca Coelho 已提交
3368 3369 3370 3371 3372 3373 3374
		mutex_unlock(&sdata->local->sta_mtx);
		sdata_info(sdata,
			   "HE AP is missing HE capability/operation\n");
		ret = false;
		goto out;
	}

3375
	/* Set up internal HT/VHT capabilities */
3376
	if (elems->ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
3377
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3378
						  elems->ht_cap_elem, sta);
3379

3380
	if (elems->vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
M
Mahesh Palivela 已提交
3381
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3382
						    elems->vht_cap_elem, sta);
M
Mahesh Palivela 已提交
3383

3384 3385
	if (elems->he_operation && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
	    elems->he_cap) {
L
Luca Coelho 已提交
3386
		ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
3387 3388
						  elems->he_cap,
						  elems->he_cap_len,
L
Luca Coelho 已提交
3389 3390 3391
						  sta);

		bss_conf->he_support = sta->sta.he_cap.has_he;
3392 3393 3394 3395 3396 3397 3398 3399
		if (elems->rsnx && elems->rsnx_len &&
		    (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
		    wiphy_ext_feature_isset(local->hw.wiphy,
					    NL80211_EXT_FEATURE_PROTECTED_TWT))
			bss_conf->twt_protected = true;
		else
			bss_conf->twt_protected = false;

3400
		changed |= ieee80211_recalc_twt_req(sdata, sta, elems);
L
Luca Coelho 已提交
3401 3402
	} else {
		bss_conf->he_support = false;
3403
		bss_conf->twt_requester = false;
3404
		bss_conf->twt_protected = false;
L
Luca Coelho 已提交
3405 3406 3407
	}

	if (bss_conf->he_support) {
3408
		bss_conf->he_bss_color.color =
3409
			le32_get_bits(elems->he_operation->he_oper_params,
3410
				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3411 3412 3413 3414 3415 3416 3417
		bss_conf->he_bss_color.partial =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
		bss_conf->he_bss_color.disabled =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
		changed |= BSS_CHANGED_HE_BSS_COLOR;
L
Luca Coelho 已提交
3418 3419

		bss_conf->htc_trig_based_pkt_ext =
3420
			le32_get_bits(elems->he_operation->he_oper_params,
3421
			      IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
L
Luca Coelho 已提交
3422
		bss_conf->frame_time_rts_th =
3423
			le32_get_bits(elems->he_operation->he_oper_params,
3424
			      IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
L
Luca Coelho 已提交
3425 3426 3427 3428 3429 3430 3431 3432 3433

		bss_conf->multi_sta_back_32bit =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP;

		bss_conf->ack_enabled =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_ACK_EN;

3434 3435 3436
		bss_conf->uora_exists = !!elems->uora_element;
		if (elems->uora_element)
			bss_conf->uora_ocw_range = elems->uora_element[0];
L
Luca Coelho 已提交
3437

3438 3439
		ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
		ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
L
Luca Coelho 已提交
3440 3441 3442
		/* TODO: OPEN: what happens if BSS color disable is set? */
	}

S
Sara Sharon 已提交
3443 3444 3445 3446 3447 3448 3449 3450
	if (cbss->transmitted_bss) {
		bss_conf->nontransmitted = true;
		ether_addr_copy(bss_conf->transmitter_bssid,
				cbss->transmitted_bss->bssid);
		bss_conf->bssid_indicator = cbss->max_bssid_indicator;
		bss_conf->bssid_index = cbss->bssid_index;
	}

3451 3452 3453 3454 3455 3456
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
3457

3458 3459 3460 3461 3462
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
3463 3464
	if (elems->opmode_notif &&
	    !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
3465 3466
		u8 nss;

3467
		nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
3468 3469 3470 3471 3472
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

3473
	rate_control_rate_init(sta);
3474

3475
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
J
Johannes Berg 已提交
3476
		set_sta_flag(sta, WLAN_STA_MFP);
3477 3478 3479 3480
		sta->sta.mfp = true;
	} else {
		sta->sta.mfp = false;
	}
3481

3482
	sta->sta.wme = elems->wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3483

3484
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3485 3486 3487
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
3488 3489 3490
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
3491 3492
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
3493 3494
		ret = false;
		goto out;
3495 3496
	}

3497
	mutex_unlock(&sdata->local->sta_mtx);
3498

3499 3500 3501 3502 3503 3504 3505
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;
3506
	ifmgd->mu_edca_last_param_set = -1;
3507

3508
	if (ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
3509
		ieee80211_set_wmm_default(sdata, false, false);
3510 3511 3512
	} else if (!ieee80211_sta_wmm_params(local, sdata, elems->wmm_param,
					     elems->wmm_param_len,
					     elems->mu_edca_param_set)) {
3513 3514 3515 3516 3517 3518 3519 3520 3521 3522 3523
		/* still enable QoS since we might have HT/VHT */
		ieee80211_set_wmm_default(sdata, false, true);
		/* set the disable-WMM flag in this case to disable
		 * tracking WMM parameter changes in the beacon if
		 * the parameters weren't actually valid. Doing so
		 * avoids changing parameters very strangely when
		 * the AP is going back and forth between valid and
		 * invalid parameters.
		 */
		ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
	}
3524
	changed |= BSS_CHANGED_QOS;
3525

3526
	if (elems->max_idle_period_ie) {
3527
		bss_conf->max_idle_period =
3528
			le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
3529
		bss_conf->protected_keep_alive =
3530
			!!(elems->max_idle_period_ie->idle_options &
3531 3532 3533 3534 3535 3536 3537
			   WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
		changed |= BSS_CHANGED_KEEP_ALIVE;
	} else {
		bss_conf->max_idle_period = 0;
		bss_conf->protected_keep_alive = false;
	}

3538
	/* set assoc capability (AID was already set earlier),
J
Johannes Berg 已提交
3539 3540
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->assoc_capability = capab_info;
3541
	ieee80211_set_associated(sdata, cbss, changed);
3542

3543 3544 3545 3546 3547 3548 3549
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3550
	/*
J
Johannes Berg 已提交
3551 3552
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3553
	 */
J
Johannes Berg 已提交
3554
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3555
	ieee80211_sta_reset_beacon_monitor(sdata);
3556

3557 3558 3559 3560
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3561 3562
}

3563 3564 3565
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3566 3567 3568 3569 3570
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3571
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3572 3573
	u8 *pos;
	bool reassoc;
3574
	struct cfg80211_bss *bss;
3575 3576 3577 3578
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = ASSOC_EVENT,
	};
J
Johannes Berg 已提交
3579

3580
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3581 3582

	if (!assoc_data)
3583
		return;
3584
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3585
		return;
J
Johannes Berg 已提交
3586 3587 3588 3589 3590 3591 3592

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3593
		return;
J
Johannes Berg 已提交
3594

3595
	reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
J
Johannes Berg 已提交
3596 3597 3598 3599
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3600 3601 3602 3603
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3604

3605 3606 3607 3608
	if (assoc_data->fils_kek_len &&
	    fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
		return;

J
Johannes Berg 已提交
3609
	pos = mgmt->u.assoc_resp.variable;
3610 3611
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, assoc_data->bss->bssid);
J
Johannes Berg 已提交
3612 3613

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3614 3615
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3616
		u32 tu, ms;
3617
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3618
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3619 3620 3621
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3622
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3623
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3624
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3625 3626
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3627 3628
	}

3629
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3630 3631

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3632 3633
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
3634
		ieee80211_destroy_assoc_data(sdata, false, false);
3635 3636 3637
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3638
	} else {
3639
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len, &elems)) {
J
Johannes Berg 已提交
3640
			/* oops -- internal error -- send timeout for now */
3641
			ieee80211_destroy_assoc_data(sdata, false, false);
3642
			cfg80211_assoc_timeout(sdata->dev, bss);
3643
			return;
J
Johannes Berg 已提交
3644
		}
3645 3646
		event.u.mlme.status = MLME_SUCCESS;
		drv_event_callback(sdata->local, sdata, &event);
3647
		sdata_info(sdata, "associated\n");
3648 3649 3650 3651 3652 3653

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
3654
		ieee80211_destroy_assoc_data(sdata, true, false);
3655 3656 3657 3658 3659

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
3660
				uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
J
Johannes Berg 已提交
3661 3662
	}

3663 3664
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues,
			       ifmgd->assoc_req_ies, ifmgd->assoc_req_ies_len);
J
Johannes Berg 已提交
3665
}
J
Johannes Berg 已提交
3666

3667
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3668
				  struct ieee80211_mgmt *mgmt, size_t len,
3669
				  struct ieee80211_rx_status *rx_status)
3670 3671
{
	struct ieee80211_local *local = sdata->local;
3672
	struct ieee80211_bss *bss;
3673
	struct ieee80211_channel *channel;
3674

3675
	sdata_assert_lock(sdata);
3676

3677 3678
	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
	if (!channel)
3679 3680
		return;

3681
	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
3682 3683
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3684
		ieee80211_rx_bss_put(local, bss);
3685
	}
3686 3687 3688
}


3689
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3690
					 struct sk_buff *skb)
3691
{
J
Johannes Berg 已提交
3692
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3693
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3694
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
3695
	struct ieee80211_channel *channel;
J
Johannes Berg 已提交
3696
	size_t baselen, len = skb->len;
3697

3698 3699
	ifmgd = &sdata->u.mgd;

3700
	sdata_assert_lock(sdata);
3701

3702 3703 3704 3705 3706 3707 3708 3709 3710 3711 3712 3713 3714 3715 3716
	/*
	 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
	 * "If a 6 GHz AP receives a Probe Request frame  and responds with
	 * a Probe Response frame [..], the Address 1 field of the Probe
	 * Response frame shall be set to the broadcast address [..]"
	 * So, on 6GHz band we should also accept broadcast responses.
	 */
	channel = ieee80211_get_channel(sdata->local->hw.wiphy,
					rx_status->freq);
	if (!channel)
		return;

	if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
	    (channel->band != NL80211_BAND_6GHZ ||
	     !is_broadcast_ether_addr(mgmt->da)))
3717 3718
		return; /* ignore ProbeResp to foreign address */

3719 3720 3721 3722
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

3723
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
3724

3725
	if (ifmgd->associated &&
3726
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3727
		ieee80211_reset_ap_probe(sdata);
3728 3729
}

3730 3731 3732
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3733 3734 3735
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3736 3737 3738 3739 3740 3741 3742 3743 3744 3745
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3746 3747 3748 3749 3750
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3751 3752
	(1ULL << WLAN_EID_HT_OPERATION) |
	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3753

3754 3755 3756 3757 3758
static void ieee80211_handle_beacon_sig(struct ieee80211_sub_if_data *sdata,
					struct ieee80211_if_managed *ifmgd,
					struct ieee80211_bss_conf *bss_conf,
					struct ieee80211_local *local,
					struct ieee80211_rx_status *rx_status)
3759
{
3760
	/* Track average RSSI from the Beacon frames of the current AP */
3761

3762 3763
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3764
		ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3765
		ifmgd->last_cqm_event_signal = 0;
3766
		ifmgd->count_beacon_signal = 1;
3767
		ifmgd->last_ave_beacon_signal = 0;
3768
	} else {
3769
		ifmgd->count_beacon_signal++;
3770
	}
3771

3772 3773
	ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);

3774 3775
	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3776
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3777
		int last_sig = ifmgd->last_ave_beacon_signal;
3778 3779 3780
		struct ieee80211_event event = {
			.type = RSSI_EVENT,
		};
3781 3782 3783 3784 3785 3786 3787 3788

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3789 3790
			event.u.rssi.data = RSSI_EVENT_HIGH;
			drv_event_callback(local, sdata, &event);
3791 3792 3793 3794
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3795 3796
			event.u.rssi.data = RSSI_EVENT_LOW;
			drv_event_callback(local, sdata, &event);
3797 3798 3799
		}
	}

3800
	if (bss_conf->cqm_rssi_thold &&
3801
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3802
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3803
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3804 3805 3806
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
3807

3808 3809 3810 3811 3812 3813
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3814
				sig, GFP_KERNEL);
3815 3816 3817 3818 3819 3820
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3821
				sig, GFP_KERNEL);
3822 3823 3824
		}
	}

3825 3826 3827 3828 3829 3830 3831 3832 3833 3834 3835 3836 3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847
	if (bss_conf->cqm_rssi_low &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
		int last_event = ifmgd->last_cqm_event_signal;
		int low = bss_conf->cqm_rssi_low;
		int high = bss_conf->cqm_rssi_high;

		if (sig < low &&
		    (last_event == 0 || last_event >= low)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				sig, GFP_KERNEL);
		} else if (sig > high &&
			   (last_event == 0 || last_event <= high)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				sig, GFP_KERNEL);
		}
	}
3848 3849
}

S
Sara Sharon 已提交
3850 3851 3852 3853 3854 3855 3856 3857 3858 3859
static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
				    struct cfg80211_bss *bss)
{
	if (ether_addr_equal(tx_bssid, bss->bssid))
		return true;
	if (!bss->transmitted_bss)
		return false;
	return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
}

3860 3861 3862 3863 3864 3865 3866 3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
	size_t baselen;
	struct ieee802_11_elems elems;
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
	struct sta_info *sta;
	u32 changed = 0;
	bool erp_valid;
	u8 erp_value = 0;
	u32 ncrc;
	u8 *bssid;
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_assert_lock(sdata);

	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
		return;
	}

	if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
		rcu_read_unlock();
		return;
	}
	chan = chanctx_conf->def.chan;
	rcu_read_unlock();

	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
S
Sara Sharon 已提交
3901
	    ieee80211_rx_our_beacon(mgmt->bssid, ifmgd->assoc_data->bss)) {
3902
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3903 3904 3905
				       len - baselen, false, &elems,
				       mgmt->bssid,
				       ifmgd->assoc_data->bss->bssid);
3906

3907
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
S
Sara Sharon 已提交
3908 3909 3910

		if (elems.dtim_period)
			ifmgd->dtim_period = elems.dtim_period;
3911 3912 3913 3914 3915 3916 3917
		ifmgd->have_beacon = true;
		ifmgd->assoc_data->need_beacon = false;
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
S
Sara Sharon 已提交
3918
			sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
3919
		}
S
Sara Sharon 已提交
3920 3921 3922 3923 3924 3925 3926 3927 3928

		if (elems.mbssid_config_ie)
			bss_conf->profile_periodicity =
				elems.mbssid_config_ie->profile_periodicity;

		if (elems.ext_capab_len >= 11 &&
		    (elems.ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			bss_conf->ema_ap = true;

3929 3930 3931 3932 3933 3934 3935 3936
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
		ifmgd->assoc_data->timeout_started = true;
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
	}

	if (!ifmgd->associated ||
S
Sara Sharon 已提交
3937
	    !ieee80211_rx_our_beacon(mgmt->bssid,  ifmgd->associated))
3938 3939 3940 3941 3942 3943
		return;
	bssid = ifmgd->associated->bssid;

	if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
		ieee80211_handle_beacon_sig(sdata, ifmgd, bss_conf,
					    local, rx_status);
3944

3945
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3946
		mlme_dbg_ratelimited(sdata,
3947
				     "cancelling AP probe due to a received beacon\n");
3948
		ieee80211_reset_ap_probe(sdata);
3949 3950
	}

J
Johannes Berg 已提交
3951 3952 3953 3954
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
3955
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
3956

3957 3958
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3959
					  len - baselen, false, &elems,
3960 3961
					  care_about_ies, ncrc,
					  mgmt->bssid, bssid);
3962

3963
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
3964
	    ieee80211_check_tim(elems.tim, elems.tim_len, bss_conf->aid)) {
3965 3966 3967 3968 3969
		if (local->hw.conf.dynamic_ps_timeout > 0) {
			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
				ieee80211_hw_config(local,
						    IEEE80211_CONF_CHANGE_PS);
3970
			}
3971
			ieee80211_send_nullfunc(local, sdata, false);
3972 3973 3974 3975 3976 3977 3978 3979 3980 3981 3982 3983
		} else if (!local->pspolling && sdata->u.mgd.powersave) {
			local->pspolling = true;

			/*
			 * Here is assumed that the driver will be
			 * able to send ps-poll frame and receive a
			 * response even though power save mode is
			 * enabled, but some drivers might require
			 * to disable power save here. This needs
			 * to be investigated.
			 */
			ieee80211_send_pspoll(local, sdata);
3984 3985
		}
	}
J
Johannes Berg 已提交
3986

3987 3988
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
J
Janusz Dziedzic 已提交
3989
		struct ieee80211_p2p_noa_attr noa = {};
3990 3991 3992 3993 3994
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3995
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
3996 3997 3998 3999 4000 4001 4002 4003 4004 4005 4006 4007 4008 4009 4010 4011
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
4012 4013 4014 4015 4016
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

4017 4018 4019
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

4020 4021 4022 4023 4024 4025 4026 4027
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
4028
	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4029 4030 4031 4032
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
S
Sara Sharon 已提交
4033
		sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
4034 4035
	}

4036
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
4037
		return;
4038
	ifmgd->beacon_crc = ncrc;
4039
	ifmgd->beacon_crc_valid = true;
4040

4041
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
4042

4043
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
4044
					 rx_status->device_timestamp,
4045 4046
					 &elems, true);

4047 4048
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
L
Luca Coelho 已提交
4049 4050
				     elems.wmm_param_len,
				     elems.mu_edca_param_set))
4051 4052
		changed |= BSS_CHANGED_QOS;

4053 4054
	/*
	 * If we haven't had a beacon before, tell the driver about the
4055
	 * DTIM period (and beacon timing if desired) now.
4056
	 */
4057
	if (!ifmgd->have_beacon) {
4058
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
S
Sara Sharon 已提交
4059
		bss_conf->dtim_period = elems.dtim_period ?: 1;
4060

4061 4062
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
4063 4064

		mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
4065
		ieee80211_recalc_ps(local);
4066 4067
		mutex_unlock(&local->iflist_mtx);

4068
		ieee80211_recalc_ps_vif(sdata);
4069 4070
	}

4071
	if (elems.erp_info) {
J
Johannes Berg 已提交
4072 4073 4074 4075
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
4076
	}
J
Johannes Berg 已提交
4077 4078 4079
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
4080

4081
	mutex_lock(&local->sta_mtx);
4082 4083
	sta = sta_info_get(sdata, bssid);

4084 4085
	changed |= ieee80211_recalc_twt_req(sdata, sta, &elems);

4086 4087
	if (ieee80211_config_bw(sdata, sta,
				elems.ht_cap_elem, elems.ht_operation,
L
Luca Coelho 已提交
4088 4089
				elems.vht_operation, elems.he_operation,
				bssid, &changed)) {
4090
		mutex_unlock(&local->sta_mtx);
4091 4092 4093
		sdata_info(sdata,
			   "failed to follow AP %pM bandwidth change, disconnect\n",
			   bssid);
4094 4095 4096
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
4097 4098 4099
		ieee80211_report_disconnect(sdata, deauth_buf,
					    sizeof(deauth_buf), true,
					    WLAN_REASON_DEAUTH_LEAVING);
4100
		return;
4101
	}
4102 4103 4104

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
4105
					    rx_status->band);
4106
	mutex_unlock(&local->sta_mtx);
4107

4108 4109 4110
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
4111 4112
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
4113

4114
	ieee80211_bss_info_change_notify(sdata, changed);
4115 4116
}

4117 4118
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
4119 4120 4121 4122
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
4123 4124
	struct ieee802_11_elems elems;
	int ies_len;
4125 4126 4127 4128 4129

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

4130
	sdata_lock(sdata);
4131

J
Johannes Berg 已提交
4132 4133
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
4134
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
4135 4136 4137 4138 4139
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
4140
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4141 4142
		break;
	case IEEE80211_STYPE_DEAUTH:
4143
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4144 4145
		break;
	case IEEE80211_STYPE_DISASSOC:
4146
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4147 4148 4149
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
4150
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4151 4152
		break;
	case IEEE80211_STYPE_ACTION:
4153
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
4154 4155 4156
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
4157 4158 4159 4160

			if (ies_len < 0)
				break;

4161
			/* CSA IE cannot be overridden, no need for BSSID */
4162 4163
			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
4164
				ies_len, true, &elems, mgmt->bssid, NULL);
4165 4166 4167 4168

			if (elems.parse_error)
				break;

4169
			ieee80211_sta_process_chanswitch(sdata,
4170 4171 4172
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4173 4174 4175 4176 4177 4178 4179 4180
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

4181 4182 4183 4184
			/*
			 * extended CSA IE can't be overridden, no need for
			 * BSSID
			 */
4185 4186
			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
4187
				ies_len, true, &elems, mgmt->bssid, NULL);
4188 4189 4190 4191 4192 4193 4194 4195

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
4196
			ieee80211_sta_process_chanswitch(sdata,
4197 4198 4199
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4200
		}
4201
		break;
4202
	}
4203
	sdata_unlock(sdata);
4204 4205
}

4206
static void ieee80211_sta_timer(struct timer_list *t)
4207
{
J
Johannes Berg 已提交
4208
	struct ieee80211_sub_if_data *sdata =
4209
		from_timer(sdata, t, u.mgd.timer);
4210

4211
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
4212 4213
}

4214
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
4215
					  u8 *bssid, u8 reason, bool tx)
4216
{
4217
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4218

4219
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
4220
			       tx, frame_buf);
4221

4222 4223
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    reason);
4224 4225
}

4226
static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4227 4228 4229 4230
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
4231
	u32 tx_flags = 0;
4232 4233
	u16 trans = 1;
	u16 status = 0;
4234
	u16 prepare_tx_duration = 0;
J
Johannes Berg 已提交
4235

4236
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4237 4238 4239 4240 4241 4242 4243

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
4244 4245
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
4246 4247 4248 4249 4250 4251 4252 4253 4254 4255

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

4256 4257 4258 4259 4260
	if (auth_data->algorithm == WLAN_AUTH_SAE)
		prepare_tx_duration =
			jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);

	drv_mgd_prepare_tx(local, sdata, prepare_tx_duration);
J
Johannes Berg 已提交
4261

4262 4263 4264
	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
		   auth_data->bss->bssid, auth_data->tries,
		   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
4265

4266
	auth_data->expected_transaction = 2;
4267

4268 4269 4270 4271 4272
	if (auth_data->algorithm == WLAN_AUTH_SAE) {
		trans = auth_data->sae_trans;
		status = auth_data->sae_status;
		auth_data->expected_transaction = trans;
	}
J
Johannes Berg 已提交
4273

4274 4275 4276
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
4277

4278 4279 4280 4281 4282
	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
			    auth_data->data, auth_data->data_len,
			    auth_data->bss->bssid,
			    auth_data->bss->bssid, NULL, 0, 0,
			    tx_flags);
J
Johannes Berg 已提交
4283

4284
	if (tx_flags == 0) {
4285 4286 4287 4288 4289
		if (auth_data->algorithm == WLAN_AUTH_SAE)
			auth_data->timeout = jiffies +
				IEEE80211_AUTH_TIMEOUT_SAE;
		else
			auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
4290
	} else {
4291 4292
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
4293
	}
J
Johannes Berg 已提交
4294

4295 4296 4297
	auth_data->timeout_started = true;
	run_again(sdata, auth_data->timeout);

J
Johannes Berg 已提交
4298 4299 4300 4301 4302 4303 4304 4305
	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

4306
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4307 4308 4309

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
4310 4311
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
4312 4313 4314 4315 4316 4317 4318 4319 4320 4321

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
4322 4323 4324
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
4325 4326
	ieee80211_send_assoc(sdata);

4327
	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
4328
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
4329
		assoc_data->timeout_started = true;
4330
		run_again(sdata, assoc_data->timeout);
4331
	} else {
4332 4333 4334 4335 4336
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
4337
	}
J
Johannes Berg 已提交
4338 4339 4340 4341

	return 0;
}

4342 4343 4344 4345 4346 4347 4348 4349 4350 4351 4352 4353
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

4354
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4355 4356
{
	struct ieee80211_local *local = sdata->local;
4357
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4358

4359
	sdata_lock(sdata);
4360

4361 4362 4363 4364 4365
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
4366
		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
4367
			if (status_acked) {
4368 4369 4370 4371 4372 4373 4374 4375 4376
				if (ifmgd->auth_data->algorithm ==
				    WLAN_AUTH_SAE)
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SAE;
				else
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SHORT;
4377
				run_again(sdata, ifmgd->auth_data->timeout);
4378 4379 4380
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
4381
			ifmgd->auth_data->timeout_started = true;
4382 4383 4384 4385 4386 4387
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
4388
				run_again(sdata, ifmgd->assoc_data->timeout);
4389 4390 4391
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
4392
			ifmgd->assoc_data->timeout_started = true;
4393 4394 4395
		}
	}

4396
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
4397 4398 4399 4400 4401 4402 4403
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
4404
		} else if (ieee80211_auth(sdata)) {
J
Johannes Berg 已提交
4405
			u8 bssid[ETH_ALEN];
4406 4407 4408 4409 4410
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = AUTH_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4411 4412 4413 4414 4415

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

4416
			cfg80211_auth_timeout(sdata->dev, bssid);
4417
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4418
		}
4419
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
4420
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
4421

4422
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
4423
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
4424
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
4425
		    ieee80211_do_assoc(sdata)) {
4426
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4427 4428 4429 4430 4431
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = ASSOC_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4432

4433
			ieee80211_destroy_assoc_data(sdata, false, false);
4434
			cfg80211_assoc_timeout(sdata->dev, bss);
4435
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4436
		}
4437
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
4438
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
4439

4440
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
4441
	    ifmgd->associated) {
4442
		u8 bssid[ETH_ALEN];
4443
		int max_tries;
4444

4445
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
4446

4447
		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
4448
			max_tries = max_nullfunc_tries;
4449
		else
4450
			max_tries = max_probe_tries;
4451

4452 4453 4454
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
4455 4456
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4457 4458 4459 4460
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
4461 4462
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
4463 4464 4465
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
4466
				ieee80211_sta_connection_lost(sdata, bssid,
4467 4468
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
4469 4470
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
4471
			run_again(sdata, ifmgd->probe_timeout);
4472
		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
J
Johannes Berg 已提交
4473 4474 4475
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
4476
			ieee80211_sta_connection_lost(sdata, bssid,
4477
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
4478
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4479 4480 4481 4482
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
4483 4484
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
4485 4486 4487 4488
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
4489 4490 4491
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, disconnecting.\n",
				 bssid, probe_wait_ms);
4492

4493
			ieee80211_sta_connection_lost(sdata, bssid,
4494
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
4495 4496 4497
		}
	}

4498
	sdata_unlock(sdata);
4499 4500
}

4501
static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4502 4503
{
	struct ieee80211_sub_if_data *sdata =
4504
		from_timer(sdata, t, u.mgd.bcn_mon_timer);
4505
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4506

4507
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4508 4509
		return;

4510
	sdata->u.mgd.connection_loss = false;
4511 4512
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
4513 4514
}

4515
static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4516 4517
{
	struct ieee80211_sub_if_data *sdata =
4518
		from_timer(sdata, t, u.mgd.conn_mon_timer);
J
Johannes Berg 已提交
4519 4520 4521
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

4522
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4523 4524
		return;

4525
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
4526 4527 4528 4529 4530 4531 4532 4533 4534 4535 4536
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
4537 4538
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
4539
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
4540
		__ieee80211_stop_poll(sdata);
4541

J
Johannes Berg 已提交
4542
		/* let's probe the connection once */
4543
		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
4544 4545
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
4546
	}
J
Johannes Berg 已提交
4547
}
4548

4549
#ifdef CONFIG_PM
4550 4551 4552 4553 4554 4555 4556
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

4557 4558 4559 4560 4561
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

4562
		/*
4563 4564 4565
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
4566
		 */
4567
		ieee80211_send_deauth_disassoc(sdata, bssid, bssid,
4568 4569 4570
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
4571
		if (ifmgd->assoc_data)
4572
			ieee80211_destroy_assoc_data(sdata, false, true);
4573 4574
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
4575 4576 4577 4578
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

4579 4580 4581 4582 4583 4584 4585 4586 4587 4588 4589 4590 4591 4592 4593 4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604 4605 4606
	/* This is a bit of a hack - we should find a better and more generic
	 * solution to this. Normally when suspending, cfg80211 will in fact
	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
	 * auth (not so important) or assoc (this is the problem) process.
	 *
	 * As a consequence, it can happen that we are in the process of both
	 * associating and suspending, and receive an association response
	 * after cfg80211 has checked if it needs to disconnect, but before
	 * we actually set the flag to drop incoming frames. This will then
	 * cause the workqueue flush to process the association response in
	 * the suspend, resulting in a successful association just before it
	 * tries to remove the interface from the driver, which now though
	 * has a channel context assigned ... this results in issues.
	 *
	 * To work around this (for now) simply deauth here again if we're
	 * now connected.
	 */
	if (ifmgd->associated && !sdata->local->wowlan) {
		u8 bssid[ETH_ALEN];
		struct cfg80211_deauth_request req = {
			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
			.bssid = bssid,
		};

		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
		ieee80211_mgd_deauth(sdata, &req);
	}

4607 4608 4609
	sdata_unlock(sdata);
}

4610 4611 4612 4613
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4614
	sdata_lock(sdata);
4615
	if (!ifmgd->associated) {
4616
		sdata_unlock(sdata);
4617 4618 4619 4620 4621 4622 4623 4624 4625 4626
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4627
		sdata_unlock(sdata);
4628 4629
		return;
	}
4630
	sdata_unlock(sdata);
4631 4632 4633
}
#endif

J
Johannes Berg 已提交
4634 4635
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4636
{
4637
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4638

4639
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4640
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4641
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4642 4643
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4644 4645
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4646
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4647 4648
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4649 4650 4651 4652
	timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
	timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
	timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
	timer_setup(&ifmgd->chswitch_timer, ieee80211_chswitch_timer, 0);
4653 4654
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4655

4656
	ifmgd->flags = 0;
4657
	ifmgd->powersave = sdata->wdev.ps;
4658 4659
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4660
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4661

4662
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4663 4664 4665
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4666 4667 4668 4669 4670

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4671 4672
}

4673 4674
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4675
{
4676
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4677

4678 4679
	/* Restart STA timers */
	rcu_read_lock();
4680 4681 4682 4683
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4684 4685
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4686

J
Johannes Berg 已提交
4687 4688 4689 4690 4691 4692 4693 4694 4695 4696 4697 4698
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4699
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4700 4701 4702 4703 4704 4705 4706 4707 4708 4709 4710 4711
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4712
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4713 4714 4715 4716 4717 4718 4719 4720 4721 4722 4723 4724 4725 4726 4727 4728 4729 4730
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

L
Luca Coelho 已提交
4731 4732 4733 4734 4735 4736
static bool
ieee80211_verify_sta_he_mcs_support(struct ieee80211_supported_band *sband,
				    const struct ieee80211_he_operation *he_op)
{
	const struct ieee80211_sta_he_cap *sta_he_cap =
		ieee80211_get_he_sta_cap(sband);
4737
	u16 ap_min_req_set;
L
Luca Coelho 已提交
4738 4739 4740 4741 4742
	int i;

	if (!sta_he_cap || !he_op)
		return false;

4743 4744
	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);

L
Luca Coelho 已提交
4745 4746 4747 4748 4749 4750 4751 4752 4753 4754 4755 4756 4757 4758 4759 4760 4761 4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779 4780 4781 4782 4783 4784 4785 4786 4787 4788 4789 4790 4791 4792
	/* Need to go over for 80MHz, 160MHz and for 80+80 */
	for (i = 0; i < 3; i++) {
		const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
			&sta_he_cap->he_mcs_nss_supp;
		u16 sta_mcs_map_rx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
		u16 sta_mcs_map_tx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
		u8 nss;
		bool verified = true;

		/*
		 * For each band there is a maximum of 8 spatial streams
		 * possible. Each of the sta_mcs_map_* is a 16-bit struct built
		 * of 2 bits per NSS (1-8), with the values defined in enum
		 * ieee80211_he_mcs_support. Need to make sure STA TX and RX
		 * capabilities aren't less than the AP's minimum requirements
		 * for this HE BSS per SS.
		 * It is enough to find one such band that meets the reqs.
		 */
		for (nss = 8; nss > 0; nss--) {
			u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
			u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
			u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;

			if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
				continue;

			/*
			 * Make sure the HE AP doesn't require MCSs that aren't
			 * supported by the client
			 */
			if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
				verified = false;
				break;
			}
		}

		if (verified)
			return true;
	}

	/* If here, STA doesn't meet AP's HE min requirements */
	return false;
}

4793 4794
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4795 4796 4797
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4798
	const struct ieee80211_ht_cap *ht_cap = NULL;
4799
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4800
	const struct ieee80211_vht_operation *vht_oper = NULL;
L
Luca Coelho 已提交
4801
	const struct ieee80211_he_operation *he_oper = NULL;
4802
	struct ieee80211_supported_band *sband;
4803
	struct cfg80211_chan_def chandef;
J
Johannes Berg 已提交
4804
	int ret;
4805 4806
	u32 i;
	bool have_80mhz;
4807

4808 4809
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4810 4811 4812 4813
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4814 4815 4816 4817 4818 4819 4820 4821 4822 4823 4824 4825 4826
	/* disable HT/VHT/HE if we don't support them */
	if (!sband->ht_cap.ht_supported) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

	if (!sband->vht_cap.vht_supported)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	if (!ieee80211_get_he_sta_cap(sband))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

4827 4828
	rcu_read_lock();

4829
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
4830
		const u8 *ht_oper_ie, *ht_cap_ie;
4831

4832
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4833 4834
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4835

4836 4837 4838 4839 4840
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4841 4842 4843
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4844 4845
	}

4846
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
4847
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4848

4849 4850
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4851 4852 4853 4854
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4855
			sdata_info(sdata,
4856
				   "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4857 4858
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4859
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
4860
		}
4861 4862 4863 4864 4865 4866

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4867 4868
	}

4869
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE)) {
L
Luca Coelho 已提交
4870 4871 4872 4873 4874 4875 4876 4877 4878 4879 4880 4881
		const struct cfg80211_bss_ies *ies;
		const u8 *he_oper_ie;

		ies = rcu_dereference(cbss->ies);
		he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
						  ies->data, ies->len);
		if (he_oper_ie &&
		    he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3]))
			he_oper = (void *)(he_oper_ie + 3);
		else
			he_oper = NULL;

4882
		if (!ieee80211_verify_sta_he_mcs_support(sband, he_oper))
L
Luca Coelho 已提交
4883 4884 4885
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

4886 4887 4888 4889 4890 4891 4892 4893 4894 4895 4896 4897 4898 4899
	/* Allow VHT if at least one channel on the sband supports 80 MHz */
	have_80mhz = false;
	for (i = 0; i < sband->n_channels; i++) {
		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
						IEEE80211_CHAN_NO_80MHZ))
			continue;

		have_80mhz = true;
		break;
	}

	if (!have_80mhz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4900 4901
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
L
Luca Coelho 已提交
4902
						     ht_oper, vht_oper, he_oper,
4903
						     &chandef, false);
4904

J
Johannes Berg 已提交
4905 4906
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4907

4908 4909
	rcu_read_unlock();

4910 4911 4912
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4913
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4914 4915 4916 4917 4918 4919 4920
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4921 4922 4923 4924

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4925
		goto out;
4926

4927
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4928
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4929 4930 4931
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4932 4933
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4934
	return ret;
4935 4936
}

S
Sara Sharon 已提交
4937 4938 4939 4940 4941 4942 4943 4944 4945 4946 4947 4948 4949 4950 4951 4952 4953 4954 4955 4956 4957 4958 4959 4960 4961 4962 4963 4964 4965 4966 4967 4968 4969 4970
static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
			       u8 *dtim_count, u8 *dtim_period)
{
	const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
	const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
					 ies->len);
	const struct ieee80211_tim_ie *tim = NULL;
	const struct ieee80211_bssid_index *idx;
	bool valid = tim_ie && tim_ie[1] >= 2;

	if (valid)
		tim = (void *)(tim_ie + 2);

	if (dtim_count)
		*dtim_count = valid ? tim->dtim_count : 0;

	if (dtim_period)
		*dtim_period = valid ? tim->dtim_period : 0;

	/* Check if value is overridden by non-transmitted profile */
	if (!idx_ie || idx_ie[1] < 3)
		return valid;

	idx = (void *)(idx_ie + 2);

	if (dtim_count)
		*dtim_count = idx->dtim_count;

	if (dtim_period)
		*dtim_period = idx->dtim_period;

	return true;
}

4971
static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
4972 4973
				     struct cfg80211_bss *cbss, bool assoc,
				     bool override)
4974 4975 4976 4977 4978
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
4979
	struct ieee80211_supported_band *sband;
4980
	bool have_sta = false;
4981 4982
	int err;

4983 4984
	sband = local->hw.wiphy->bands[cbss->channel->band];

4985 4986 4987
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

4988 4989 4990 4991
	/* If a reconfig is happening, bail out */
	if (local->in_reconfig)
		return -EBUSY;

4992 4993 4994 4995 4996 4997 4998 4999 5000 5001 5002
	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
5003

5004 5005 5006 5007 5008 5009 5010 5011 5012 5013 5014 5015 5016
	/*
	 * Set up the information for the new channel before setting the
	 * new channel. We can't - completely race-free - change the basic
	 * rates bitmap and the channel (sband) that it refers to, but if
	 * we set it up before we at least avoid calling into the driver's
	 * bss_info_changed() method with invalid information (since we do
	 * call that from changing the channel - only for IDLE and perhaps
	 * some others, but ...).
	 *
	 * So to avoid that, just set up all the new information before the
	 * channel, but tell the driver to apply it only afterwards, since
	 * it might need the new channel for that.
	 */
J
Johannes Berg 已提交
5017
	if (new_sta) {
5018 5019 5020
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
J
Johannes Berg 已提交
5021
		const struct cfg80211_bss_ies *ies;
5022
		int shift = ieee80211_vif_get_shift(&sdata->vif);
5023 5024 5025 5026 5027

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
5028
				    &min_rate, &min_rate_index,
5029
				    shift);
5030 5031 5032 5033 5034 5035 5036 5037 5038 5039

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
		 */
		if (!basic_rates && min_rate_index >= 0) {
J
Johannes Berg 已提交
5040 5041
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
5042 5043 5044
			basic_rates = BIT(min_rate_index);
		}

5045 5046 5047 5048 5049 5050
		if (rates)
			new_sta->sta.supp_rates[cbss->channel->band] = rates;
		else
			sdata_info(sdata,
				   "No rates found, keeping mandatory only\n");

5051 5052 5053
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
5054
		if (cbss->channel->band == NL80211_BAND_2GHZ &&
5055 5056 5057 5058 5059 5060 5061
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

5062 5063
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
5064
		rcu_read_lock();
5065 5066 5067 5068 5069
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
S
Sara Sharon 已提交
5070 5071 5072 5073

			ieee80211_get_dtim(ies,
					   &sdata->vif.bss_conf.sync_dtim_count,
					   NULL);
5074 5075
		} else if (!ieee80211_hw_check(&sdata->local->hw,
					       TIMING_BEACON_ONLY)) {
5076 5077 5078 5079 5080 5081 5082 5083 5084 5085 5086
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
5087
		rcu_read_unlock();
5088
	}
5089

5090 5091 5092 5093 5094 5095 5096 5097 5098 5099 5100 5101 5102 5103
	if (new_sta || override) {
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

	if (new_sta) {
		/*
		 * tell driver about BSSID, basic rates and timing
		 * this was set up above, before setting the channel
		 */
5104
		ieee80211_bss_info_change_notify(sdata,
5105 5106
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
5107 5108

		if (assoc)
J
Johannes Berg 已提交
5109
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
5110

J
Johannes Berg 已提交
5111 5112
		err = sta_info_insert(new_sta);
		new_sta = NULL;
5113
		if (err) {
J
Johannes Berg 已提交
5114 5115 5116
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
5117 5118 5119
			return err;
		}
	} else
5120
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
5121

5122 5123 5124 5125
	/* Cancel scan to ensure that nothing interferes with connection */
	if (local->scanning)
		ieee80211_scan_cancel(local);

5126 5127 5128
	return 0;
}

5129 5130 5131
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
5132
{
J
Johannes Berg 已提交
5133 5134 5135
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
5136
	u16 auth_alg;
J
Johannes Berg 已提交
5137
	int err;
5138
	bool cont_auth;
J
Johannes Berg 已提交
5139 5140

	/* prepare auth data structure */
J
Johannes Berg 已提交
5141

5142 5143 5144 5145 5146
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
5147
		if (fips_enabled)
5148
			return -EOPNOTSUPP;
5149 5150 5151 5152 5153 5154 5155 5156
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
5157 5158 5159
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
5160 5161 5162 5163 5164 5165 5166 5167 5168
	case NL80211_AUTHTYPE_FILS_SK:
		auth_alg = WLAN_AUTH_FILS_SK;
		break;
	case NL80211_AUTHTYPE_FILS_SK_PFS:
		auth_alg = WLAN_AUTH_FILS_SK_PFS;
		break;
	case NL80211_AUTHTYPE_FILS_PK:
		auth_alg = WLAN_AUTH_FILS_PK;
		break;
5169 5170
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
5171
	}
5172

5173
	if (ifmgd->assoc_data)
5174 5175
		return -EBUSY;

5176
	auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
5177
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
5178
	if (!auth_data)
J
Johannes Berg 已提交
5179
		return -ENOMEM;
5180

J
Johannes Berg 已提交
5181
	auth_data->bss = req->bss;
5182

5183
	if (req->auth_data_len >= 4) {
5184 5185 5186 5187 5188 5189
		if (req->auth_type == NL80211_AUTHTYPE_SAE) {
			__le16 *pos = (__le16 *) req->auth_data;

			auth_data->sae_trans = le16_to_cpu(pos[0]);
			auth_data->sae_status = le16_to_cpu(pos[1]);
		}
5190 5191 5192
		memcpy(auth_data->data, req->auth_data + 4,
		       req->auth_data_len - 4);
		auth_data->data_len += req->auth_data_len - 4;
5193 5194
	}

5195 5196 5197 5198 5199 5200 5201
	/* Check if continuing authentication or trying to authenticate with the
	 * same BSS that we were in the process of authenticating with and avoid
	 * removal and re-addition of the STA entry in
	 * ieee80211_prep_connection().
	 */
	cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss;

5202
	if (req->ie && req->ie_len) {
5203 5204 5205
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
5206
	}
5207

J
Johannes Berg 已提交
5208
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
5209 5210 5211
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
5212 5213
	}

J
Johannes Berg 已提交
5214
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
5215

J
Johannes Berg 已提交
5216
	/* try to authenticate/probe */
5217

5218 5219 5220 5221 5222 5223 5224
	if (ifmgd->auth_data) {
		if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
			auth_data->peer_confirmed =
				ifmgd->auth_data->peer_confirmed;
		}
		ieee80211_destroy_auth_data(sdata, cont_auth);
	}
5225

J
Johannes Berg 已提交
5226 5227
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
5228

5229 5230 5231 5232 5233 5234 5235 5236 5237
	/* If this is continuation of an ongoing SAE authentication exchange
	 * (i.e., request to send SAE Confirm) and the peer has already
	 * confirmed, mark authentication completed since we are about to send
	 * out SAE Confirm.
	 */
	if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
	    auth_data->peer_confirmed && auth_data->sae_trans == 2)
		ieee80211_mark_sta_auth(sdata, req->bss->bssid);

5238 5239 5240
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5241 5242 5243
		sdata_info(sdata,
			   "disconnect from AP %pM for new auth to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5244 5245 5246 5247
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5248 5249 5250
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5251
	}
J
Johannes Berg 已提交
5252

J
Johannes Berg 已提交
5253
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
5254

5255
	err = ieee80211_prep_connection(sdata, req->bss, cont_auth, false);
5256
	if (err)
J
Johannes Berg 已提交
5257
		goto err_clear;
J
Johannes Berg 已提交
5258

5259
	err = ieee80211_auth(sdata);
J
Johannes Berg 已提交
5260 5261 5262 5263 5264 5265
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
5266
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
5267
	return 0;
J
Johannes Berg 已提交
5268 5269

 err_clear:
5270
	eth_zero_addr(ifmgd->bssid);
5271
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5272
	ifmgd->auth_data = NULL;
5273 5274 5275
	mutex_lock(&sdata->local->mtx);
	ieee80211_vif_release_channel(sdata);
	mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
5276 5277
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
5278 5279
}

5280 5281
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
5282
{
J
Johannes Berg 已提交
5283
	struct ieee80211_local *local = sdata->local;
5284
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5285
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
5286
	struct ieee80211_mgd_assoc_data *assoc_data;
5287
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
5288
	struct ieee80211_supported_band *sband;
5289
	const u8 *ssidie, *ht_ie, *vht_ie;
5290
	int i, err;
5291
	bool override = false;
5292

J
Johannes Berg 已提交
5293 5294 5295 5296
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

5297 5298
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
5299
	if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
5300 5301 5302 5303 5304 5305 5306 5307
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

5308 5309 5310
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5311 5312 5313
		sdata_info(sdata,
			   "disconnect from AP %pM for new assoc to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5314 5315 5316 5317
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5318 5319 5320
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5321
	}
J
Johannes Berg 已提交
5322 5323 5324 5325

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
5326
	}
5327

J
Johannes Berg 已提交
5328 5329 5330 5331
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
5332

J
Johannes Berg 已提交
5333 5334 5335 5336
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
5337
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
5338
		ieee80211_destroy_auth_data(sdata, match);
5339 5340
	}

J
Johannes Berg 已提交
5341
	/* prepare assoc data */
5342

5343 5344
	ifmgd->beacon_crc_valid = false;

5345 5346 5347
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);

J
Johannes Berg 已提交
5348 5349 5350 5351 5352 5353 5354
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
5355
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
5356 5357
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
5358
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
5359
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5360
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
L
Luca Coelho 已提交
5361
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5362
			netdev_info(sdata->dev,
5363
				    "disabling HT/VHT/HE due to WEP/TKIP use\n");
5364 5365
		}
	}
5366

J
Johannes Berg 已提交
5367 5368
	sband = local->hw.wiphy->bands[req->bss->channel->band];

5369 5370 5371
	/* also disable HT/VHT/HE if the AP doesn't use WMM */
	if (!bss->wmm_used) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5372
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5373 5374 5375
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
		netdev_info(sdata->dev,
			    "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
5376 5377
	}

B
Ben Greear 已提交
5378 5379 5380 5381
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

5382 5383 5384 5385
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

5386
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
5387 5388 5389
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
5390

5391 5392 5393 5394 5395 5396 5397 5398 5399 5400 5401 5402 5403 5404 5405
	if (req->fils_kek) {
		/* should already be checked in cfg80211 - so warn */
		if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
			err = -EINVAL;
			goto err_free;
		}
		memcpy(assoc_data->fils_kek, req->fils_kek,
		       req->fils_kek_len);
		assoc_data->fils_kek_len = req->fils_kek_len;
	}

	if (req->fils_nonces)
		memcpy(assoc_data->fils_nonces, req->fils_nonces,
		       2 * FILS_NONCE_LEN);

J
Johannes Berg 已提交
5406
	assoc_data->bss = req->bss;
5407

J
Johannes Berg 已提交
5408 5409
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
5410
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
5411
		else
5412
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
5413
	} else
5414
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
5415

J
Johannes Berg 已提交
5416 5417 5418
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
5419

5420
	rcu_read_lock();
5421 5422 5423 5424 5425
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
	else
5426
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5427 5428 5429 5430 5431 5432
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
	else
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5433
	rcu_read_unlock();
5434

5435
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
5436
		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
5437 5438 5439
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
5440
	if (bss->wmm_used && bss->uapsd_supported &&
5441
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
5442
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
5443 5444
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
5445
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
5446 5447 5448
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

5449
	if (req->prev_bssid)
J
Johannes Berg 已提交
5450
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
5451 5452 5453 5454 5455 5456 5457 5458 5459

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

5460 5461 5462 5463 5464
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

5465 5466 5467 5468 5469
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

5470 5471
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
5472 5473
	sdata->control_port_over_nl80211 =
					req->crypto.control_port_over_nl80211;
5474
	sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
5475 5476
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
5477

J
Johannes Berg 已提交
5478 5479 5480
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
5481
	ifmgd->dtim_period = 0;
5482
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
5483

5484 5485 5486 5487 5488 5489 5490 5491 5492 5493 5494 5495 5496 5497 5498 5499 5500 5501 5502 5503 5504 5505 5506 5507
	/* override HT/VHT configuration only if the AP and we support it */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
		struct ieee80211_sta_ht_cap sta_ht_cap;

		if (req->flags & ASSOC_REQ_DISABLE_HT)
			override = true;

		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

		/* check for 40 MHz disable override */
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
		    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
		    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
			override = true;

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
		    req->flags & ASSOC_REQ_DISABLE_VHT)
			override = true;
	}

	if (req->flags & ASSOC_REQ_DISABLE_HT) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5508
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5509 5510 5511 5512 5513 5514
	}

	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	err = ieee80211_prep_connection(sdata, req->bss, true, override);
5515 5516
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
5517

5518 5519
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
5520

5521
	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
5522 5523 5524 5525 5526 5527 5528 5529
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
5530
		assoc_data->timeout_started = true;
5531 5532
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
S
Sara Sharon 已提交
5533
		const u8 *ie;
5534 5535
		u8 dtim_count = 0;

S
Sara Sharon 已提交
5536 5537 5538
		ieee80211_get_dtim(beacon_ies, &dtim_count,
				   &ifmgd->dtim_period);

5539
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
5540
		assoc_data->timeout = jiffies;
5541
		assoc_data->timeout_started = true;
5542

5543
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5544 5545 5546 5547 5548
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
S
Sara Sharon 已提交
5549 5550 5551 5552 5553 5554 5555 5556 5557 5558 5559

		ie = cfg80211_find_ext_ie(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
					  beacon_ies->data, beacon_ies->len);
		if (ie && ie[1] >= 3)
			sdata->vif.bss_conf.profile_periodicity = ie[4];

		ie = cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY,
				      beacon_ies->data, beacon_ies->len);
		if (ie && ie[1] >= 11 &&
		    (ie[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			sdata->vif.bss_conf.ema_ap = true;
5560 5561
	} else {
		assoc_data->timeout = jiffies;
5562
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
5563
	}
5564 5565
	rcu_read_unlock();

5566
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
5567

P
Paul Stewart 已提交
5568 5569 5570 5571 5572 5573 5574 5575 5576 5577
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
5578 5579
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
5580 5581
	}

5582
	return 0;
J
Johannes Berg 已提交
5583
 err_clear:
5584
	eth_zero_addr(ifmgd->bssid);
5585
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5586 5587 5588 5589
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
5590 5591
}

5592
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
5593
			 struct cfg80211_deauth_request *req)
5594
{
5595
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5596
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5597
	bool tx = !req->local_state_change;
5598

5599 5600 5601 5602 5603 5604
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
5605

5606
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5607
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5608
					       IEEE80211_STYPE_DEAUTH,
5609
					       req->reason_code, tx,
5610
					       frame_buf);
5611
		ieee80211_destroy_auth_data(sdata, false);
5612 5613 5614
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5615

5616
		return 0;
5617 5618
	}

5619 5620 5621 5622 5623 5624 5625
	if (ifmgd->assoc_data &&
	    ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting association with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5626
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5627
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5628 5629 5630
					       IEEE80211_STYPE_DEAUTH,
					       req->reason_code, tx,
					       frame_buf);
5631
		ieee80211_destroy_assoc_data(sdata, false, true);
5632 5633 5634 5635 5636 5637
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
		return 0;
	}

5638 5639
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
5640 5641 5642 5643 5644
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5645 5646
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
5647 5648 5649
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5650 5651
		return 0;
	}
5652

5653
	return -ENOTCONN;
5654
}
5655

5656
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
5657
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
5658
{
5659
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5660
	u8 bssid[ETH_ALEN];
5661
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
5662

J
Johannes Berg 已提交
5663 5664 5665 5666 5667 5668
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
5669
	if (ifmgd->associated != req->bss)
5670 5671
		return -ENOLINK;

J
Johannes Berg 已提交
5672
	sdata_info(sdata,
5673 5674
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
5675

5676
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
5677 5678 5679
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
5680

5681 5682
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    req->reason_code);
5683

5684 5685
	return 0;
}
5686

5687
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
5688 5689 5690
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

5691 5692 5693 5694 5695 5696 5697 5698 5699 5700
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
5701
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5702

5703
	sdata_lock(sdata);
5704 5705
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5706
		ieee80211_destroy_assoc_data(sdata, false, false);
5707 5708
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
5709 5710
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
5711 5712 5713 5714 5715 5716
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
5717 5718 5719
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = NULL;
	ifmgd->assoc_req_ies_len = 0;
5720
	spin_unlock_bh(&ifmgd->teardown_lock);
5721
	del_timer_sync(&ifmgd->timer);
5722
	sdata_unlock(sdata);
5723 5724
}

5725 5726
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
5727
			       s32 rssi_level,
5728 5729 5730 5731
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

5732
	trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
J
Johannes Berg 已提交
5733

5734
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
5735 5736
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
5737 5738 5739 5740 5741 5742 5743 5744 5745 5746

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);