mlme.c 143.1 KB
Newer Older
1 2
/*
 * BSS client mode implementation
3
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4 5 6 7
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8
 * Copyright 2013-2014  Intel Mobile Communications GmbH
9
 * Copyright (C) 2015 - 2016 Intel Deutschland GmbH
10 11 12 13 14 15
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

16
#include <linux/delay.h>
17 18 19 20
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
21
#include <linux/moduleparam.h>
22
#include <linux/rtnetlink.h>
23
#include <linux/crc32.h>
24
#include <linux/slab.h>
25
#include <linux/export.h>
26
#include <net/mac80211.h>
27
#include <asm/unaligned.h>
J
Johannes Berg 已提交
28

29
#include "ieee80211_i.h"
30
#include "driver-ops.h"
J
Johannes Berg 已提交
31 32
#include "rate.h"
#include "led.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36 37 38 39
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
40
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
41 42
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
43

44 45 46 47 48 49 50 51 52
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
53 54

/*
55 56 57 58 59 60
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
61
 */
62 63 64 65
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
66

J
Johannes Berg 已提交
67 68 69 70
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
71
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
72 73 74 75 76
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
77 78 79 80 81
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
82

83 84 85 86 87 88
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
89 90 91 92 93 94 95 96 97 98
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
99 100
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
101
{
102
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
103

104 105 106
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
107 108
}

109
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
110
{
111
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
112 113
		return;

114
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
115 116
		return;

J
Johannes Berg 已提交
117
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
118
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
119 120
}

121 122
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
123 124
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

125 126 127
	if (unlikely(!sdata->u.mgd.associated))
		return;

128 129
	ifmgd->probe_send_count = 0;

130
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
131 132 133 134 135 136
		return;

	mod_timer(&sdata->u.mgd.conn_mon_timer,
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

137
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
138
{
139
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
140 141
}

142 143 144 145
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
146
			     const struct ieee80211_ht_cap *ht_cap,
147 148
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
149
			     struct cfg80211_chan_def *chandef, bool tracking)
150
{
151
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
152
	struct cfg80211_chan_def vht_chandef;
153
	struct ieee80211_sta_ht_cap sta_ht_cap;
154 155
	u32 ht_cfreq, ret;

156 157 158
	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

159 160 161 162 163
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
	chandef->center_freq2 = 0;

164
	if (!ht_cap || !ht_oper || !sta_ht_cap.ht_supported) {
165 166 167 168 169 170
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

171 172
	if (!(ht_cap->cap_info &
	      cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
173
		ret = IEEE80211_STA_DISABLE_40MHZ;
174
		vht_chandef = *chandef;
175 176 177
		goto out;
	}

178 179 180
	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
181
	if (!tracking && channel->center_freq != ht_cfreq) {
182 183 184 185 186 187 188
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
189 190 191 192
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
193 194 195 196 197
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	/* check 40 MHz support, if we have it */
198
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
199
		ieee80211_chandef_ht_oper(ht_oper, chandef);
200 201 202
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
203 204
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
205 206 207 208 209 210 211 212
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

213 214
	vht_chandef = *chandef;
	if (!ieee80211_chandef_vht_oper(vht_oper, &vht_chandef)) {
215
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
216
			sdata_info(sdata,
217
				   "AP VHT information is invalid, disable VHT\n");
218 219 220 221 222
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
223
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
224 225
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
226 227 228 229 230 231 232 233 234 235
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
236
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
237 238
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
239 240 241 242 243 244 245 246 247
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

270 271 272 273
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

274 275 276 277 278 279 280 281
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
282
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
283 284
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
285 286 287
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
			      IEEE80211_STA_DISABLE_VHT;
288
			break;
289 290
		}

291
		ret |= ieee80211_chandef_downgrade(chandef);
292 293
	}

294
	if (chandef->width != vht_chandef.width && !tracking)
295 296 297 298 299 300 301
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

302 303
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
304
			       const struct ieee80211_ht_cap *ht_cap,
305 306 307
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
			       const u8 *bssid, u32 *changed)
308 309
{
	struct ieee80211_local *local = sdata->local;
310
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
311
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
312
	struct ieee80211_channel *chan;
313
	struct cfg80211_chan_def chandef;
314
	u16 ht_opmode;
315 316 317
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
318

319 320
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
321 322
		return 0;

323 324 325 326 327 328 329
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

330 331 332 333 334 335 336 337 338 339
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

340
	chan = sdata->vif.bss_conf.chandef.chan;
J
Johannes Berg 已提交
341
	sband = local->hw.wiphy->bands[chan->band];
342

343
	/* calculate new channel (type) based on HT/VHT operation IEs */
344 345 346
	flags = ieee80211_determine_chantype(sdata, sband, chan,
					     ht_cap, ht_oper, vht_oper,
					     &chandef, true);
347 348 349 350 351 352 353 354 355 356

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
357
		flags |= ieee80211_chandef_downgrade(&chandef);
358 359
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
360
		flags |= ieee80211_chandef_downgrade(&chandef);
361 362
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
363
		flags |= ieee80211_chandef_downgrade(&chandef);
364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
		   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
		   chandef.center_freq1, chandef.center_freq2);

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
390
	case NL80211_CHAN_WIDTH_40:
391
		new_sta_bw = IEEE80211_STA_RX_BW_40;
392
		break;
393 394 395 396 397 398
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
399
		break;
400 401
	default:
		return -EINVAL;
402
	}
403

404 405
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
406

407 408 409 410 411
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
412

413 414 415 416 417 418 419
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
420

421 422 423 424
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
425
	}
426

427
	return 0;
428 429
}

J
Johannes Berg 已提交
430 431
/* frame sending functions */

J
Johannes Berg 已提交
432
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
433
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

451
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
452 453 454 455 456 457 458 459 460 461 462 463 464 465
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

466 467 468 469 470 471 472 473 474 475
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

501 502 503 504
/* This function determines vht capability flags for the association
 * and builds the IE.
 * Note - the function may set the owner of the MU-MIMO capability
 */
505 506
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
507 508
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
509
{
510
	struct ieee80211_local *local = sdata->local;
511 512 513
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
514
	u32 mask, ap_bf_sts, our_bf_sts;
515 516 517 518

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
519
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
520 521 522 523

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
524
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
525 526 527 528 529 530
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
531 532 533 534
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
535
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
536 537
	}

538 539 540 541 542 543
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561
		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
	else if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

	/*
	 * If some other vif is using the MU-MIMO capablity we cannot associate
	 * using MU-MIMO - this will lead to contradictions in the group-id
	 * mechanism.
	 * Ownership is defined since association request, in order to avoid
	 * simultaneous associations with MU-MIMO.
	 */
	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
		bool disable_mu_mimo = false;
		struct ieee80211_sub_if_data *other;

		list_for_each_entry_rcu(other, &local->interfaces, list) {
562
			if (other->vif.mu_mimo_owner) {
563 564 565 566 567 568 569
				disable_mu_mimo = true;
				break;
			}
		}
		if (disable_mu_mimo)
			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
		else
570
			sdata->vif.mu_mimo_owner = true;
571
	}
572

573 574 575 576 577 578 579 580 581 582
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

583
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
584
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
585 586 587
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

J
Johannes Berg 已提交
588 589 590 591 592 593 594 595 596
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
	u8 *pos, qos_info;
	size_t offset = 0, noffset;
597
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
598 599
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
600 601
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
602
	u32 rate_flags, rates = 0;
J
Johannes Berg 已提交
603

604
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
605

J
Johannes Berg 已提交
606 607 608 609 610 611
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
612
	chan = chanctx_conf->def.chan;
613
	rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
J
Johannes Berg 已提交
614 615
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
616
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
617 618 619 620 621 622 623 624

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
625 626 627 628
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
629 630 631 632 633 634
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
635 636 637 638 639 640 641 642
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			if ((rate_flags & sband->bitrates[i].flags)
			    != rate_flags)
				continue;
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
643 644 645 646 647 648 649 650 651
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
652
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
J
Johannes Berg 已提交
653 654 655 656 657 658 659 660 661 662 663
			assoc_data->ie_len + /* extra IEs */
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

	if (sband->band == IEEE80211_BAND_2GHZ) {
664 665
		capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
J
Johannes Berg 已提交
666 667 668 669 670 671
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
672
	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
J
Johannes Berg 已提交
673 674
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

675 676 677
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

J
Johannes Berg 已提交
678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719
	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(mgmt, 0, 24);
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
720 721 722
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
723 724 725 726 727 728 729 730 731 732 733 734
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
735 736 737 738
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
739 740 741 742
			}
		}
	}

743 744
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
745 746 747 748
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
749 750
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
751
	}
J
Johannes Berg 已提交
752

753
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
J
Johannes Berg 已提交
754 755 756 757 758 759 760 761 762 763 764 765
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

	/* if present, add any custom IEs that go before HT */
766
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
767 768 769 770 771 772 773 774 775 776
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
777 778
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
779 780
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
			/* 60GHz doesn't happen right now */
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
J
Johannes Berg 已提交
801 802 803 804 805
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

J
Johannes Berg 已提交
806 807 808 809
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

810
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
811
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
812
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
813

814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
		};
834 835

		/* RIC already taken above, so no need to handle here anymore */
836 837 838 839 840 841 842 843
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

844
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
845 846
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
847

J
Johannes Berg 已提交
848
	/* if present, add any custom non-vendor IEs that go after HT */
849
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
850 851 852 853 854 855 856 857
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

858 859
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
860 861
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
862 863 864 865 866
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

867
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
868 869 870
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
871
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
872 873 874 875 876
		noffset = assoc_data->ie_len;
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
	}

J
Johannes Berg 已提交
877 878
	drv_mgd_prepare_tx(local, sdata);

J
Johannes Berg 已提交
879
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
880
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
881 882
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
883 884 885
	ieee80211_tx_skb(sdata, skb);
}

886 887 888 889 890 891
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

892 893
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
894 895
		return;

896 897
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
898

899 900
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
901 902
}

903 904
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
905
			     bool powersave)
906 907
{
	struct sk_buff *skb;
908
	struct ieee80211_hdr_3addr *nullfunc;
909
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
910

911 912
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
	if (!skb)
913 914
		return;

915
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
916
	if (powersave)
917
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
918

919 920
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
921

922
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
923 924
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

925
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
926 927
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

928
	ieee80211_tx_skb(sdata, skb);
929 930
}

931 932 933 934 935 936 937 938 939 940 941
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
942
	if (!skb)
943
		return;
944

945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960
	skb_reserve(skb, local->hw.extra_tx_headroom);

	nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
	memset(nullfunc, 0, 30);
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

961 962 963 964 965
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
966
	struct ieee80211_local *local = sdata->local;
967
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
968
	int ret;
969

970
	if (!ieee80211_sdata_running(sdata))
971 972
		return;

973
	sdata_lock(sdata);
974 975 976
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

977 978
	if (!ifmgd->associated)
		goto out;
979

980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1014
		sdata_info(sdata,
1015
			   "failed to finalize channel switch, disconnecting\n");
1016 1017 1018 1019
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1020

1021
	/* XXX: shouldn't really modify cfg80211-owned data! */
1022
	ifmgd->associated->channel = sdata->csa_chandef.chan;
1023

1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1044

1045 1046 1047 1048 1049
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1050

1051 1052 1053
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1054 1055 1056 1057 1058 1059
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1060
		return;
1061
	}
1062 1063

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1064 1065
}

1066 1067
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1068 1069
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1070 1071 1072

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1073 1074 1075 1076 1077 1078
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1079 1080 1081 1082
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1083 1084 1085 1086
static void ieee80211_chswitch_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
1087

1088
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1089 1090
}

1091
static void
J
Johannes Berg 已提交
1092
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1093 1094
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1095
				 bool beacon)
1096
{
1097
	struct ieee80211_local *local = sdata->local;
1098
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1099
	struct cfg80211_bss *cbss = ifmgd->associated;
1100
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1101
	struct ieee80211_chanctx *chanctx;
1102
	enum ieee80211_band current_band;
1103
	struct ieee80211_csa_ie csa_ie;
1104
	struct ieee80211_channel_switch ch_switch;
1105
	int res;
1106

1107
	sdata_assert_lock(sdata);
1108

1109
	if (!cbss)
1110 1111
		return;

1112
	if (local->scanning)
1113 1114
		return;

1115
	/* disregard subsequent announcements if we are already processing */
1116
	if (sdata->vif.csa_active)
1117 1118
		return;

1119
	current_band = cbss->channel->band;
1120
	memset(&csa_ie, 0, sizeof(csa_ie));
1121
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1122
					   ifmgd->flags,
1123
					   ifmgd->associated->bssid, &csa_ie);
1124
	if (res	< 0)
1125
		ieee80211_queue_work(&local->hw,
1126
				     &ifmgd->csa_connection_drop_work);
1127
	if (res)
1128
		return;
1129

1130
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1131 1132 1133
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1134
			   ifmgd->associated->bssid,
1135 1136 1137
			   csa_ie.chandef.chan->center_freq,
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
			   csa_ie.chandef.center_freq2);
1138 1139 1140 1141 1142
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153
	if (cfg80211_chandef_identical(&csa_ie.chandef,
				       &sdata->vif.bss_conf.chandef)) {
		if (ifmgd->csa_ignored_same_chan)
			return;
		sdata_info(sdata,
			   "AP %pM tries to chanswitch to same channel, ignore\n",
			   ifmgd->associated->bssid);
		ifmgd->csa_ignored_same_chan = true;
		return;
	}

1154 1155 1156 1157 1158 1159 1160 1161
	/*
	 * Drop all TDLS peers - either we disconnect or move to a different
	 * channel from this point on. There's no telling what our peer will do.
	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
	 * have an incompatible wider chandef.
	 */
	ieee80211_teardown_tdls_peers(sdata);

1162
	mutex_lock(&local->mtx);
1163
	mutex_lock(&local->chanctx_mtx);
1164 1165 1166 1167 1168
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
1169
		goto drop_connection;
1170 1171 1172 1173
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1174
	if (local->use_chanctx &&
1175
	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1176 1177
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
1178
		goto drop_connection;
J
Johannes Berg 已提交
1179 1180
	}

1181 1182 1183 1184 1185 1186 1187 1188 1189
	ch_switch.timestamp = timestamp;
	ch_switch.device_timestamp = device_timestamp;
	ch_switch.block_tx = csa_ie.mode;
	ch_switch.chandef = csa_ie.chandef;
	ch_switch.count = csa_ie.count;

	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
1190
		goto drop_connection;
1191 1192
	}

1193 1194 1195
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1196
		sdata_info(sdata,
1197 1198
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1199
		goto drop_connection;
J
Johannes Berg 已提交
1200
	}
1201
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1202

1203
	sdata->vif.csa_active = true;
1204
	sdata->csa_chandef = csa_ie.chandef;
1205
	sdata->csa_block_tx = csa_ie.mode;
1206
	ifmgd->csa_ignored_same_chan = false;
J
Johannes Berg 已提交
1207

1208
	if (sdata->csa_block_tx)
1209 1210
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1211
	mutex_unlock(&local->mtx);
1212

1213 1214 1215
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1216
	if (local->ops->channel_switch) {
1217
		/* use driver's channel switch callback */
1218
		drv_channel_switch(local, sdata, &ch_switch);
1219 1220 1221 1222
		return;
	}

	/* channel switch handled in software */
1223
	if (csa_ie.count <= 1)
1224
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1225
	else
1226
		mod_timer(&ifmgd->chswitch_timer,
1227 1228
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1229 1230 1231 1232 1233
	return;
 drop_connection:
	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
1234 1235
}

1236 1237 1238 1239 1240 1241
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1242
{
1243 1244
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1245
	int i, chan_increment;
1246
	bool have_chan_pwr = false;
1247

1248 1249
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1250
		return false;
1251

1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
	case IEEE80211_BAND_2GHZ:
	case IEEE80211_BAND_60GHZ:
		chan_increment = 1;
		break;
	case IEEE80211_BAND_5GHZ:
		chan_increment = 4;
		break;
1266
	}
1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1278
				*chan_pwr = triplet->chans.max_power;
1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1290
	if (have_chan_pwr && pwr_constr_elem)
1291
		*pwr_reduction = *pwr_constr_elem;
1292 1293 1294
	else
		*pwr_reduction = 0;

1295 1296 1297
	return have_chan_pwr;
}

1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1312 1313 1314 1315
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1316 1317
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1318
{
1319 1320 1321
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1322
	int new_ap_level;
1323
	__le16 capab = mgmt->u.probe_resp.capab_info;
1324

1325 1326 1327
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1328 1329 1330
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1331 1332 1333 1334 1335 1336 1337 1338
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1339
	}
1340

1341
	if (!has_80211h_pwr && !has_cisco_pwr)
1342
		return 0;
1343

1344 1345 1346 1347 1348
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1349 1350 1351 1352 1353
		new_ap_level = pwr_level_80211h;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1354 1355 1356 1357
		sdata_dbg(sdata,
			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			  sdata->u.mgd.bssid);
1358
	} else {  /* has_cisco_pwr is always true here. */
1359 1360 1361 1362 1363
		new_ap_level = pwr_level_cisco;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1364 1365 1366
		sdata_dbg(sdata,
			  "Limiting TX power to %d dBm as advertised by %pM\n",
			  pwr_level_cisco, sdata->u.mgd.bssid);
1367
	}
1368

1369 1370 1371 1372
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1373 1374
}

1375 1376 1377 1378 1379 1380
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1381 1382 1383 1384
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1385
	if (local->scanning)
J
Johannes Berg 已提交
1386 1387
		return;

1388
	if (conf->dynamic_ps_timeout > 0 &&
1389
	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1390 1391 1392
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
1393
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1394
			ieee80211_send_nullfunc(local, sdata, true);
1395

1396 1397
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1398 1399 1400 1401
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1419 1420 1421 1422
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1423
	bool authorized = false;
1424 1425 1426 1427

	if (!mgd->powersave)
		return false;

1428 1429 1430
	if (mgd->broken_ap)
		return false;

1431 1432 1433
	if (!mgd->associated)
		return false;

1434
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1435 1436
		return false;

1437
	if (!mgd->have_beacon)
1438 1439
		return false;

1440 1441 1442
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1443
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1444 1445
	rcu_read_unlock();

J
Johannes Berg 已提交
1446
	return authorized;
1447 1448
}

1449
/* need to hold RTNL or interface lock */
J
Johannes Berg 已提交
1450
void ieee80211_recalc_ps(struct ieee80211_local *local)
1451 1452 1453
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1454
	int timeout;
1455

1456
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1457 1458 1459 1460 1461
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1462
		if (!ieee80211_sdata_running(sdata))
1463
			continue;
1464 1465 1466 1467 1468 1469 1470 1471
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1472 1473 1474 1475 1476 1477
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1478
	if (count == 1 && ieee80211_powersave_allowed(found)) {
J
Johannes Berg 已提交
1479
		u8 dtimper = found->u.mgd.dtim_period;
1480 1481 1482 1483 1484
		s32 beaconint_us;

		beaconint_us = ieee80211_tu_to_usec(
					found->vif.bss_conf.beacon_int);

1485
		timeout = local->dynamic_ps_forced_timeout;
J
Johannes Berg 已提交
1486 1487
		if (timeout < 0)
			timeout = 100;
1488
		local->hw.conf.dynamic_ps_timeout = timeout;
1489

J
Johannes Berg 已提交
1490 1491 1492 1493 1494 1495
		/* If the TIM IE is invalid, pretend the value is 1 */
		if (!dtimper)
			dtimper = 1;

		local->hw.conf.ps_dtim_period = dtimper;
		local->ps_sdata = found;
1496
	} else {
1497
		local->ps_sdata = NULL;
1498
	}
1499 1500 1501 1502

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1503 1504 1505 1506 1507 1508 1509 1510 1511 1512
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1525
					IEEE80211_MAX_QUEUE_MAP,
1526 1527
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1528 1529 1530 1531 1532 1533 1534 1535
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1536
	struct ieee80211_if_managed *ifmgd;
1537 1538
	unsigned long flags;
	int q;
1539 1540 1541 1542 1543

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1544 1545
	ifmgd = &sdata->u.mgd;

1546 1547 1548
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1549
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1550 1551
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1552 1553 1554 1555 1556
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1575 1576
	}

1577
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1578
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1579
		if (drv_tx_frames_pending(local)) {
1580 1581 1582
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1583
		} else {
1584
			ieee80211_send_nullfunc(local, sdata, true);
1585
			/* Flush to get the tx status of nullfunc frame */
1586
			ieee80211_flush_queues(local, sdata, false);
1587
		}
1588 1589
	}

1590 1591
	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1592 1593 1594 1595 1596
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1597 1598 1599 1600 1601 1602
}

void ieee80211_dynamic_ps_timer(unsigned long data)
{
	struct ieee80211_local *local = (void *) data;

1603
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1604 1605
}

1606 1607
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
1608
	struct delayed_work *delayed_work = to_delayed_work(work);
1609 1610 1611
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1612
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1613

1614 1615 1616 1617 1618 1619 1620 1621
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1622 1623
}

1624 1625 1626 1627 1628
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1629
	bool ret = false;
1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
			/* The loop will result in using BK even if it requires
			 * admission control, such configuration makes no sense
			 * and we have to transmit somehow - the AC selection
			 * does the same thing.
			 */
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1713
/* MLME */
1714
static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1715
				     struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
1716
				     const u8 *wmm_param, size_t wmm_param_len)
1717
{
1718
	struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1719
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1720
	size_t left;
1721
	int count, ac;
J
Johannes Berg 已提交
1722 1723
	const u8 *pos;
	u8 uapsd_queues = 0;
1724

1725
	if (!local->ops->conf_tx)
1726
		return false;
1727

J
Johannes Berg 已提交
1728
	if (local->hw.queues < IEEE80211_NUM_ACS)
1729
		return false;
1730 1731

	if (!wmm_param)
1732
		return false;
1733

1734
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1735
		return false;
K
Kalle Valo 已提交
1736 1737

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1738
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
1739

1740
	count = wmm_param[6] & 0x0f;
1741
	if (count == ifmgd->wmm_last_param_set)
1742
		return false;
1743
	ifmgd->wmm_last_param_set = count;
1744 1745 1746 1747 1748 1749

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
1750
	sdata->wmm_acm = 0;
1751 1752 1753
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
1754
		bool uapsd = false;
1755 1756

		switch (aci) {
1757
		case 1: /* AC_BK */
1758
			ac = IEEE80211_AC_BK;
J
Johannes Berg 已提交
1759
			if (acm)
Y
Yoni Divinsky 已提交
1760
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
1761 1762
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
1763
			break;
1764
		case 2: /* AC_VI */
1765
			ac = IEEE80211_AC_VI;
J
Johannes Berg 已提交
1766
			if (acm)
Y
Yoni Divinsky 已提交
1767
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
1768 1769
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
1770
			break;
1771
		case 3: /* AC_VO */
1772
			ac = IEEE80211_AC_VO;
J
Johannes Berg 已提交
1773
			if (acm)
Y
Yoni Divinsky 已提交
1774
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
1775 1776
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
1777
			break;
1778
		case 0: /* AC_BE */
1779
		default:
1780
			ac = IEEE80211_AC_BE;
J
Johannes Berg 已提交
1781
			if (acm)
Y
Yoni Divinsky 已提交
1782
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
1783 1784
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
1785 1786 1787
			break;
		}

1788
		params[ac].aifs = pos[0] & 0x0f;
1789

1790
		if (params[ac].aifs < 2) {
1791 1792
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
1793 1794
				   params[ac].aifs, aci);
			params[ac].aifs = 2;
1795
		}
1796 1797 1798 1799 1800
		params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
		params[ac].txop = get_unaligned_le16(pos + 2);
		params[ac].acm = acm;
		params[ac].uapsd = uapsd;
K
Kalle Valo 已提交
1801

1802 1803 1804 1805 1806 1807 1808 1809 1810
		if (params[ac].cw_min > params[ac].cw_max) {
			sdata_info(sdata,
				   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
				   params[ac].cw_min, params[ac].cw_max, aci);
			return false;
		}
	}

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
J
Johannes Berg 已提交
1811
		mlme_dbg(sdata,
1812 1813 1814 1815 1816 1817 1818 1819
			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
			 ac, params[ac].acm,
			 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
			 params[ac].txop, params[ac].uapsd,
			 ifmgd->tx_tspec[ac].downgraded);
		sdata->tx_conf[ac] = params[ac];
		if (!ifmgd->tx_tspec[ac].downgraded &&
		    drv_conf_tx(local, sdata, ac, &params[ac]))
J
Johannes Berg 已提交
1820
			sdata_err(sdata,
1821 1822
				  "failed to set TX queue parameters for AC %d\n",
				  ac);
1823
	}
1824 1825

	/* enable WMM or activate new settings */
1826
	sdata->vif.bss_conf.qos = true;
1827
	return true;
1828 1829
}

1830 1831 1832 1833
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

1834
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1835 1836 1837 1838 1839 1840 1841 1842 1843 1844
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
1845 1846
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
1847
{
J
Johannes Berg 已提交
1848
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1849
	u32 changed = 0;
J
Johannes Berg 已提交
1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
J
Johannes Berg 已提交
1863
	if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1864
		use_short_slot = true;
1865

1866 1867 1868
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
1869
	}
1870

1871 1872
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
1873
		changed |= BSS_CHANGED_ERP_PREAMBLE;
1874
	}
1875

J
Johannes Berg 已提交
1876 1877 1878
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
1879 1880 1881 1882 1883
	}

	return changed;
}

1884
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1885
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
1886
				     u32 bss_info_changed)
1887
{
1888
	struct ieee80211_bss *bss = (void *)cbss->priv;
1889
	struct ieee80211_local *local = sdata->local;
1890
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1891

J
Johannes Berg 已提交
1892
	bss_info_changed |= BSS_CHANGED_ASSOC;
1893
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1894
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1895

1896
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1897
		beacon_loss_count * bss_conf->beacon_int));
1898

1899 1900
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1901

1902 1903
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

1904 1905
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
1906
		const struct cfg80211_bss_ies *ies;
1907

1908 1909 1910 1911 1912 1913 1914 1915
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
1916 1917
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
1918
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
1919 1920
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
1921 1922
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
1923
		}
1924
		rcu_read_unlock();
1925 1926
	}

J
Johannes Berg 已提交
1927
	/* just to be sure */
1928
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
1929

1930
	ieee80211_led_assoc(local, 1);
1931

1932
	if (sdata->u.mgd.have_beacon) {
1933 1934 1935 1936 1937 1938 1939
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1940
		bss_conf->beacon_rate = bss->beacon_rate;
1941
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1942
	} else {
1943
		bss_conf->beacon_rate = NULL;
1944
		bss_conf->dtim_period = 0;
1945
	}
1946

1947
	bss_conf->assoc = 1;
1948

1949
	/* Tell the driver to monitor connection quality (if supported) */
1950
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1951
	    bss_conf->cqm_rssi_thold)
1952 1953
		bss_info_changed |= BSS_CHANGED_CQM;

1954
	/* Enable ARP filtering */
1955
	if (bss_conf->arp_addr_cnt)
1956 1957
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
1958
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1959

J
Johannes Berg 已提交
1960
	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
1961
	ieee80211_recalc_ps(local);
J
Johannes Berg 已提交
1962
	mutex_unlock(&local->iflist_mtx);
1963

1964
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
1965 1966
	ieee80211_recalc_ps_vif(sdata);

1967
	netif_carrier_on(sdata->dev);
1968 1969
}

1970
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1971 1972
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
1973
{
1974
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1975
	struct ieee80211_local *local = sdata->local;
1976
	u32 changed = 0;
1977

1978
	sdata_assert_lock(sdata);
1979

1980 1981 1982
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
1983 1984 1985
	if (WARN_ON(!ifmgd->associated))
		return;

1986 1987
	ieee80211_stop_poll(sdata);

1988
	ifmgd->associated = NULL;
1989 1990
	netif_carrier_off(sdata->dev);

1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2002 2003 2004
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2005 2006 2007
	/* make sure ongoing transmission finishes */
	synchronize_net();

2008 2009 2010 2011 2012 2013
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2014
	if (tx)
2015
		ieee80211_flush_queues(local, sdata, true);
2016

2017 2018
	/* deauthenticate/disassociate now */
	if (tx || frame_buf)
2019 2020
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
					       reason, tx, frame_buf);
2021

2022
	/* flush out frame - make sure the deauth was actually sent */
2023
	if (tx)
2024
		ieee80211_flush_queues(local, sdata, false);
2025

2026
	/* clear bssid only after building the needed mgmt frames */
2027
	eth_zero_addr(ifmgd->bssid);
2028

2029
	/* remove AP and TDLS peers */
2030
	sta_info_flush(sdata);
2031 2032

	/* finally reset all BSS / config parameters */
2033 2034 2035
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2036 2037
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2038

J
Janusz Dziedzic 已提交
2039 2040 2041
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2042

2043
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2044 2045
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2046 2047
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2048 2049 2050 2051 2052 2053 2054

	/* reset MU-MIMO ownership and group data */
	memset(sdata->vif.bss_conf.mu_group.membership, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.membership));
	memset(sdata->vif.bss_conf.mu_group.position, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.position));
	changed |= BSS_CHANGED_MU_GROUPS;
2055
	sdata->vif.mu_mimo_owner = false;
2056

2057
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2058

2059 2060 2061
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2062
	/* Disable ARP filtering */
2063
	if (sdata->vif.bss_conf.arp_addr_cnt)
2064 2065
		changed |= BSS_CHANGED_ARP_FILTER;

2066 2067 2068
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2069 2070
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2071
	ieee80211_bss_info_change_notify(sdata, changed);
2072

2073
	/* disassociated - set to defaults now */
2074
	ieee80211_set_wmm_default(sdata, false, false);
2075

2076 2077 2078 2079
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2080

2081
	sdata->vif.bss_conf.dtim_period = 0;
2082 2083
	sdata->vif.bss_conf.beacon_rate = NULL;

2084
	ifmgd->have_beacon = false;
2085

2086
	ifmgd->flags = 0;
2087
	mutex_lock(&local->mtx);
2088
	ieee80211_vif_release_channel(sdata);
2089 2090

	sdata->vif.csa_active = false;
2091
	ifmgd->csa_waiting_bcn = false;
2092
	ifmgd->csa_ignored_same_chan = false;
2093 2094 2095 2096 2097
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2098
	mutex_unlock(&local->mtx);
2099

2100 2101 2102 2103
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2104
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2105
}
2106

2107 2108 2109 2110 2111 2112 2113 2114
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2115 2116
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2117
	 */
J
Johannes Berg 已提交
2118 2119 2120
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2121
	ieee80211_sta_reset_conn_monitor(sdata);
2122
}
2123

2124 2125 2126
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2127
	struct ieee80211_local *local = sdata->local;
2128

2129
	mutex_lock(&local->mtx);
2130 2131
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2132

2133
	__ieee80211_stop_poll(sdata);
2134 2135

	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2136
	ieee80211_recalc_ps(local);
2137
	mutex_unlock(&local->iflist_mtx);
2138

2139
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2140
		goto out;
2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2152 2153
out:
	mutex_unlock(&local->mtx);
2154 2155
}

2156 2157 2158 2159 2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u16 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2191
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2192
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2193
{
2194 2195
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2196
	if (!ieee80211_is_data(hdr->frame_control))
2197 2198 2199 2200
	    return;

	if (ieee80211_is_nullfunc(hdr->frame_control) &&
	    sdata->u.mgd.probe_send_count > 0) {
2201
		if (ack)
2202
			ieee80211_sta_reset_conn_monitor(sdata);
2203 2204
		else
			sdata->u.mgd.nullfunc_failed = true;
2205
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2206
		return;
2207
	}
2208 2209 2210

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2211 2212
}

2213 2214 2215 2216
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2217
	u8 *dst = ifmgd->associated->bssid;
2218
	u8 unicast_limit = max(1, max_probe_tries - 3);
2219 2220 2221 2222 2223 2224 2225 2226

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2227

2228 2229 2230 2231 2232 2233 2234
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2235 2236
	ifmgd->probe_send_count++;

2237
	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2238
		ifmgd->nullfunc_failed = false;
2239
		ieee80211_send_nullfunc(sdata->local, sdata, false);
2240
	} else {
2241 2242
		int ssid_len;

2243
		rcu_read_lock();
2244
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2245 2246 2247 2248 2249
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2250
		ieee80211_send_probe_req(sdata, sdata->vif.addr, dst,
2251
					 ssid + 2, ssid_len, NULL,
2252
					 0, (u32) -1, true, 0,
J
Johannes Berg 已提交
2253
					 ifmgd->associated->channel, false);
2254
		rcu_read_unlock();
2255
	}
2256

2257
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2258
	run_again(sdata, ifmgd->probe_timeout);
2259 2260
}

J
Johannes Berg 已提交
2261 2262
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2263 2264
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2265
	bool already = false;
2266

2267
	if (!ieee80211_sdata_running(sdata))
2268 2269
		return;

2270
	sdata_lock(sdata);
2271 2272 2273 2274

	if (!ifmgd->associated)
		goto out;

2275 2276 2277 2278 2279 2280 2281
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2282
	if (beacon) {
J
Johannes Berg 已提交
2283
		mlme_dbg_ratelimited(sdata,
2284 2285
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2286

2287
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2288
	}
2289

J
Johannes Berg 已提交
2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2301
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2302 2303
		already = true;

E
Eliad Peller 已提交
2304 2305
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2306 2307
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2308 2309 2310
	if (already)
		goto out;

2311
	mutex_lock(&sdata->local->iflist_mtx);
J
Johannes Berg 已提交
2312
	ieee80211_recalc_ps(sdata->local);
2313 2314
	mutex_unlock(&sdata->local->iflist_mtx);

2315 2316
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2317
 out:
2318
	sdata_unlock(sdata);
2319 2320
}

2321 2322 2323 2324 2325
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2326
	struct cfg80211_bss *cbss;
2327 2328
	struct sk_buff *skb;
	const u8 *ssid;
2329
	int ssid_len;
2330 2331 2332 2333

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2334
	sdata_assert_lock(sdata);
2335

2336 2337 2338 2339 2340 2341 2342
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2343 2344
		return NULL;

2345
	rcu_read_lock();
2346
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2347 2348 2349 2350 2351
	if (WARN_ON_ONCE(ssid == NULL))
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2352
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2353
					(u32) -1, cbss->channel,
2354
					ssid + 2, ssid_len,
2355
					NULL, 0, true);
2356
	rcu_read_unlock();
2357 2358 2359 2360 2361

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379
static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
					const u8 *buf, size_t len, bool tx,
					u16 reason)
{
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
		.u.mlme.reason = reason,
	};

	if (tx)
		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
	else
		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);

	drv_event_callback(sdata->local, sdata, &event);
}

2380
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2381
{
2382
	struct ieee80211_local *local = sdata->local;
2383
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2384
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2385

2386
	sdata_lock(sdata);
2387
	if (!ifmgd->associated) {
2388
		sdata_unlock(sdata);
2389 2390 2391
		return;
	}

2392 2393
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2394
			       true, frame_buf);
2395
	mutex_lock(&local->mtx);
2396
	sdata->vif.csa_active = false;
2397
	ifmgd->csa_waiting_bcn = false;
2398 2399 2400 2401 2402
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2403
	mutex_unlock(&local->mtx);
2404

2405 2406 2407
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);

2408
	sdata_unlock(sdata);
2409 2410
}

2411
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2412 2413 2414
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2415
			     u.mgd.beacon_connection_loss_work);
2416 2417
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

2418 2419
	if (ifmgd->associated)
		ifmgd->beacon_loss_count++;
J
Johannes Berg 已提交
2420

2421
	if (ifmgd->connection_loss) {
2422 2423
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2424
		__ieee80211_disconnect(sdata);
2425
	} else {
2426
		ieee80211_mgd_probe_ap(sdata, true);
2427 2428 2429 2430 2431 2432 2433 2434 2435
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2436
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2437 2438
}

2439 2440 2441
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2442
	struct ieee80211_hw *hw = &sdata->local->hw;
2443

J
Johannes Berg 已提交
2444 2445
	trace_api_beacon_loss(sdata);

2446
	sdata->u.mgd.connection_loss = false;
2447
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2448 2449 2450
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2451 2452 2453 2454 2455
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2456 2457
	trace_api_connection_loss(sdata);

2458
	sdata->u.mgd.connection_loss = true;
2459 2460 2461 2462 2463
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2464 2465 2466 2467 2468
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2469
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2470 2471

	if (!assoc) {
2472 2473 2474 2475 2476 2477
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2478 2479
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

2480
		eth_zero_addr(sdata->u.mgd.bssid);
J
Johannes Berg 已提交
2481
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2482
		sdata->u.mgd.flags = 0;
2483
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2484
		ieee80211_vif_release_channel(sdata);
2485
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2486 2487
	}

2488
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2489 2490 2491 2492
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
					 bool assoc)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

	sdata_assert_lock(sdata);

	if (!assoc) {
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		eth_zero_addr(sdata->u.mgd.bssid);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
		sdata->u.mgd.flags = 0;
2512 2513
		sdata->vif.mu_mimo_owner = false;

2514 2515 2516 2517 2518 2519 2520 2521 2522
		mutex_lock(&sdata->local->mtx);
		ieee80211_vif_release_channel(sdata);
		mutex_unlock(&sdata->local->mtx);
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

J
Johannes Berg 已提交
2523 2524 2525
static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2526
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2527 2528 2529
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2530
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2531 2532

	pos = mgmt->u.auth.variable;
2533
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2534 2535 2536
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
J
Johannes Berg 已提交
2537
	drv_mgd_prepare_tx(sdata->local, sdata);
2538
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2539 2540
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2541
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2542 2543 2544
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2545
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2546 2547
}

2548 2549
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2550 2551 2552 2553 2554
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
	struct sta_info *sta;
2555 2556 2557 2558
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = AUTH_EVENT,
	};
J
Johannes Berg 已提交
2559

2560
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2561 2562

	if (len < 24 + 6)
2563
		return;
J
Johannes Berg 已提交
2564 2565

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2566
		return;
J
Johannes Berg 已提交
2567 2568 2569

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2570
	if (!ether_addr_equal(bssid, mgmt->bssid))
2571
		return;
J
Johannes Berg 已提交
2572 2573 2574 2575 2576 2577

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2578 2579 2580 2581 2582
	    auth_transaction != ifmgd->auth_data->expected_transaction) {
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2583
		return;
2584
	}
J
Johannes Berg 已提交
2585 2586

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
2587 2588
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2589
		ieee80211_destroy_auth_data(sdata, false);
2590
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2591 2592 2593
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
2594
		return;
J
Johannes Berg 已提交
2595 2596 2597 2598 2599 2600
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
2601
	case WLAN_AUTH_SAE:
J
Johannes Berg 已提交
2602 2603 2604 2605 2606
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
2607
			return;
J
Johannes Berg 已提交
2608 2609 2610 2611 2612
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
2613
		return;
J
Johannes Berg 已提交
2614 2615
	}

2616 2617
	event.u.mlme.status = MLME_SUCCESS;
	drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
2618
	sdata_info(sdata, "authenticated\n");
J
Johannes Berg 已提交
2619 2620
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2621
	ifmgd->auth_data->timeout_started = true;
2622
	run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
2623

2624 2625 2626 2627 2628 2629
	if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
	    ifmgd->auth_data->expected_transaction != 2) {
		/*
		 * Report auth frame to user space for processing since another
		 * round of Authentication frames is still needed.
		 */
2630
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2631
		return;
2632 2633
	}

J
Johannes Berg 已提交
2634 2635 2636 2637 2638 2639 2640 2641
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
		goto out_err;
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
J
Johannes Berg 已提交
2642
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
J
Johannes Berg 已提交
2643 2644 2645 2646
		goto out_err;
	}
	mutex_unlock(&sdata->local->sta_mtx);

2647
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2648
	return;
J
Johannes Berg 已提交
2649 2650 2651 2652 2653
 out_err:
	mutex_unlock(&sdata->local->sta_mtx);
	/* ignore frame -- wait for timeout */
}

2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

static const char *ieee80211_get_reason_code_string(u16 reason_code)
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
2710

2711 2712
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
2713
{
2714
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2715
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2716

2717
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2718

2719
	if (len < 24 + 2)
2720
		return;
2721

2722 2723 2724
	if (ifmgd->associated &&
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
		const u8 *bssid = ifmgd->associated->bssid;
2725

2726 2727 2728
		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));
2729

2730
		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2731

2732 2733 2734 2735
		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
					    reason_code);
		return;
	}
2736

2737 2738 2739
	if (ifmgd->assoc_data &&
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
		const u8 *bssid = ifmgd->assoc_data->bss->bssid;
2740

2741 2742 2743 2744 2745 2746 2747 2748 2749 2750
		sdata_info(sdata,
			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));

		ieee80211_destroy_assoc_data(sdata, false);

		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
		return;
	}
2751 2752 2753
}


2754 2755
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
2756
{
2757
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2758 2759
	u16 reason_code;

2760
	sdata_assert_lock(sdata);
2761

J
Johannes Berg 已提交
2762
	if (len < 24 + 2)
2763
		return;
2764

J
Johannes Berg 已提交
2765
	if (!ifmgd->associated ||
2766
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2767
		return;
2768 2769 2770

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

J
Johannes Berg 已提交
2771 2772
	sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
		   mgmt->sa, reason_code);
2773

2774 2775
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

2776
	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
2777 2778
}

2779 2780 2781 2782
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
2783 2784
				int *min_rate, int *min_rate_index,
				int shift, u32 rate_flags)
2785 2786 2787 2788
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
2789
		int rate = supp_rates[i] & 0x7f;
2790 2791
		bool is_basic = !!(supp_rates[i] & 0x80);

2792
		if ((rate * 5 * (1 << shift)) > 110)
2793 2794 2795 2796 2797 2798 2799 2800 2801 2802 2803 2804 2805 2806 2807
			*have_higher_than_11mbit = true;

		/*
		 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
		 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
		 *
		 * Note: Even through the membership selector and the basic
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
		if (!!(supp_rates[i] & 0x80) &&
		    (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
2808 2809 2810 2811 2812 2813 2814 2815 2816
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];
			if ((rate_flags & br->flags) != rate_flags)
				continue;

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
2817 2818 2819
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
2820 2821
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
2822 2823 2824 2825 2826 2827 2828
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
2829

J
Johannes Berg 已提交
2830 2831
static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2832
				    struct ieee80211_mgmt *mgmt, size_t len)
2833
{
2834
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2835
	struct ieee80211_local *local = sdata->local;
2836
	struct ieee80211_supported_band *sband;
2837
	struct sta_info *sta;
J
Johannes Berg 已提交
2838 2839
	u8 *pos;
	u16 capab_info, aid;
2840
	struct ieee802_11_elems elems;
J
Johannes Berg 已提交
2841
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2842 2843
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
J
Johannes Berg 已提交
2844
	u32 changed = 0;
2845
	int err;
2846
	bool ret;
2847

J
Johannes Berg 已提交
2848
	/* AssocResp and ReassocResp have identical structure */
2849 2850

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
2851
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2852

2853
	if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
J
Johannes Berg 已提交
2854 2855
		sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
			   aid);
2856 2857
	aid &= ~(BIT(15) | BIT(14));

2858 2859 2860
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
2861 2862
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
2863 2864 2865 2866
		aid = 0;
		ifmgd->broken_ap = true;
	}

J
Johannes Berg 已提交
2867
	pos = mgmt->u.assoc_resp.variable;
2868
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2869

2870
	if (!elems.supp_rates) {
J
Johannes Berg 已提交
2871
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
2872
		return false;
2873 2874
	}

2875
	ifmgd->aid = aid;
2876 2877 2878
	ifmgd->tdls_chan_switch_prohibited =
		elems.ext_capab && elems.ext_capab_len >= 5 &&
		(elems.ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
2879

2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
	if ((assoc_data->wmm && !elems.wmm_param) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	     (!elems.ht_cap_elem || !elems.ht_operation)) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	     (!elems.vht_cap_elem || !elems.vht_operation))) {
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
				       false, &bss_elems);
		if (assoc_data->wmm &&
		    !elems.wmm_param && bss_elems.wmm_param) {
			elems.wmm_param = bss_elems.wmm_param;
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
		if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_cap_elem = bss_elems.ht_cap_elem;
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
		if (!elems.ht_operation && bss_elems.ht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_operation = bss_elems.ht_operation;
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
		if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_cap_elem = bss_elems.vht_cap_elem;
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
		if (!elems.vht_operation && bss_elems.vht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_operation = bss_elems.vht_operation;
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

2943 2944 2945 2946 2947 2948 2949
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
		sdata_info(sdata,
2950 2951 2952
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
2953 2954 2955 2956 2957
	}

	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    (!elems.vht_cap_elem || !elems.vht_operation)) {
		sdata_info(sdata,
2958 2959 2960
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
2961 2962
	}

2963 2964 2965 2966 2967
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
2968
	sta = sta_info_get(sdata, cbss->bssid);
2969 2970
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
2971 2972
		ret = false;
		goto out;
2973
	}
2974

J
Johannes Berg 已提交
2975
	sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2976

2977
	/* Set up internal HT/VHT capabilities */
2978
	if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
2979
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2980
						  elems.ht_cap_elem, sta);
2981

M
Mahesh Palivela 已提交
2982 2983
	if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2984
						    elems.vht_cap_elem, sta);
M
Mahesh Palivela 已提交
2985

2986 2987 2988 2989 2990 2991
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
2992

2993 2994 2995 2996 2997 2998 2999 3000 3001 3002 3003 3004 3005 3006 3007
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
	if (elems.opmode_notif &&
	    !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
		u8 nss;

		nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

3008
	rate_control_rate_init(sta);
3009

3010
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
J
Johannes Berg 已提交
3011
		set_sta_flag(sta, WLAN_STA_MFP);
3012 3013 3014 3015
		sta->sta.mfp = true;
	} else {
		sta->sta.mfp = false;
	}
3016

3017
	sta->sta.wme = elems.wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3018

3019
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3020 3021 3022
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
3023 3024 3025
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
3026 3027
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
3028 3029
		ret = false;
		goto out;
3030 3031
	}

3032
	mutex_unlock(&sdata->local->sta_mtx);
3033

3034 3035 3036 3037 3038 3039 3040 3041
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;

3042
	if (ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
3043
		ieee80211_set_wmm_default(sdata, false, false);
3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056
	} else if (!ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
					     elems.wmm_param_len)) {
		/* still enable QoS since we might have HT/VHT */
		ieee80211_set_wmm_default(sdata, false, true);
		/* set the disable-WMM flag in this case to disable
		 * tracking WMM parameter changes in the beacon if
		 * the parameters weren't actually valid. Doing so
		 * avoids changing parameters very strangely when
		 * the AP is going back and forth between valid and
		 * invalid parameters.
		 */
		ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
	}
3057
	changed |= BSS_CHANGED_QOS;
3058

J
Johannes Berg 已提交
3059 3060 3061 3062
	/* set AID and assoc capability,
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->aid = aid;
	bss_conf->assoc_capability = capab_info;
3063
	ieee80211_set_associated(sdata, cbss, changed);
3064

3065 3066 3067 3068 3069 3070 3071
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3072
	/*
J
Johannes Berg 已提交
3073 3074
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3075
	 */
J
Johannes Berg 已提交
3076
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3077
	ieee80211_sta_reset_beacon_monitor(sdata);
3078

3079 3080 3081 3082
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3083 3084
}

3085 3086 3087
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3088 3089 3090 3091 3092
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3093
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3094 3095
	u8 *pos;
	bool reassoc;
3096
	struct cfg80211_bss *bss;
3097 3098 3099 3100
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = ASSOC_EVENT,
	};
J
Johannes Berg 已提交
3101

3102
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3103 3104

	if (!assoc_data)
3105
		return;
3106
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3107
		return;
J
Johannes Berg 已提交
3108 3109 3110 3111 3112 3113 3114

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3115
		return;
J
Johannes Berg 已提交
3116 3117 3118 3119 3120 3121

	reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3122 3123 3124 3125
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3126 3127

	pos = mgmt->u.assoc_resp.variable;
3128
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
3129 3130

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3131 3132
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3133
		u32 tu, ms;
3134
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3135
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3136 3137 3138
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3139
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3140
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3141
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3142 3143
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3144 3145
	}

3146
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3147 3148

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3149 3150
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
J
Johannes Berg 已提交
3151
		ieee80211_destroy_assoc_data(sdata, false);
3152 3153 3154
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3155
	} else {
3156
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
J
Johannes Berg 已提交
3157
			/* oops -- internal error -- send timeout for now */
3158
			ieee80211_destroy_assoc_data(sdata, false);
3159
			cfg80211_assoc_timeout(sdata->dev, bss);
3160
			return;
J
Johannes Berg 已提交
3161
		}
3162 3163
		event.u.mlme.status = MLME_SUCCESS;
		drv_event_callback(sdata->local, sdata, &event);
3164
		sdata_info(sdata, "associated\n");
3165 3166 3167 3168 3169 3170 3171

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
		ieee80211_destroy_assoc_data(sdata, true);
3172 3173 3174 3175 3176 3177

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
				uapsd_queues |= BIT(ac);
J
Johannes Berg 已提交
3178 3179
	}

3180
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues);
J
Johannes Berg 已提交
3181
}
J
Johannes Berg 已提交
3182

3183
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3184
				  struct ieee80211_mgmt *mgmt, size_t len,
3185
				  struct ieee80211_rx_status *rx_status,
3186
				  struct ieee802_11_elems *elems)
3187 3188
{
	struct ieee80211_local *local = sdata->local;
3189
	struct ieee80211_bss *bss;
3190
	struct ieee80211_channel *channel;
3191

3192
	sdata_assert_lock(sdata);
3193

3194 3195
	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
	if (!channel)
3196 3197 3198
		return;

	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
3199
					channel);
3200 3201
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3202
		ieee80211_rx_bss_put(local, bss);
3203
	}
3204 3205 3206
}


3207
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3208
					 struct sk_buff *skb)
3209
{
J
Johannes Berg 已提交
3210
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3211
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3212 3213
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
	size_t baselen, len = skb->len;
3214 3215
	struct ieee802_11_elems elems;

3216 3217
	ifmgd = &sdata->u.mgd;

3218
	sdata_assert_lock(sdata);
3219

3220
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
3221 3222
		return; /* ignore ProbeResp to foreign address */

3223 3224 3225 3226 3227
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
3228
			       false, &elems);
3229

3230
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3231

3232
	if (ifmgd->associated &&
3233
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3234
		ieee80211_reset_ap_probe(sdata);
3235 3236
}

3237 3238 3239
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3240 3241 3242
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3243 3244 3245 3246 3247 3248 3249 3250 3251 3252
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3253 3254 3255 3256 3257
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3258 3259
	(1ULL << WLAN_EID_HT_OPERATION) |
	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3260

3261 3262 3263
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
3264
{
3265
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3266
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3267 3268
	size_t baselen;
	struct ieee802_11_elems elems;
3269
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
3270 3271
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
3272
	struct sta_info *sta;
3273
	u32 changed = 0;
3274
	bool erp_valid;
J
Johannes Berg 已提交
3275
	u8 erp_value = 0;
3276
	u32 ncrc;
3277
	u8 *bssid;
3278
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
3279

3280
	sdata_assert_lock(sdata);
3281

3282 3283 3284
	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
3285
		return;
3286

J
Johannes Berg 已提交
3287 3288 3289 3290
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
3291
		return;
J
Johannes Berg 已提交
3292 3293
	}

3294
	if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
J
Johannes Berg 已提交
3295
		rcu_read_unlock();
3296
		return;
J
Johannes Berg 已提交
3297
	}
3298
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
3299
	rcu_read_unlock();
3300

3301
	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
3302
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
J
Johannes Berg 已提交
3303
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3304
				       len - baselen, false, &elems);
3305

3306
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3307 3308 3309 3310
		if (elems.tim && !elems.parse_error) {
			const struct ieee80211_tim_ie *tim_ie = elems.tim;
			ifmgd->dtim_period = tim_ie->dtim_period;
		}
3311
		ifmgd->have_beacon = true;
3312
		ifmgd->assoc_data->need_beacon = false;
3313
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
3314 3315 3316 3317 3318 3319 3320 3321 3322 3323
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
			if (elems.tim)
				sdata->vif.bss_conf.sync_dtim_count =
					elems.tim->dtim_count;
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
3324 3325
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
3326
		ifmgd->assoc_data->timeout_started = true;
3327 3328
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3329
	}
3330

J
Johannes Berg 已提交
3331
	if (!ifmgd->associated ||
3332
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3333
		return;
J
Johannes Berg 已提交
3334
	bssid = ifmgd->associated->bssid;
3335

3336 3337 3338
	/* Track average RSSI from the Beacon frames of the current AP */
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3339
		ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3340
		ifmgd->last_cqm_event_signal = 0;
3341
		ifmgd->count_beacon_signal = 1;
3342
		ifmgd->last_ave_beacon_signal = 0;
3343
	} else {
3344
		ifmgd->count_beacon_signal++;
3345
	}
3346

3347 3348
	ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);

3349 3350
	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3351
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3352
		int last_sig = ifmgd->last_ave_beacon_signal;
3353 3354 3355
		struct ieee80211_event event = {
			.type = RSSI_EVENT,
		};
3356 3357 3358 3359 3360 3361 3362 3363

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3364 3365
			event.u.rssi.data = RSSI_EVENT_HIGH;
			drv_event_callback(local, sdata, &event);
3366 3367 3368 3369
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3370 3371
			event.u.rssi.data = RSSI_EVENT_LOW;
			drv_event_callback(local, sdata, &event);
3372 3373 3374
		}
	}

3375
	if (bss_conf->cqm_rssi_thold &&
3376
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3377
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3378
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3379 3380 3381
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
3382

3383 3384 3385 3386 3387 3388 3389 3390 3391 3392 3393 3394 3395 3396 3397 3398 3399
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				GFP_KERNEL);
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				GFP_KERNEL);
		}
	}

3400
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3401
		mlme_dbg_ratelimited(sdata,
3402
				     "cancelling AP probe due to a received beacon\n");
3403
		ieee80211_reset_ap_probe(sdata);
3404 3405
	}

J
Johannes Berg 已提交
3406 3407 3408 3409
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
3410
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
3411

3412 3413
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3414
					  len - baselen, false, &elems,
3415 3416
					  care_about_ies, ncrc);

3417 3418 3419 3420 3421 3422 3423
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
	    ieee80211_check_tim(elems.tim, elems.tim_len, ifmgd->aid)) {
		if (local->hw.conf.dynamic_ps_timeout > 0) {
			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
				ieee80211_hw_config(local,
						    IEEE80211_CONF_CHANGE_PS);
3424
			}
3425
			ieee80211_send_nullfunc(local, sdata, false);
3426 3427 3428 3429 3430 3431 3432 3433 3434 3435 3436 3437
		} else if (!local->pspolling && sdata->u.mgd.powersave) {
			local->pspolling = true;

			/*
			 * Here is assumed that the driver will be
			 * able to send ps-poll frame and receive a
			 * response even though power save mode is
			 * enabled, but some drivers might require
			 * to disable power save here. This needs
			 * to be investigated.
			 */
			ieee80211_send_pspoll(local, sdata);
3438 3439
		}
	}
J
Johannes Berg 已提交
3440

3441 3442
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
J
Janusz Dziedzic 已提交
3443
		struct ieee80211_p2p_noa_attr noa = {};
3444 3445 3446 3447 3448
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3449
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
3450 3451 3452 3453 3454 3455 3456 3457 3458 3459 3460 3461 3462 3463 3464 3465
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3466 3467 3468 3469 3470
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

3471 3472 3473
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

3474 3475 3476 3477 3478 3479 3480 3481
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
3482
	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
3483 3484 3485 3486 3487 3488 3489 3490 3491 3492 3493
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
		if (elems.tim)
			sdata->vif.bss_conf.sync_dtim_count =
				elems.tim->dtim_count;
		else
			sdata->vif.bss_conf.sync_dtim_count = 0;
	}

3494
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3495
		return;
3496
	ifmgd->beacon_crc = ncrc;
3497
	ifmgd->beacon_crc_valid = true;
3498

3499
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3500

3501
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
3502
					 rx_status->device_timestamp,
3503 3504
					 &elems, true);

3505 3506
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3507 3508 3509
				     elems.wmm_param_len))
		changed |= BSS_CHANGED_QOS;

3510 3511
	/*
	 * If we haven't had a beacon before, tell the driver about the
3512
	 * DTIM period (and beacon timing if desired) now.
3513
	 */
3514
	if (!ifmgd->have_beacon) {
3515 3516 3517 3518 3519
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
		if (elems.tim)
			bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
		else
			bss_conf->dtim_period = 1;
3520

3521 3522
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
3523 3524

		mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
3525
		ieee80211_recalc_ps(local);
3526 3527
		mutex_unlock(&local->iflist_mtx);

3528
		ieee80211_recalc_ps_vif(sdata);
3529 3530
	}

3531
	if (elems.erp_info) {
J
Johannes Berg 已提交
3532 3533 3534 3535
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
3536
	}
J
Johannes Berg 已提交
3537 3538 3539
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
3540

3541
	mutex_lock(&local->sta_mtx);
3542 3543
	sta = sta_info_get(sdata, bssid);

3544 3545
	if (ieee80211_config_bw(sdata, sta,
				elems.ht_cap_elem, elems.ht_operation,
3546 3547
				elems.vht_operation, bssid, &changed)) {
		mutex_unlock(&local->sta_mtx);
3548 3549 3550
		sdata_info(sdata,
			   "failed to follow AP %pM bandwidth change, disconnect\n",
			   bssid);
3551 3552 3553
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
3554 3555 3556
		ieee80211_report_disconnect(sdata, deauth_buf,
					    sizeof(deauth_buf), true,
					    WLAN_REASON_DEAUTH_LEAVING);
3557
		return;
3558
	}
3559 3560 3561

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
3562
					    rx_status->band);
3563
	mutex_unlock(&local->sta_mtx);
3564

3565 3566 3567
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
3568 3569
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
3570

3571
	ieee80211_bss_info_change_notify(sdata, changed);
3572 3573
}

3574 3575
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
3576 3577 3578 3579
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
3580 3581
	struct ieee802_11_elems elems;
	int ies_len;
3582 3583 3584 3585 3586

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

3587
	sdata_lock(sdata);
3588

J
Johannes Berg 已提交
3589 3590
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
3591
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
3592 3593 3594 3595 3596
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
3597
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3598 3599
		break;
	case IEEE80211_STYPE_DEAUTH:
3600
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3601 3602
		break;
	case IEEE80211_STYPE_DISASSOC:
3603
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3604 3605 3606
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
3607
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3608 3609
		break;
	case IEEE80211_STYPE_ACTION:
3610
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3611 3612 3613
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
3614 3615 3616 3617 3618 3619

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
3620
				ies_len, true, &elems);
3621 3622 3623 3624

			if (elems.parse_error)
				break;

3625
			ieee80211_sta_process_chanswitch(sdata,
3626 3627 3628
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3629 3630 3631 3632 3633 3634 3635 3636 3637 3638
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
3639
				ies_len, true, &elems);
3640 3641 3642 3643 3644 3645 3646 3647

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
3648
			ieee80211_sta_process_chanswitch(sdata,
3649 3650 3651
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3652
		}
3653
		break;
3654
	}
3655
	sdata_unlock(sdata);
3656 3657
}

J
Johannes Berg 已提交
3658
static void ieee80211_sta_timer(unsigned long data)
3659
{
J
Johannes Berg 已提交
3660 3661
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
3662

3663
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3664 3665
}

3666
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3667
					  u8 *bssid, u8 reason, bool tx)
3668
{
3669
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3670

3671
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3672
			       tx, frame_buf);
3673

3674 3675
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    reason);
3676 3677
}

3678
static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
3679 3680 3681 3682
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3683
	u32 tx_flags = 0;
3684 3685
	u16 trans = 1;
	u16 status = 0;
J
Johannes Berg 已提交
3686

3687
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3688 3689 3690 3691 3692 3693 3694

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
3695 3696
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
3697 3698 3699 3700 3701 3702 3703 3704 3705 3706

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3707 3708
	drv_mgd_prepare_tx(local, sdata);

3709 3710 3711
	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
		   auth_data->bss->bssid, auth_data->tries,
		   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
3712

3713
	auth_data->expected_transaction = 2;
3714

3715 3716 3717 3718 3719
	if (auth_data->algorithm == WLAN_AUTH_SAE) {
		trans = auth_data->sae_trans;
		status = auth_data->sae_status;
		auth_data->expected_transaction = trans;
	}
J
Johannes Berg 已提交
3720

3721 3722 3723
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
3724

3725 3726 3727 3728 3729
	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
			    auth_data->data, auth_data->data_len,
			    auth_data->bss->bssid,
			    auth_data->bss->bssid, NULL, 0, 0,
			    tx_flags);
J
Johannes Berg 已提交
3730

3731
	if (tx_flags == 0) {
3732
		auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3733
		auth_data->timeout_started = true;
3734
		run_again(sdata, auth_data->timeout);
3735
	} else {
3736 3737 3738 3739
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
		auth_data->timeout_started = true;
		run_again(sdata, auth_data->timeout);
3740
	}
J
Johannes Berg 已提交
3741 3742 3743 3744 3745 3746 3747 3748 3749

	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

3750
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3751 3752 3753

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
3754 3755
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
3756 3757 3758 3759 3760 3761 3762 3763 3764 3765

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3766 3767 3768
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
3769 3770
	ieee80211_send_assoc(sdata);

3771
	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
3772
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3773
		assoc_data->timeout_started = true;
3774
		run_again(sdata, assoc_data->timeout);
3775
	} else {
3776 3777 3778 3779 3780
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
3781
	}
J
Johannes Berg 已提交
3782 3783 3784 3785

	return 0;
}

3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

3798
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
3799 3800
{
	struct ieee80211_local *local = sdata->local;
3801
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3802

3803
	sdata_lock(sdata);
3804

3805 3806 3807 3808 3809
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
3810
		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
3811 3812 3813
			if (status_acked) {
				ifmgd->auth_data->timeout =
					jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3814
				run_again(sdata, ifmgd->auth_data->timeout);
3815 3816 3817
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
3818
			ifmgd->auth_data->timeout_started = true;
3819 3820 3821 3822 3823 3824
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3825
				run_again(sdata, ifmgd->assoc_data->timeout);
3826 3827 3828
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
3829
			ifmgd->assoc_data->timeout_started = true;
3830 3831 3832
		}
	}

3833
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
3834 3835 3836 3837 3838 3839 3840
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
3841
		} else if (ieee80211_auth(sdata)) {
J
Johannes Berg 已提交
3842
			u8 bssid[ETH_ALEN];
3843 3844 3845 3846 3847
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = AUTH_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
3848 3849 3850 3851 3852

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

3853
			cfg80211_auth_timeout(sdata->dev, bssid);
3854
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3855
		}
3856
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3857
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
3858

3859
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
3860
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
3861
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
3862
		    ieee80211_do_assoc(sdata)) {
3863
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
3864 3865 3866 3867 3868
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = ASSOC_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
3869 3870

			ieee80211_destroy_assoc_data(sdata, false);
3871
			cfg80211_assoc_timeout(sdata->dev, bss);
3872
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3873
		}
3874
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3875
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
3876

3877
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
3878
	    ifmgd->associated) {
3879
		u8 bssid[ETH_ALEN];
3880
		int max_tries;
3881

3882
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3883

3884
		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3885
			max_tries = max_nullfunc_tries;
3886
		else
3887
			max_tries = max_probe_tries;
3888

3889 3890 3891
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
3892 3893
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3894 3895 3896 3897
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
3898 3899
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
3900 3901 3902
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
3903
				ieee80211_sta_connection_lost(sdata, bssid,
3904 3905
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
3906 3907
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
3908
			run_again(sdata, ifmgd->probe_timeout);
3909
		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
J
Johannes Berg 已提交
3910 3911 3912
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
3913
			ieee80211_sta_connection_lost(sdata, bssid,
3914
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3915
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3916 3917 3918 3919
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
3920 3921
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
3922 3923 3924 3925
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
3926 3927 3928
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, disconnecting.\n",
				 bssid, probe_wait_ms);
3929

3930
			ieee80211_sta_connection_lost(sdata, bssid,
3931
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
3932 3933 3934
		}
	}

3935
	sdata_unlock(sdata);
3936 3937
}

J
Johannes Berg 已提交
3938 3939 3940 3941
static void ieee80211_sta_bcn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
3942
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3943

3944
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3945 3946
		return;

3947
	sdata->u.mgd.connection_loss = false;
3948 3949
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
3950 3951 3952 3953 3954 3955 3956 3957 3958
}

static void ieee80211_sta_conn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

3959
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3960 3961
		return;

3962
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
3963 3964 3965 3966 3967 3968 3969 3970 3971 3972 3973
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
3974 3975
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
3976
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3977
		__ieee80211_stop_poll(sdata);
3978

J
Johannes Berg 已提交
3979
		/* let's probe the connection once */
3980
		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
3981 3982
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
3983
	}
J
Johannes Berg 已提交
3984
}
3985

3986
#ifdef CONFIG_PM
3987 3988 3989 3990 3991 3992 3993
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

3994 3995 3996 3997 3998
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

3999
		/*
4000 4001 4002
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
4003
		 */
4004
		ieee80211_send_deauth_disassoc(sdata, bssid,
4005 4006 4007
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
4008 4009 4010 4011
		if (ifmgd->assoc_data)
			ieee80211_destroy_assoc_data(sdata, false);
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
4012 4013 4014 4015
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

4016 4017 4018 4019 4020 4021 4022 4023 4024 4025 4026 4027 4028 4029 4030 4031 4032 4033 4034 4035 4036 4037 4038 4039 4040 4041 4042 4043
	/* This is a bit of a hack - we should find a better and more generic
	 * solution to this. Normally when suspending, cfg80211 will in fact
	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
	 * auth (not so important) or assoc (this is the problem) process.
	 *
	 * As a consequence, it can happen that we are in the process of both
	 * associating and suspending, and receive an association response
	 * after cfg80211 has checked if it needs to disconnect, but before
	 * we actually set the flag to drop incoming frames. This will then
	 * cause the workqueue flush to process the association response in
	 * the suspend, resulting in a successful association just before it
	 * tries to remove the interface from the driver, which now though
	 * has a channel context assigned ... this results in issues.
	 *
	 * To work around this (for now) simply deauth here again if we're
	 * now connected.
	 */
	if (ifmgd->associated && !sdata->local->wowlan) {
		u8 bssid[ETH_ALEN];
		struct cfg80211_deauth_request req = {
			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
			.bssid = bssid,
		};

		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
		ieee80211_mgd_deauth(sdata, &req);
	}

4044 4045 4046
	sdata_unlock(sdata);
}

4047 4048 4049 4050
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4051
	sdata_lock(sdata);
4052
	if (!ifmgd->associated) {
4053
		sdata_unlock(sdata);
4054 4055 4056 4057 4058 4059 4060 4061 4062 4063
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4064
		sdata_unlock(sdata);
4065 4066
		return;
	}
4067
	sdata_unlock(sdata);
4068 4069 4070
}
#endif

J
Johannes Berg 已提交
4071 4072
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4073
{
4074
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4075

4076
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4077
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4078
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4079 4080
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4081 4082
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4083
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4084 4085
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4086
	setup_timer(&ifmgd->timer, ieee80211_sta_timer,
S
Sujith 已提交
4087
		    (unsigned long) sdata);
J
Johannes Berg 已提交
4088 4089 4090 4091
	setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
		    (unsigned long) sdata);
	setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
		    (unsigned long) sdata);
4092
	setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
J
Johannes Berg 已提交
4093
		    (unsigned long) sdata);
4094 4095
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4096

4097
	ifmgd->flags = 0;
4098
	ifmgd->powersave = sdata->wdev.ps;
4099 4100
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4101
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4102

4103
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4104 4105 4106
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4107 4108 4109 4110 4111

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4112 4113
}

4114 4115
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4116
{
4117
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4118

4119 4120
	/* Restart STA timers */
	rcu_read_lock();
4121 4122 4123 4124
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4125 4126
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4127

J
Johannes Berg 已提交
4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4140
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4141 4142 4143 4144 4145 4146 4147 4148 4149 4150 4151 4152
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4153
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4154 4155 4156 4157 4158 4159 4160 4161 4162 4163 4164 4165 4166 4167 4168 4169 4170 4171
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

4172 4173
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4174 4175 4176
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4177
	const struct ieee80211_ht_cap *ht_cap = NULL;
4178
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4179
	const struct ieee80211_vht_operation *vht_oper = NULL;
4180
	struct ieee80211_supported_band *sband;
4181
	struct cfg80211_chan_def chandef;
J
Johannes Berg 已提交
4182
	int ret;
4183 4184
	u32 i;
	bool have_80mhz;
4185

4186 4187
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4188 4189 4190 4191
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4192 4193
	rcu_read_lock();

J
Johannes Berg 已提交
4194 4195
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    sband->ht_cap.ht_supported) {
4196
		const u8 *ht_oper_ie, *ht_cap_ie;
4197

4198
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4199 4200
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4201

4202 4203 4204 4205 4206
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4207 4208 4209
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4210 4211
	}

J
Johannes Berg 已提交
4212 4213
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    sband->vht_cap.vht_supported) {
4214
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4215

4216 4217
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4218 4219 4220 4221
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4222
			sdata_info(sdata,
J
Johannes Berg 已提交
4223
				   "AP advertised VHT without HT, disabling both\n");
4224 4225
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4226
		}
4227 4228 4229 4230 4231 4232

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4233 4234
	}

4235 4236 4237 4238 4239 4240 4241 4242 4243 4244 4245 4246 4247 4248
	/* Allow VHT if at least one channel on the sband supports 80 MHz */
	have_80mhz = false;
	for (i = 0; i < sband->n_channels; i++) {
		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
						IEEE80211_CHAN_NO_80MHZ))
			continue;

		have_80mhz = true;
		break;
	}

	if (!have_80mhz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4249 4250
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
4251
						     ht_cap, ht_oper, vht_oper,
4252
						     &chandef, false);
4253

J
Johannes Berg 已提交
4254 4255
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4256

4257 4258
	rcu_read_unlock();

4259 4260 4261
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4262
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4263 4264 4265 4266 4267 4268 4269
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4270 4271 4272 4273

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4274
		goto out;
4275

4276
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4277
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4278 4279 4280
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4281 4282
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4283
	return ret;
4284 4285 4286
}

static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
4287 4288
				     struct cfg80211_bss *cbss, bool assoc,
				     bool override)
4289 4290 4291 4292 4293
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
4294
	struct ieee80211_supported_band *sband;
4295
	bool have_sta = false;
4296 4297
	int err;

4298 4299
	sband = local->hw.wiphy->bands[cbss->channel->band];

4300 4301 4302 4303 4304 4305 4306 4307 4308 4309 4310 4311 4312 4313
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
4314

4315
	if (new_sta || override) {
4316 4317 4318 4319 4320 4321 4322 4323
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

J
Johannes Berg 已提交
4324
	if (new_sta) {
4325 4326 4327
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
4328
		struct ieee80211_chanctx_conf *chanctx_conf;
J
Johannes Berg 已提交
4329
		const struct cfg80211_bss_ies *ies;
4330
		int shift = ieee80211_vif_get_shift(&sdata->vif);
4331
		u32 rate_flags;
4332

4333 4334 4335 4336
		rcu_read_lock();
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
		if (WARN_ON(!chanctx_conf)) {
			rcu_read_unlock();
E
Eytan Lifshitz 已提交
4337
			sta_info_free(local, new_sta);
4338 4339 4340 4341
			return -EINVAL;
		}
		rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
		rcu_read_unlock();
4342 4343 4344 4345 4346

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
4347 4348
				    &min_rate, &min_rate_index,
				    shift, rate_flags);
4349 4350 4351 4352 4353 4354 4355 4356 4357 4358

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
		 */
		if (!basic_rates && min_rate_index >= 0) {
J
Johannes Berg 已提交
4359 4360
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
4361 4362 4363
			basic_rates = BIT(min_rate_index);
		}

J
Johannes Berg 已提交
4364
		new_sta->sta.supp_rates[cbss->channel->band] = rates;
4365 4366 4367
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
J
Johannes Berg 已提交
4368
		if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
4369 4370 4371 4372 4373 4374 4375
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

4376 4377
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
4378
		rcu_read_lock();
4379 4380 4381 4382 4383 4384 4385 4386 4387 4388 4389 4390 4391
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			const u8 *tim_ie;

			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						  ies->data, ies->len);
			if (tim_ie && tim_ie[1] >= 2)
				sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
4392 4393
		} else if (!ieee80211_hw_check(&sdata->local->hw,
					       TIMING_BEACON_ONLY)) {
4394 4395 4396 4397 4398 4399 4400 4401 4402 4403 4404
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
4405
		rcu_read_unlock();
4406 4407

		/* tell driver about BSSID, basic rates and timing */
4408
		ieee80211_bss_info_change_notify(sdata,
4409 4410
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
4411 4412

		if (assoc)
J
Johannes Berg 已提交
4413
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
4414

J
Johannes Berg 已提交
4415 4416
		err = sta_info_insert(new_sta);
		new_sta = NULL;
4417
		if (err) {
J
Johannes Berg 已提交
4418 4419 4420
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
4421 4422 4423
			return err;
		}
	} else
4424
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4425

4426 4427 4428 4429
	/* Cancel scan to ensure that nothing interferes with connection */
	if (local->scanning)
		ieee80211_scan_cancel(local);

4430 4431 4432
	return 0;
}

4433 4434 4435
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
4436
{
J
Johannes Berg 已提交
4437 4438 4439
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
4440
	u16 auth_alg;
J
Johannes Berg 已提交
4441 4442 4443
	int err;

	/* prepare auth data structure */
J
Johannes Berg 已提交
4444

4445 4446 4447 4448 4449
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
J
Johannes Berg 已提交
4450
		if (IS_ERR(local->wep_tx_tfm))
4451
			return -EOPNOTSUPP;
4452 4453 4454 4455 4456 4457 4458 4459
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
4460 4461 4462
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
4463 4464
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4465
	}
4466

4467 4468
	auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
4469
	if (!auth_data)
J
Johannes Berg 已提交
4470
		return -ENOMEM;
4471

J
Johannes Berg 已提交
4472
	auth_data->bss = req->bss;
4473

4474 4475 4476 4477 4478 4479 4480 4481 4482
	if (req->sae_data_len >= 4) {
		__le16 *pos = (__le16 *) req->sae_data;
		auth_data->sae_trans = le16_to_cpu(pos[0]);
		auth_data->sae_status = le16_to_cpu(pos[1]);
		memcpy(auth_data->data, req->sae_data + 4,
		       req->sae_data_len - 4);
		auth_data->data_len += req->sae_data_len - 4;
	}

4483
	if (req->ie && req->ie_len) {
4484 4485 4486
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
4487
	}
4488

J
Johannes Berg 已提交
4489
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
4490 4491 4492
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
4493 4494
	}

J
Johannes Berg 已提交
4495
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
4496

J
Johannes Berg 已提交
4497
	/* try to authenticate/probe */
4498

J
Johannes Berg 已提交
4499 4500 4501 4502
	if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
	    ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
4503 4504
	}

J
Johannes Berg 已提交
4505 4506
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
4507

J
Johannes Berg 已提交
4508 4509
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
4510

4511 4512 4513
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

4514 4515 4516
		sdata_info(sdata,
			   "disconnect from AP %pM for new auth to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
4517 4518 4519 4520
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4521 4522 4523
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
4524
	}
J
Johannes Berg 已提交
4525

J
Johannes Berg 已提交
4526
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4527

4528
	err = ieee80211_prep_connection(sdata, req->bss, false, false);
4529
	if (err)
J
Johannes Berg 已提交
4530
		goto err_clear;
J
Johannes Berg 已提交
4531

4532
	err = ieee80211_auth(sdata);
J
Johannes Berg 已提交
4533 4534 4535 4536 4537 4538
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
4539
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4540
	return 0;
J
Johannes Berg 已提交
4541 4542

 err_clear:
4543
	eth_zero_addr(ifmgd->bssid);
4544
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4545
	ifmgd->auth_data = NULL;
4546 4547 4548
	mutex_lock(&sdata->local->mtx);
	ieee80211_vif_release_channel(sdata);
	mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
4549 4550 4551
 err_free:
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
4552 4553
}

4554 4555
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
4556
{
J
Johannes Berg 已提交
4557
	struct ieee80211_local *local = sdata->local;
4558
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4559
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
4560
	struct ieee80211_mgd_assoc_data *assoc_data;
4561
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
4562
	struct ieee80211_supported_band *sband;
4563
	const u8 *ssidie, *ht_ie, *vht_ie;
4564
	int i, err;
4565
	bool override = false;
4566

J
Johannes Berg 已提交
4567 4568 4569 4570
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

4571 4572 4573 4574 4575 4576 4577 4578 4579 4580 4581
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
	if (!ssidie) {
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

4582 4583 4584
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

4585 4586 4587
		sdata_info(sdata,
			   "disconnect from AP %pM for new assoc to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
4588 4589 4590 4591
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4592 4593 4594
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
4595
	}
J
Johannes Berg 已提交
4596 4597 4598 4599

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
4600
	}
4601

J
Johannes Berg 已提交
4602 4603 4604 4605
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
4606

J
Johannes Berg 已提交
4607 4608 4609 4610
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
4611
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
4612
		ieee80211_destroy_auth_data(sdata, match);
4613 4614
	}

J
Johannes Berg 已提交
4615
	/* prepare assoc data */
4616

4617 4618
	ifmgd->beacon_crc_valid = false;

4619 4620 4621
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);

J
Johannes Berg 已提交
4622 4623 4624 4625 4626 4627 4628
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
4629
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4630 4631
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4632
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4633
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4634
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4635
			netdev_info(sdata->dev,
4636
				    "disabling HT/VHT due to WEP/TKIP use\n");
4637 4638
		}
	}
4639

J
Johannes Berg 已提交
4640 4641 4642
	/* Also disable HT if we don't support it or the AP doesn't use WMM */
	sband = local->hw.wiphy->bands[req->bss->channel->band];
	if (!sband->ht_cap.ht_supported ||
4643 4644
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4645
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4646 4647
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4648 4649
			netdev_info(sdata->dev,
				    "disabling HT as WMM/QoS is not supported by the AP\n");
4650
	}
J
Johannes Berg 已提交
4651

4652 4653
	/* disable VHT if we don't support it or the AP doesn't use WMM */
	if (!sband->vht_cap.vht_supported ||
4654 4655
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4656
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4657 4658
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4659 4660
			netdev_info(sdata->dev,
				    "disabling VHT as WMM/QoS is not supported by the AP\n");
4661 4662
	}

B
Ben Greear 已提交
4663 4664 4665 4666
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

4667 4668 4669 4670
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

4671
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
4672 4673 4674
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
4675

J
Johannes Berg 已提交
4676
	assoc_data->bss = req->bss;
4677

J
Johannes Berg 已提交
4678 4679
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
4680
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
4681
		else
4682
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
4683
	} else
4684
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
4685

J
Johannes Berg 已提交
4686 4687 4688
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
4689

4690
	rcu_read_lock();
4691 4692 4693 4694 4695
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
	else
4696
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4697 4698 4699 4700 4701 4702
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
	else
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4703
	rcu_read_unlock();
4704

4705
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
4706
		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
4707 4708 4709
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
4710
	if (bss->wmm_used && bss->uapsd_supported &&
4711
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
4712
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
4713 4714
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
4715
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
4716 4717 4718
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

4719
	if (req->prev_bssid)
J
Johannes Berg 已提交
4720
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4721 4722 4723 4724 4725 4726 4727 4728 4729

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

4730 4731 4732 4733 4734
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

4735 4736 4737 4738 4739
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

4740 4741
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4742 4743
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
4744

J
Johannes Berg 已提交
4745 4746 4747
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
4748
	ifmgd->dtim_period = 0;
4749
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
4750

4751 4752 4753 4754 4755 4756 4757 4758 4759 4760 4761 4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779 4780
	/* override HT/VHT configuration only if the AP and we support it */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
		struct ieee80211_sta_ht_cap sta_ht_cap;

		if (req->flags & ASSOC_REQ_DISABLE_HT)
			override = true;

		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

		/* check for 40 MHz disable override */
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
		    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
		    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
			override = true;

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
		    req->flags & ASSOC_REQ_DISABLE_VHT)
			override = true;
	}

	if (req->flags & ASSOC_REQ_DISABLE_HT) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
	}

	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	err = ieee80211_prep_connection(sdata, req->bss, true, override);
4781 4782
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
4783

4784 4785
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
4786

4787
	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
4788 4789 4790 4791 4792 4793 4794 4795
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4796
		assoc_data->timeout_started = true;
4797 4798 4799 4800 4801
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
		const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						    beacon_ies->data,
						    beacon_ies->len);
4802 4803
		u8 dtim_count = 0;

4804 4805 4806 4807
		if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
			const struct ieee80211_tim_ie *tim;
			tim = (void *)(tim_ie + 2);
			ifmgd->dtim_period = tim->dtim_period;
4808
			dtim_count = tim->dtim_count;
4809
		}
4810
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
4811
		assoc_data->timeout = jiffies;
4812
		assoc_data->timeout_started = true;
4813

4814
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4815 4816 4817 4818 4819
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
4820 4821
	} else {
		assoc_data->timeout = jiffies;
4822
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
4823
	}
4824 4825
	rcu_read_unlock();

4826
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
4827

P
Paul Stewart 已提交
4828 4829 4830 4831 4832 4833 4834 4835 4836 4837
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
4838 4839
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
4840 4841
	}

4842
	return 0;
J
Johannes Berg 已提交
4843
 err_clear:
4844
	eth_zero_addr(ifmgd->bssid);
4845
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4846 4847 4848 4849
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
4850 4851
}

4852
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4853
			 struct cfg80211_deauth_request *req)
4854
{
4855
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4856
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4857
	bool tx = !req->local_state_change;
4858

4859 4860 4861 4862 4863 4864
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
4865

4866
		drv_mgd_prepare_tx(sdata->local, sdata);
4867 4868
		ieee80211_send_deauth_disassoc(sdata, req->bssid,
					       IEEE80211_STYPE_DEAUTH,
4869
					       req->reason_code, tx,
4870
					       frame_buf);
4871
		ieee80211_destroy_auth_data(sdata, false);
4872 4873 4874
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
4875

4876
		return 0;
4877 4878
	}

4879 4880 4881 4882 4883 4884 4885 4886 4887 4888 4889 4890 4891 4892 4893 4894 4895 4896 4897
	if (ifmgd->assoc_data &&
	    ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting association with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

		drv_mgd_prepare_tx(sdata->local, sdata);
		ieee80211_send_deauth_disassoc(sdata, req->bssid,
					       IEEE80211_STYPE_DEAUTH,
					       req->reason_code, tx,
					       frame_buf);
		ieee80211_destroy_assoc_data(sdata, false);
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
		return 0;
	}

4898 4899
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4900 4901 4902 4903 4904
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

4905 4906
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
4907 4908 4909
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
4910 4911
		return 0;
	}
4912

4913
	return -ENOTCONN;
4914
}
4915

4916
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4917
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
4918
{
4919
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4920
	u8 bssid[ETH_ALEN];
4921
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
4922

J
Johannes Berg 已提交
4923 4924 4925 4926 4927 4928
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
4929
	if (ifmgd->associated != req->bss)
4930 4931
		return -ENOLINK;

J
Johannes Berg 已提交
4932
	sdata_info(sdata,
4933 4934
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
4935

4936
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
4937 4938 4939
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
4940

4941 4942
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    req->reason_code);
4943

4944 4945
	return 0;
}
4946

4947
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4948 4949 4950
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4951 4952 4953 4954 4955 4956 4957 4958 4959 4960
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
4961
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
4962

4963
	sdata_lock(sdata);
4964 4965
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4966
		ieee80211_destroy_assoc_data(sdata, false);
4967 4968
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
4969 4970
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
4971 4972 4973 4974 4975 4976 4977
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
	spin_unlock_bh(&ifmgd->teardown_lock);
4978
	del_timer_sync(&ifmgd->timer);
4979
	sdata_unlock(sdata);
4980 4981
}

4982 4983 4984 4985 4986 4987
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

J
Johannes Berg 已提交
4988 4989
	trace_api_cqm_rssi_notify(sdata, rssi_event);

4990 4991 4992
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
4993 4994 4995 4996 4997 4998 4999 5000 5001 5002

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);