mlme.c 167.9 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-only
2 3
/*
 * BSS client mode implementation
4
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
5 6 7 8
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9
 * Copyright 2013-2014  Intel Mobile Communications GmbH
10
 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
11
 * Copyright (C) 2018 - 2020 Intel Corporation
12 13
 */

14
#include <linux/delay.h>
15
#include <linux/fips.h>
16 17 18 19
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
20
#include <linux/moduleparam.h>
21
#include <linux/rtnetlink.h>
22
#include <linux/crc32.h>
23
#include <linux/slab.h>
24
#include <linux/export.h>
25
#include <net/mac80211.h>
26
#include <asm/unaligned.h>
J
Johannes Berg 已提交
27

28
#include "ieee80211_i.h"
29
#include "driver-ops.h"
J
Johannes Berg 已提交
30 31
#include "rate.h"
#include "led.h"
32
#include "fils_aead.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
37
#define IEEE80211_AUTH_TIMEOUT_SAE	(HZ * 2)
38 39 40
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
41
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
42 43
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
44

45 46 47 48 49 50 51 52 53
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
54 55

/*
56 57 58 59 60 61
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
62
 */
63 64 65 66
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
67

J
Johannes Berg 已提交
68 69 70 71
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
72
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
73 74 75 76 77
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
78 79 80 81 82
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
83

84 85 86 87 88 89
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
90 91 92 93 94 95 96 97 98 99
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
100 101
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
102
{
103
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
104

105 106 107
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
108 109
}

110
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
111
{
112
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
113 114
		return;

115
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
116 117
		return;

J
Johannes Berg 已提交
118
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
119
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
120 121
}

122 123
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
124 125
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

126
	if (unlikely(!ifmgd->associated))
127 128
		return;

129 130
	if (ifmgd->probe_send_count)
		ifmgd->probe_send_count = 0;
131

132
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
133 134
		return;

135
	mod_timer(&ifmgd->conn_mon_timer,
136 137 138
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

139
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
140
{
141
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
142 143
}

144 145 146 147
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
148
			     u32 vht_cap_info,
149 150
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
151
			     const struct ieee80211_he_operation *he_oper,
152
			     struct cfg80211_chan_def *chandef, bool tracking)
153
{
154
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
155
	struct cfg80211_chan_def vht_chandef;
156
	struct ieee80211_sta_ht_cap sta_ht_cap;
157 158
	u32 ht_cfreq, ret;

159
	memset(chandef, 0, sizeof(struct cfg80211_chan_def));
160 161 162
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
163
	chandef->freq1_offset = channel->freq_offset;
164

165 166 167 168 169
	if (channel->band == NL80211_BAND_6GHZ) {
		if (!ieee80211_chandef_he_6ghz_oper(sdata, he_oper, chandef))
			ret = IEEE80211_STA_DISABLE_HT |
			      IEEE80211_STA_DISABLE_VHT |
			      IEEE80211_STA_DISABLE_HE;
170 171
		else
			ret = 0;
172 173 174 175 176 177 178
		vht_chandef = *chandef;
		goto out;
	}

	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

179
	if (!ht_oper || !sta_ht_cap.ht_supported) {
180 181 182
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
183 184 185 186 187 188 189 190
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
191
	if (!tracking && channel->center_freq != ht_cfreq) {
192 193 194 195 196 197 198
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
199 200 201 202
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
203 204 205
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
206 207 208 209
		goto out;
	}

	/* check 40 MHz support, if we have it */
210
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
211
		ieee80211_chandef_ht_oper(ht_oper, chandef);
212 213 214
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
215 216
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
217 218 219 220 221 222 223 224
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

225
	vht_chandef = *chandef;
L
Luca Coelho 已提交
226 227 228 229 230 231 232 233 234 235 236 237
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && he_oper &&
	    (le32_to_cpu(he_oper->he_oper_params) &
	     IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
		struct ieee80211_vht_operation he_oper_vht_cap;

		/*
		 * Set only first 3 bytes (other 2 aren't used in
		 * ieee80211_chandef_vht_oper() anyway)
		 */
		memcpy(&he_oper_vht_cap, he_oper->optional, 3);
		he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);

238
		if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
239
						&he_oper_vht_cap, ht_oper,
L
Luca Coelho 已提交
240 241 242 243 244 245 246
						&vht_chandef)) {
			if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
				sdata_info(sdata,
					   "HE AP VHT information is invalid, disable HE\n");
			ret = IEEE80211_STA_DISABLE_HE;
			goto out;
		}
247 248 249 250
	} else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
					       vht_cap_info,
					       vht_oper, ht_oper,
					       &vht_chandef)) {
251
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
252
			sdata_info(sdata,
253
				   "AP VHT information is invalid, disable VHT\n");
254 255 256 257 258
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
259
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
260 261
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
262 263 264 265 266 267 268 269 270 271
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
272
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
273 274
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
275 276 277 278 279 280 281 282 283
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

306 307 308 309
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

310 311 312 313 314 315 316 317
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
318
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
319 320
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
321 322
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
323 324
			      IEEE80211_STA_DISABLE_VHT |
			      IEEE80211_STA_DISABLE_HE;
325
			break;
326 327
		}

328
		ret |= ieee80211_chandef_downgrade(chandef);
329 330
	}

331 332
	if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
						 IEEE80211_CHAN_NO_HE))
333 334
		ret |= IEEE80211_STA_DISABLE_HE;

335
	if (chandef->width != vht_chandef.width && !tracking)
336 337 338 339 340 341 342
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

343 344
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
345
			       const struct ieee80211_ht_cap *ht_cap,
346
			       const struct ieee80211_vht_cap *vht_cap,
347 348
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
349
			       const struct ieee80211_he_operation *he_oper,
350
			       const u8 *bssid, u32 *changed)
351 352
{
	struct ieee80211_local *local = sdata->local;
353
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
L
Luca Coelho 已提交
354 355 356
	struct ieee80211_channel *chan = sdata->vif.bss_conf.chandef.chan;
	struct ieee80211_supported_band *sband =
		local->hw.wiphy->bands[chan->band];
357
	struct cfg80211_chan_def chandef;
358
	u16 ht_opmode;
359 360
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
361
	u32 vht_cap_info = 0;
362
	int ret;
363

364 365
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
366 367
		return 0;

368 369 370 371
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

L
Luca Coelho 已提交
372 373 374 375 376
	/* don't check HE if we associated as non-HE station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HE ||
	    !ieee80211_get_he_sta_cap(sband))
		he_oper = NULL;

377 378 379
	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

380 381 382 383 384 385 386 387 388 389
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

390 391 392
	if (vht_cap)
		vht_cap_info = le32_to_cpu(vht_cap->vht_cap_info);

L
Luca Coelho 已提交
393
	/* calculate new channel (type) based on HT/VHT/HE operation IEs */
394
	flags = ieee80211_determine_chantype(sdata, sband, chan, vht_cap_info,
L
Luca Coelho 已提交
395
					     ht_oper, vht_oper, he_oper,
396
					     &chandef, true);
397 398 399 400 401 402 403 404 405 406

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
407
		flags |= ieee80211_chandef_downgrade(&chandef);
408 409
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
410
		flags |= ieee80211_chandef_downgrade(&chandef);
411 412
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
413
		flags |= ieee80211_chandef_downgrade(&chandef);
414 415 416 417 418

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
419 420 421 422 423 424
		   "AP %pM changed bandwidth, new config is %d.%03d MHz, "
		   "width %d (%d.%03d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq,
		   chandef.chan->freq_offset, chandef.width,
		   chandef.center_freq1, chandef.freq1_offset,
		   chandef.center_freq2);
425 426 427

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
428
				      IEEE80211_STA_DISABLE_HE |
429 430 431 432 433 434 435 436 437 438 439 440 441 442 443
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
444
	case NL80211_CHAN_WIDTH_40:
445
		new_sta_bw = IEEE80211_STA_RX_BW_40;
446
		break;
447 448 449 450 451 452
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
453
		break;
454 455
	default:
		return -EINVAL;
456
	}
457

458 459
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
460

461 462 463 464 465
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
466

467 468 469 470 471 472 473
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
474

475 476 477 478
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
479
	}
480

481
	return 0;
482 483
}

J
Johannes Berg 已提交
484 485
/* frame sending functions */

J
Johannes Berg 已提交
486
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
487
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

505
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
506 507 508 509 510 511 512 513 514 515 516 517 518 519
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

520 521 522 523 524 525 526 527 528 529
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
530 531 532 533 534 535
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
536
		/* fall through */
J
Johannes Berg 已提交
537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

556 557 558 559
/* This function determines vht capability flags for the association
 * and builds the IE.
 * Note - the function may set the owner of the MU-MIMO capability
 */
560 561
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
562 563
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
564
{
565
	struct ieee80211_local *local = sdata->local;
566 567 568
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
569
	u32 mask, ap_bf_sts, our_bf_sts;
570 571 572 573

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
574
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
575 576 577 578

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
579
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
580 581 582 583 584 585
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
586 587 588 589
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
590
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
591 592
	}

593 594 595 596 597 598
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616
		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
	else if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

	/*
	 * If some other vif is using the MU-MIMO capablity we cannot associate
	 * using MU-MIMO - this will lead to contradictions in the group-id
	 * mechanism.
	 * Ownership is defined since association request, in order to avoid
	 * simultaneous associations with MU-MIMO.
	 */
	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
		bool disable_mu_mimo = false;
		struct ieee80211_sub_if_data *other;

		list_for_each_entry_rcu(other, &local->interfaces, list) {
617
			if (other->vif.mu_mimo_owner) {
618 619 620 621 622 623 624
				disable_mu_mimo = true;
				break;
			}
		}
		if (disable_mu_mimo)
			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
		else
625
			sdata->vif.mu_mimo_owner = true;
626
	}
627

628 629 630 631 632 633 634 635 636 637
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

638
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
639
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
640 641 642
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

L
Luca Coelho 已提交
643 644 645 646 647 648 649 650 651
/* This function determines HE capability flags for the association
 * and builds the IE.
 */
static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
				struct sk_buff *skb,
				struct ieee80211_supported_band *sband)
{
	u8 *pos;
	const struct ieee80211_sta_he_cap *he_cap = NULL;
652
	struct ieee80211_chanctx_conf *chanctx_conf;
L
Luca Coelho 已提交
653
	u8 he_cap_size;
654 655 656 657 658 659 660 661 662 663
	bool reg_cap = false;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!WARN_ON_ONCE(!chanctx_conf))
		reg_cap = cfg80211_chandef_usable(sdata->wdev.wiphy,
						  &chanctx_conf->def,
						  IEEE80211_CHAN_NO_HE);

	rcu_read_unlock();
L
Luca Coelho 已提交
664 665

	he_cap = ieee80211_get_he_sta_cap(sband);
666
	if (!he_cap || !reg_cap)
L
Luca Coelho 已提交
667 668 669 670 671 672 673 674 675 676 677 678 679
		return;

	/*
	 * TODO: the 1 added is because this temporarily is under the EXTENSION
	 * IE. Get rid of it when it moves.
	 */
	he_cap_size =
		2 + 1 + sizeof(he_cap->he_cap_elem) +
		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
		ieee80211_he_ppe_size(he_cap->ppe_thres[0],
				      he_cap->he_cap_elem.phy_cap_info);
	pos = skb_put(skb, he_cap_size);
	ieee80211_ie_build_he_cap(pos, he_cap, pos + he_cap_size);
680 681

	ieee80211_ie_build_he_6ghz_cap(sdata, skb);
L
Luca Coelho 已提交
682 683
}

J
Johannes Berg 已提交
684 685 686 687 688 689 690
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
691
	u8 *pos, qos_info, *ie_start;
J
Johannes Berg 已提交
692
	size_t offset = 0, noffset;
693
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
694 695
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
696 697
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
698
	u32 rates = 0;
699 700 701 702 703 704 705
	struct element *ext_capa = NULL;

	/* we know it's writable, cast away the const */
	if (assoc_data->ie_len)
		ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
						      assoc_data->ie,
						      assoc_data->ie_len);
J
Johannes Berg 已提交
706

707
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
708

J
Johannes Berg 已提交
709 710 711 712 713 714
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
715
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
716 717
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
718
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
719 720 721 722 723 724 725 726

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
727 728 729 730
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
731 732 733 734 735 736
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
737 738 739 740 741
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
742 743 744 745 746 747 748 749 750
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
751
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
L
Luca Coelho 已提交
752 753 754
			2 + 1 + sizeof(struct ieee80211_he_cap_elem) + /* HE */
				sizeof(struct ieee80211_he_mcs_nss_supp) +
				IEEE80211_HE_PPE_THRES_MAX_LEN +
755
			2 + 1 + sizeof(struct ieee80211_he_6ghz_capa) +
J
Johannes Berg 已提交
756
			assoc_data->ie_len + /* extra IEs */
757
			(assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
J
Johannes Berg 已提交
758 759 760 761 762 763 764 765 766
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

767
	if (sband->band == NL80211_BAND_2GHZ) {
768 769
		capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
J
Johannes Berg 已提交
770 771 772 773 774 775
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
776
	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
J
Johannes Berg 已提交
777 778
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

779 780 781
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

782
	mgmt = skb_put_zero(skb, 24);
J
Johannes Berg 已提交
783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
807
	ie_start = pos;
J
Johannes Berg 已提交
808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
824 825 826
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
827 828 829 830 831 832 833 834 835 836 837 838
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
839 840 841 842
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
843 844 845 846
			}
		}
	}

847 848
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
849 850 851 852
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
853 854
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
855
	}
J
Johannes Berg 已提交
856

857 858 859 860 861 862 863 864 865
	/*
	 * Per spec, we shouldn't include the list of channels if we advertise
	 * support for extended channel switching, but we've always done that;
	 * (for now?) apply this restriction only on the (new) 6 GHz band.
	 */
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
	    (sband->band != NL80211_BAND_6GHZ ||
	     !ext_capa || ext_capa->datalen < 1 ||
	     !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
J
Johannes Berg 已提交
866 867 868 869 870 871 872 873 874 875 876
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

877 878
	/* Set MBSSID support for HE AP if needed */
	if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
879 880 881
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && assoc_data->ie_len &&
	    ext_capa && ext_capa->datalen >= 3)
		ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
882

J
Johannes Berg 已提交
883
	/* if present, add any custom IEs that go before HT */
884
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
885 886 887 888 889 890 891 892 893 894
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
895 896
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
897 898
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
899 900 901 902
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
903
			/* luckily this is almost always there */
904 905 906 907
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
908
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
909 910 911 912 913 914 915 916 917 918 919
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
920
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
921 922 923
		offset = noffset;
	}

J
Johannes Berg 已提交
924 925 926 927
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

928 929
	if (sband->band != NL80211_BAND_6GHZ &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
930
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
931
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
932

933 934 935
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
936 937 938 939
			/*
			 * no need to list the ones split off before HT
			 * or generated here
			 */
940 941 942 943 944
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
945
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
946
		};
947 948

		/* RIC already taken above, so no need to handle here anymore */
949 950 951
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
952
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
953 954 955
		offset = noffset;
	}

L
Luca Coelho 已提交
956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982
	/* if present, add any custom IEs that go before HE */
	if (assoc_data->ie_len) {
		static const u8 before_he[] = {
			/*
			 * no need to list the ones split off before VHT
			 * or generated here
			 */
			WLAN_EID_OPMODE_NOTIF,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
			/* 11ai elements */
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
			/* TODO: add 11ah/11aj/11ak elements */
		};

		/* RIC already taken above, so no need to handle here anymore */
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_he, ARRAY_SIZE(before_he),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

983 984
	if (sband->band != NL80211_BAND_6GHZ &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
985 986
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
987

988 989 990 991 992 993 994 995 996
	/*
	 * If AP doesn't support HT, mark HE as disabled.
	 * If on the 5GHz band, make sure it supports VHT.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT ||
	    (sband->band == NL80211_BAND_5GHZ &&
	     ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

L
Luca Coelho 已提交
997 998 999 1000
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		ieee80211_add_he_ie(sdata, skb, sband);

	/* if present, add any custom non-vendor IEs that go after HE */
1001
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
1002 1003 1004
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
1005
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
1006 1007 1008
		offset = noffset;
	}

1009 1010
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
1011 1012
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
1013 1014 1015 1016 1017
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

1018
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
1019 1020 1021
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
1022
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
1023
		noffset = assoc_data->ie_len;
1024
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
1025 1026
	}

1027 1028 1029 1030 1031 1032
	if (assoc_data->fils_kek_len &&
	    fils_encrypt_assoc_req(skb, assoc_data) < 0) {
		dev_kfree_skb(skb);
		return;
	}

1033 1034 1035 1036 1037
	pos = skb_tail_pointer(skb);
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
	ifmgd->assoc_req_ies_len = pos - ie_start;

1038
	drv_mgd_prepare_tx(local, sdata, 0);
J
Johannes Berg 已提交
1039

J
Johannes Berg 已提交
1040
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1041
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1042 1043
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
1044 1045 1046
	ieee80211_tx_skb(sdata, skb);
}

1047 1048 1049 1050 1051 1052
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

1053 1054
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
1055 1056
		return;

1057 1058
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1059

1060 1061
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
1062 1063
}

1064 1065
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
1066
			     bool powersave)
1067 1068
{
	struct sk_buff *skb;
1069
	struct ieee80211_hdr_3addr *nullfunc;
1070
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1071

L
Luca Coelho 已提交
1072 1073 1074 1075 1076
	/* Don't send NDPs when STA is connected HE */
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		return;

1077 1078
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
		!ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
1079
	if (!skb)
1080 1081
		return;

1082
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1083
	if (powersave)
1084
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1085

1086 1087
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1088

1089
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1090 1091
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

1092
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1093 1094
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

1095
	ieee80211_tx_skb(sdata, skb);
1096 1097
}

1098 1099 1100 1101 1102 1103 1104 1105 1106 1107
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

L
Luca Coelho 已提交
1108 1109 1110 1111
	/* Don't send NDPs when connected HE */
	if (!(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
		return;

1112
	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1113
	if (!skb)
1114
		return;
1115

1116 1117
	skb_reserve(skb, local->hw.extra_tx_headroom);

1118
	nullfunc = skb_put_zero(skb, 30);
1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

1131 1132 1133 1134 1135
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
1136
	struct ieee80211_local *local = sdata->local;
1137
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1138
	int ret;
1139

1140
	if (!ieee80211_sdata_running(sdata))
1141 1142
		return;

1143
	sdata_lock(sdata);
1144 1145 1146
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

1147 1148
	if (!ifmgd->associated)
		goto out;
1149

1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
1161 1162 1163 1164
		struct ieee80211_supported_band *sband = NULL;
		struct sta_info *mgd_sta = NULL;
		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;

1165 1166 1167 1168 1169 1170 1171 1172
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214
		if (sdata->vif.bss_conf.chandef.width !=
		    sdata->csa_chandef.width) {
			/*
			 * For managed interface, we need to also update the AP
			 * station bandwidth and align the rate scale algorithm
			 * on the bandwidth change. Here we only consider the
			 * bandwidth of the new channel definition (as channel
			 * switch flow does not have the full HT/VHT/HE
			 * information), assuming that if additional changes are
			 * required they would be done as part of the processing
			 * of the next beacon from the AP.
			 */
			switch (sdata->csa_chandef.width) {
			case NL80211_CHAN_WIDTH_20_NOHT:
			case NL80211_CHAN_WIDTH_20:
			default:
				bw = IEEE80211_STA_RX_BW_20;
				break;
			case NL80211_CHAN_WIDTH_40:
				bw = IEEE80211_STA_RX_BW_40;
				break;
			case NL80211_CHAN_WIDTH_80:
				bw = IEEE80211_STA_RX_BW_80;
				break;
			case NL80211_CHAN_WIDTH_80P80:
			case NL80211_CHAN_WIDTH_160:
				bw = IEEE80211_STA_RX_BW_160;
				break;
			}

			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
			sband =
				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
		}

		if (sdata->vif.bss_conf.chandef.width >
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1215 1216 1217 1218 1219 1220 1221 1222 1223 1224
		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

1225 1226 1227 1228 1229 1230 1231
		if (sdata->vif.bss_conf.chandef.width <
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1232 1233 1234 1235 1236
		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1237
		sdata_info(sdata,
1238
			   "failed to finalize channel switch, disconnecting\n");
1239 1240 1241 1242
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1243

1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1264

1265 1266 1267 1268 1269
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1270

1271 1272 1273
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1274 1275 1276 1277 1278 1279
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1280
		return;
1281
	}
1282 1283

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1284 1285
}

1286 1287
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1288 1289
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1290 1291 1292

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1293 1294 1295 1296 1297 1298
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1299 1300 1301 1302
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1303
static void ieee80211_chswitch_timer(struct timer_list *t)
1304 1305
{
	struct ieee80211_sub_if_data *sdata =
1306
		from_timer(sdata, t, u.mgd.chswitch_timer);
1307

1308
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1309 1310
}

1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336
static void
ieee80211_sta_abort_chanswitch(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;

	if (!local->ops->abort_channel_switch)
		return;

	mutex_lock(&local->mtx);

	mutex_lock(&local->chanctx_mtx);
	ieee80211_vif_unreserve_chanctx(sdata);
	mutex_unlock(&local->chanctx_mtx);

	if (sdata->csa_block_tx)
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);

	sdata->csa_block_tx = false;
	sdata->vif.csa_active = false;

	mutex_unlock(&local->mtx);

	drv_abort_channel_switch(sdata);
}

1337
static void
J
Johannes Berg 已提交
1338
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1339 1340
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1341
				 bool beacon)
1342
{
1343
	struct ieee80211_local *local = sdata->local;
1344
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1345
	struct cfg80211_bss *cbss = ifmgd->associated;
1346
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1347
	struct ieee80211_chanctx *chanctx;
1348
	enum nl80211_band current_band;
1349
	struct ieee80211_csa_ie csa_ie;
1350
	struct ieee80211_channel_switch ch_switch;
1351
	struct ieee80211_bss *bss;
1352
	int res;
1353

1354
	sdata_assert_lock(sdata);
1355

1356
	if (!cbss)
1357 1358
		return;

1359
	if (local->scanning)
1360 1361
		return;

1362
	current_band = cbss->channel->band;
1363
	bss = (void *)cbss->priv;
1364
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1365
					   bss->vht_cap_info,
1366
					   ifmgd->flags,
1367
					   ifmgd->associated->bssid, &csa_ie);
1368 1369 1370 1371

	if (!res) {
		ch_switch.timestamp = timestamp;
		ch_switch.device_timestamp = device_timestamp;
1372
		ch_switch.block_tx = csa_ie.mode;
1373 1374 1375 1376 1377
		ch_switch.chandef = csa_ie.chandef;
		ch_switch.count = csa_ie.count;
		ch_switch.delay = csa_ie.max_switch_time;
	}

1378
	if (res < 0) {
1379
		ieee80211_queue_work(&local->hw,
1380
				     &ifmgd->csa_connection_drop_work);
1381
		return;
1382 1383
	}

1384 1385 1386 1387 1388
	if (beacon && sdata->vif.csa_active && !ifmgd->csa_waiting_bcn) {
		if (res)
			ieee80211_sta_abort_chanswitch(sdata);
		else
			drv_channel_switch_rx_beacon(sdata, &ch_switch);
1389 1390 1391 1392 1393
		return;
	} else if (sdata->vif.csa_active || res) {
		/* disregard subsequent announcements if already processing */
		return;
	}
1394

1395
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1396 1397
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
1398 1399 1400
			   "AP %pM switches to unsupported channel "
			   "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
			   "disconnecting\n",
1401
			   ifmgd->associated->bssid,
1402
			   csa_ie.chandef.chan->center_freq,
1403
			   csa_ie.chandef.chan->freq_offset,
1404
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1405
			   csa_ie.chandef.freq1_offset,
1406
			   csa_ie.chandef.center_freq2);
1407 1408 1409 1410 1411
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1412
	if (cfg80211_chandef_identical(&csa_ie.chandef,
1413 1414
				       &sdata->vif.bss_conf.chandef) &&
	    (!csa_ie.mode || !beacon)) {
1415 1416 1417 1418 1419 1420 1421 1422 1423
		if (ifmgd->csa_ignored_same_chan)
			return;
		sdata_info(sdata,
			   "AP %pM tries to chanswitch to same channel, ignore\n",
			   ifmgd->associated->bssid);
		ifmgd->csa_ignored_same_chan = true;
		return;
	}

1424 1425 1426 1427 1428 1429 1430 1431
	/*
	 * Drop all TDLS peers - either we disconnect or move to a different
	 * channel from this point on. There's no telling what our peer will do.
	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
	 * have an incompatible wider chandef.
	 */
	ieee80211_teardown_tdls_peers(sdata);

1432
	mutex_lock(&local->mtx);
1433
	mutex_lock(&local->chanctx_mtx);
1434 1435 1436 1437 1438
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
1439
		goto drop_connection;
1440 1441 1442 1443
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1444
	if (local->use_chanctx &&
1445
	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1446 1447
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
1448
		goto drop_connection;
J
Johannes Berg 已提交
1449 1450
	}

1451 1452 1453
	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
1454
		goto drop_connection;
1455 1456
	}

1457 1458 1459
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1460
		sdata_info(sdata,
1461 1462
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1463
		goto drop_connection;
J
Johannes Berg 已提交
1464
	}
1465
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1466

1467
	sdata->vif.csa_active = true;
1468
	sdata->csa_chandef = csa_ie.chandef;
1469
	sdata->csa_block_tx = csa_ie.mode;
1470
	ifmgd->csa_ignored_same_chan = false;
J
Johannes Berg 已提交
1471

1472
	if (sdata->csa_block_tx)
1473 1474
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1475
	mutex_unlock(&local->mtx);
1476

1477 1478 1479
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1480
	if (local->ops->channel_switch) {
1481
		/* use driver's channel switch callback */
1482
		drv_channel_switch(local, sdata, &ch_switch);
1483 1484 1485 1486
		return;
	}

	/* channel switch handled in software */
1487
	if (csa_ie.count <= 1)
1488
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1489
	else
1490
		mod_timer(&ifmgd->chswitch_timer,
1491 1492
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1493 1494
	return;
 drop_connection:
1495 1496 1497 1498 1499 1500 1501 1502
	/*
	 * This is just so that the disconnect flow will know that
	 * we were trying to switch channel and failed. In case the
	 * mode is 1 (we are not allowed to Tx), we will know not to
	 * send a deauthentication frame. Those two fields will be
	 * reset when the disconnection worker runs.
	 */
	sdata->vif.csa_active = true;
1503
	sdata->csa_block_tx = csa_ie.mode;
1504

1505 1506 1507
	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
1508 1509
}

1510 1511 1512 1513 1514 1515
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1516
{
1517 1518
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1519
	int i, chan_increment;
1520
	bool have_chan_pwr = false;
1521

1522 1523
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1524
		return false;
1525

1526 1527 1528 1529 1530 1531 1532
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
1533 1534
	case NL80211_BAND_2GHZ:
	case NL80211_BAND_60GHZ:
1535 1536
		chan_increment = 1;
		break;
1537
	case NL80211_BAND_5GHZ:
1538
	case NL80211_BAND_6GHZ:
1539 1540
		chan_increment = 4;
		break;
1541
	}
1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1553
				*chan_pwr = triplet->chans.max_power;
1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1565
	if (have_chan_pwr && pwr_constr_elem)
1566
		*pwr_reduction = *pwr_constr_elem;
1567 1568 1569
	else
		*pwr_reduction = 0;

1570 1571 1572
	return have_chan_pwr;
}

1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1587 1588 1589 1590
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1591 1592
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1593
{
1594 1595 1596
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1597
	int new_ap_level;
1598
	__le16 capab = mgmt->u.probe_resp.capab_info;
1599

1600 1601 1602
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1603 1604 1605
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1606 1607 1608 1609 1610 1611 1612 1613
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1614
	}
1615

1616
	if (!has_80211h_pwr && !has_cisco_pwr)
1617
		return 0;
1618

1619 1620 1621 1622 1623
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1624 1625 1626 1627 1628
		new_ap_level = pwr_level_80211h;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1629 1630 1631 1632
		sdata_dbg(sdata,
			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			  sdata->u.mgd.bssid);
1633
	} else {  /* has_cisco_pwr is always true here. */
1634 1635 1636 1637 1638
		new_ap_level = pwr_level_cisco;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1639 1640 1641
		sdata_dbg(sdata,
			  "Limiting TX power to %d dBm as advertised by %pM\n",
			  pwr_level_cisco, sdata->u.mgd.bssid);
1642
	}
1643

1644 1645 1646 1647
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1648 1649
}

1650 1651 1652 1653 1654 1655
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1656 1657 1658 1659
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1660
	if (local->scanning)
J
Johannes Berg 已提交
1661 1662
		return;

1663
	if (conf->dynamic_ps_timeout > 0 &&
1664
	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1665 1666 1667
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
1668
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1669
			ieee80211_send_nullfunc(local, sdata, true);
1670

1671 1672
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1673 1674 1675 1676
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1694 1695 1696 1697
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1698
	bool authorized = false;
1699 1700 1701 1702

	if (!mgd->powersave)
		return false;

1703 1704 1705
	if (mgd->broken_ap)
		return false;

1706 1707 1708
	if (!mgd->associated)
		return false;

1709
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1710 1711
		return false;

1712
	if (!mgd->have_beacon)
1713 1714
		return false;

1715 1716 1717
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1718
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1719 1720
	rcu_read_unlock();

J
Johannes Berg 已提交
1721
	return authorized;
1722 1723
}

1724
/* need to hold RTNL or interface lock */
J
Johannes Berg 已提交
1725
void ieee80211_recalc_ps(struct ieee80211_local *local)
1726 1727 1728
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1729
	int timeout;
1730

1731
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1732 1733 1734 1735 1736
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1737
		if (!ieee80211_sdata_running(sdata))
1738
			continue;
1739 1740 1741 1742 1743 1744 1745 1746
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1747 1748 1749 1750 1751 1752
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1753
	if (count == 1 && ieee80211_powersave_allowed(found)) {
J
Johannes Berg 已提交
1754
		u8 dtimper = found->u.mgd.dtim_period;
1755

1756
		timeout = local->dynamic_ps_forced_timeout;
J
Johannes Berg 已提交
1757 1758
		if (timeout < 0)
			timeout = 100;
1759
		local->hw.conf.dynamic_ps_timeout = timeout;
1760

J
Johannes Berg 已提交
1761 1762 1763 1764 1765 1766
		/* If the TIM IE is invalid, pretend the value is 1 */
		if (!dtimper)
			dtimper = 1;

		local->hw.conf.ps_dtim_period = dtimper;
		local->ps_sdata = found;
1767
	} else {
1768
		local->ps_sdata = NULL;
1769
	}
1770 1771 1772 1773

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1774 1775 1776 1777 1778 1779 1780 1781 1782 1783
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1796
					IEEE80211_MAX_QUEUE_MAP,
1797 1798
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1799 1800 1801 1802 1803 1804 1805 1806
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1807
	struct ieee80211_if_managed *ifmgd;
1808 1809
	unsigned long flags;
	int q;
1810 1811 1812 1813 1814

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1815 1816
	ifmgd = &sdata->u.mgd;

1817 1818 1819
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1820
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1821 1822
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1823 1824 1825 1826 1827
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1846 1847
	}

1848
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1849
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1850
		if (drv_tx_frames_pending(local)) {
1851 1852 1853
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1854
		} else {
1855
			ieee80211_send_nullfunc(local, sdata, true);
1856
			/* Flush to get the tx status of nullfunc frame */
1857
			ieee80211_flush_queues(local, sdata, false);
1858
		}
1859 1860
	}

1861 1862
	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1863 1864 1865 1866 1867
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1868 1869
}

1870
void ieee80211_dynamic_ps_timer(struct timer_list *t)
1871
{
1872
	struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
1873

1874
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1875 1876
}

1877 1878
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
1879
	struct delayed_work *delayed_work = to_delayed_work(work);
1880 1881 1882
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1883
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1884

1885 1886 1887 1888 1889 1890 1891 1892
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1893 1894
}

1895 1896 1897 1898 1899
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1900
	bool ret = false;
1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
1945 1946 1947 1948 1949 1950
			/* Usually the loop will result in using BK even if it
			 * requires admission control, but such a configuration
			 * makes no sense and we have to transmit somehow - the
			 * AC selection does the same thing.
			 * If we started out trying to downgrade from BK, then
			 * the extra condition here might be needed.
1951
			 */
1952 1953
			if (non_acm_ac >= IEEE80211_NUM_ACS)
				non_acm_ac = IEEE80211_AC_BK;
1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1988
/* MLME */
L
Luca Coelho 已提交
1989 1990 1991 1992 1993
static bool
ieee80211_sta_wmm_params(struct ieee80211_local *local,
			 struct ieee80211_sub_if_data *sdata,
			 const u8 *wmm_param, size_t wmm_param_len,
			 const struct ieee80211_mu_edca_param_set *mu_edca)
1994
{
1995
	struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1996
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1997
	size_t left;
1998
	int count, mu_edca_count, ac;
J
Johannes Berg 已提交
1999 2000
	const u8 *pos;
	u8 uapsd_queues = 0;
2001

2002
	if (!local->ops->conf_tx)
2003
		return false;
2004

J
Johannes Berg 已提交
2005
	if (local->hw.queues < IEEE80211_NUM_ACS)
2006
		return false;
2007 2008

	if (!wmm_param)
2009
		return false;
2010

2011
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
2012
		return false;
K
Kalle Valo 已提交
2013 2014

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
2015
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
2016

2017
	count = wmm_param[6] & 0x0f;
2018 2019 2020 2021 2022 2023 2024
	/* -1 is the initial value of ifmgd->mu_edca_last_param_set.
	 * if mu_edca was preset before and now it disappeared tell
	 * the driver about it.
	 */
	mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
	if (count == ifmgd->wmm_last_param_set &&
	    mu_edca_count == ifmgd->mu_edca_last_param_set)
2025
		return false;
2026
	ifmgd->wmm_last_param_set = count;
2027
	ifmgd->mu_edca_last_param_set = mu_edca_count;
2028 2029 2030 2031 2032 2033

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
2034
	sdata->wmm_acm = 0;
2035 2036 2037
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
2038
		bool uapsd = false;
2039 2040

		switch (aci) {
2041
		case 1: /* AC_BK */
2042
			ac = IEEE80211_AC_BK;
J
Johannes Berg 已提交
2043
			if (acm)
Y
Yoni Divinsky 已提交
2044
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
2045 2046
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
L
Luca Coelho 已提交
2047 2048 2049
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2050
			break;
2051
		case 2: /* AC_VI */
2052
			ac = IEEE80211_AC_VI;
J
Johannes Berg 已提交
2053
			if (acm)
Y
Yoni Divinsky 已提交
2054
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
2055 2056
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
L
Luca Coelho 已提交
2057 2058 2059
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2060
			break;
2061
		case 3: /* AC_VO */
2062
			ac = IEEE80211_AC_VO;
J
Johannes Berg 已提交
2063
			if (acm)
Y
Yoni Divinsky 已提交
2064
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
2065 2066
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
L
Luca Coelho 已提交
2067 2068 2069
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2070
			break;
2071
		case 0: /* AC_BE */
2072
		default:
2073
			ac = IEEE80211_AC_BE;
J
Johannes Berg 已提交
2074
			if (acm)
Y
Yoni Divinsky 已提交
2075
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
2076 2077
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
L
Luca Coelho 已提交
2078 2079 2080
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_be;
2081 2082 2083
			break;
		}

2084
		params[ac].aifs = pos[0] & 0x0f;
2085

2086
		if (params[ac].aifs < 2) {
2087 2088
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2089 2090
				   params[ac].aifs, aci);
			params[ac].aifs = 2;
2091
		}
2092 2093 2094 2095 2096
		params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
		params[ac].txop = get_unaligned_le16(pos + 2);
		params[ac].acm = acm;
		params[ac].uapsd = uapsd;
K
Kalle Valo 已提交
2097

2098
		if (params[ac].cw_min == 0 ||
2099
		    params[ac].cw_min > params[ac].cw_max) {
2100 2101 2102 2103 2104
			sdata_info(sdata,
				   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
				   params[ac].cw_min, params[ac].cw_max, aci);
			return false;
		}
2105
		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2106 2107
	}

2108 2109 2110 2111 2112 2113 2114 2115 2116 2117
	/* WMM specification requires all 4 ACIs. */
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		if (params[ac].cw_min == 0) {
			sdata_info(sdata,
				   "AP has invalid WMM params (missing AC %d), using defaults\n",
				   ac);
			return false;
		}
	}

2118
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
J
Johannes Berg 已提交
2119
		mlme_dbg(sdata,
2120 2121 2122 2123 2124 2125 2126 2127
			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
			 ac, params[ac].acm,
			 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
			 params[ac].txop, params[ac].uapsd,
			 ifmgd->tx_tspec[ac].downgraded);
		sdata->tx_conf[ac] = params[ac];
		if (!ifmgd->tx_tspec[ac].downgraded &&
		    drv_conf_tx(local, sdata, ac, &params[ac]))
J
Johannes Berg 已提交
2128
			sdata_err(sdata,
2129 2130
				  "failed to set TX queue parameters for AC %d\n",
				  ac);
2131
	}
2132 2133

	/* enable WMM or activate new settings */
2134
	sdata->vif.bss_conf.qos = true;
2135
	return true;
2136 2137
}

2138 2139 2140 2141
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

2142
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2143 2144 2145 2146 2147 2148 2149 2150 2151 2152
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
2153 2154
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
2155
{
J
Johannes Berg 已提交
2156
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2157
	struct ieee80211_supported_band *sband;
2158
	u32 changed = 0;
J
Johannes Berg 已提交
2159 2160 2161 2162
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

2163 2164 2165 2166
	sband = ieee80211_get_sband(sdata);
	if (!sband)
		return changed;

J
Johannes Berg 已提交
2167 2168 2169 2170 2171 2172 2173 2174 2175
	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2176 2177
	if (sband->band == NL80211_BAND_5GHZ ||
	    sband->band == NL80211_BAND_6GHZ)
2178
		use_short_slot = true;
2179

2180 2181 2182
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
2183
	}
2184

2185 2186
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
2187
		changed |= BSS_CHANGED_ERP_PREAMBLE;
2188
	}
2189

J
Johannes Berg 已提交
2190 2191 2192
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
2193 2194 2195 2196 2197
	}

	return changed;
}

2198
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2199
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2200
				     u32 bss_info_changed)
2201
{
2202
	struct ieee80211_bss *bss = (void *)cbss->priv;
2203
	struct ieee80211_local *local = sdata->local;
2204
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2205

J
Johannes Berg 已提交
2206
	bss_info_changed |= BSS_CHANGED_ASSOC;
2207
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
2208
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
2209

2210
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
2211
		beacon_loss_count * bss_conf->beacon_int));
2212

2213 2214
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2215

2216 2217
	ieee80211_check_rate_mask(sdata);

2218 2219
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

2220 2221
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2222
		const struct cfg80211_bss_ies *ies;
2223

2224 2225 2226 2227 2228 2229 2230 2231
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
2232 2233
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
2234
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
2235 2236
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
2237 2238
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
2239
		}
2240
		rcu_read_unlock();
2241 2242
	}

J
Johannes Berg 已提交
2243
	/* just to be sure */
2244
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
2245

2246
	ieee80211_led_assoc(local, 1);
2247

2248
	if (sdata->u.mgd.have_beacon) {
2249 2250 2251 2252 2253 2254 2255
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
2256
		bss_conf->beacon_rate = bss->beacon_rate;
2257
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
2258
	} else {
2259
		bss_conf->beacon_rate = NULL;
2260
		bss_conf->dtim_period = 0;
2261
	}
2262

2263
	bss_conf->assoc = 1;
2264

2265
	/* Tell the driver to monitor connection quality (if supported) */
2266
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2267
	    bss_conf->cqm_rssi_thold)
2268 2269
		bss_info_changed |= BSS_CHANGED_CQM;

2270
	/* Enable ARP filtering */
2271
	if (bss_conf->arp_addr_cnt)
2272 2273
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
2274
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
2275

J
Johannes Berg 已提交
2276
	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2277
	ieee80211_recalc_ps(local);
J
Johannes Berg 已提交
2278
	mutex_unlock(&local->iflist_mtx);
2279

2280
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
2281 2282
	ieee80211_recalc_ps_vif(sdata);

2283
	netif_carrier_on(sdata->dev);
2284 2285
}

2286
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2287 2288
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
2289
{
2290
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2291
	struct ieee80211_local *local = sdata->local;
2292
	u32 changed = 0;
2293

2294
	sdata_assert_lock(sdata);
2295

2296 2297 2298
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
2299 2300 2301
	if (WARN_ON(!ifmgd->associated))
		return;

2302 2303
	ieee80211_stop_poll(sdata);

2304
	ifmgd->associated = NULL;
2305 2306
	netif_carrier_off(sdata->dev);

2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2318 2319 2320
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2321 2322 2323
	/* make sure ongoing transmission finishes */
	synchronize_net();

2324 2325 2326 2327 2328 2329
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2330
	if (tx)
2331
		ieee80211_flush_queues(local, sdata, true);
2332

2333
	/* deauthenticate/disassociate now */
2334 2335 2336 2337 2338 2339 2340 2341 2342
	if (tx || frame_buf) {
		/*
		 * In multi channel scenarios guarantee that the virtual
		 * interface is granted immediate airtime to transmit the
		 * deauthentication frame by calling mgd_prepare_tx, if the
		 * driver requested so.
		 */
		if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
		    !ifmgd->have_beacon)
2343
			drv_mgd_prepare_tx(sdata->local, sdata, 0);
2344

2345 2346 2347
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid,
					       ifmgd->bssid, stype, reason,
					       tx, frame_buf);
2348
	}
2349

2350
	/* flush out frame - make sure the deauth was actually sent */
2351
	if (tx)
2352
		ieee80211_flush_queues(local, sdata, false);
2353

2354
	/* clear bssid only after building the needed mgmt frames */
2355
	eth_zero_addr(ifmgd->bssid);
2356

2357
	/* remove AP and TDLS peers */
2358
	sta_info_flush(sdata);
2359 2360

	/* finally reset all BSS / config parameters */
2361 2362 2363
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2364 2365
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2366

J
Janusz Dziedzic 已提交
2367 2368 2369
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2370

2371
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2372 2373
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2374 2375
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2376 2377 2378 2379 2380 2381 2382

	/* reset MU-MIMO ownership and group data */
	memset(sdata->vif.bss_conf.mu_group.membership, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.membership));
	memset(sdata->vif.bss_conf.mu_group.position, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.position));
	changed |= BSS_CHANGED_MU_GROUPS;
2383
	sdata->vif.mu_mimo_owner = false;
2384

2385
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2386

2387 2388 2389
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2390
	/* Disable ARP filtering */
2391
	if (sdata->vif.bss_conf.arp_addr_cnt)
2392 2393
		changed |= BSS_CHANGED_ARP_FILTER;

2394 2395 2396
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2397 2398
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2399
	ieee80211_bss_info_change_notify(sdata, changed);
2400

2401
	/* disassociated - set to defaults now */
2402
	ieee80211_set_wmm_default(sdata, false, false);
2403

2404 2405 2406 2407
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2408

2409
	sdata->vif.bss_conf.dtim_period = 0;
2410 2411
	sdata->vif.bss_conf.beacon_rate = NULL;

2412
	ifmgd->have_beacon = false;
2413

2414
	ifmgd->flags = 0;
2415
	mutex_lock(&local->mtx);
2416
	ieee80211_vif_release_channel(sdata);
2417 2418

	sdata->vif.csa_active = false;
2419
	ifmgd->csa_waiting_bcn = false;
2420
	ifmgd->csa_ignored_same_chan = false;
2421 2422 2423 2424 2425
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2426
	mutex_unlock(&local->mtx);
2427

2428 2429 2430 2431
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2432
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2433
}
2434

2435 2436 2437 2438 2439 2440 2441 2442
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2443 2444
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2445
	 */
J
Johannes Berg 已提交
2446 2447 2448
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2449
	ieee80211_sta_reset_conn_monitor(sdata);
2450
}
2451

2452 2453 2454
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2455
	struct ieee80211_local *local = sdata->local;
2456

2457
	mutex_lock(&local->mtx);
2458 2459
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2460

2461
	__ieee80211_stop_poll(sdata);
2462 2463

	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2464
	ieee80211_recalc_ps(local);
2465
	mutex_unlock(&local->iflist_mtx);
2466

2467
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2468
		goto out;
2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2480 2481
out:
	mutex_unlock(&local->mtx);
2482 2483
}

2484 2485 2486 2487 2488
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
S
Sara Sharon 已提交
2489
	u16 tid = ieee80211_get_tid(hdr);
2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2519
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2520
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2521
{
2522 2523
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2524
	if (!ieee80211_is_data(hdr->frame_control))
2525 2526
	    return;

2527
	if (ieee80211_is_any_nullfunc(hdr->frame_control) &&
2528
	    sdata->u.mgd.probe_send_count > 0) {
2529
		if (ack)
2530
			ieee80211_sta_reset_conn_monitor(sdata);
2531 2532
		else
			sdata->u.mgd.nullfunc_failed = true;
2533
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2534
		return;
2535
	}
2536 2537 2538

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2539 2540
}

2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553 2554
static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
					  const u8 *src, const u8 *dst,
					  const u8 *ssid, size_t ssid_len,
					  struct ieee80211_channel *channel)
{
	struct sk_buff *skb;

	skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
					ssid, ssid_len, NULL, 0,
					IEEE80211_PROBE_FLAG_DIRECTED);
	if (skb)
		ieee80211_tx_skb(sdata, skb);
}

2555 2556 2557 2558
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2559
	u8 *dst = ifmgd->associated->bssid;
2560
	u8 unicast_limit = max(1, max_probe_tries - 3);
J
Johannes Berg 已提交
2561
	struct sta_info *sta;
2562 2563 2564 2565 2566 2567 2568 2569

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2570

2571 2572 2573 2574 2575 2576 2577
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2578 2579
	ifmgd->probe_send_count++;

J
Johannes Berg 已提交
2580 2581 2582 2583 2584 2585 2586 2587
	if (dst) {
		mutex_lock(&sdata->local->sta_mtx);
		sta = sta_info_get(sdata, dst);
		if (!WARN_ON(!sta))
			ieee80211_check_fast_rx(sta);
		mutex_unlock(&sdata->local->sta_mtx);
	}

2588
	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2589
		ifmgd->nullfunc_failed = false;
2590 2591 2592 2593
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
			ifmgd->probe_send_count--;
		else
			ieee80211_send_nullfunc(sdata->local, sdata, false);
2594
	} else {
2595 2596
		int ssid_len;

2597
		rcu_read_lock();
2598
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2599 2600 2601 2602 2603
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2604 2605 2606
		ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
					      ssid + 2, ssid_len,
					      ifmgd->associated->channel);
2607
		rcu_read_unlock();
2608
	}
2609

2610
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2611
	run_again(sdata, ifmgd->probe_timeout);
2612 2613
}

J
Johannes Berg 已提交
2614 2615
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2616 2617
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2618
	bool already = false;
2619

2620
	if (!ieee80211_sdata_running(sdata))
2621 2622
		return;

2623
	sdata_lock(sdata);
2624 2625 2626 2627

	if (!ifmgd->associated)
		goto out;

2628 2629 2630 2631 2632 2633 2634
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2635
	if (beacon) {
J
Johannes Berg 已提交
2636
		mlme_dbg_ratelimited(sdata,
2637 2638
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2639

2640
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2641
	}
2642

J
Johannes Berg 已提交
2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2654
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2655 2656
		already = true;

E
Eliad Peller 已提交
2657 2658
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2659 2660
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2661 2662 2663
	if (already)
		goto out;

2664
	mutex_lock(&sdata->local->iflist_mtx);
J
Johannes Berg 已提交
2665
	ieee80211_recalc_ps(sdata->local);
2666 2667
	mutex_unlock(&sdata->local->iflist_mtx);

2668 2669
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2670
 out:
2671
	sdata_unlock(sdata);
2672 2673
}

2674 2675 2676 2677 2678
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2679
	struct cfg80211_bss *cbss;
2680 2681
	struct sk_buff *skb;
	const u8 *ssid;
2682
	int ssid_len;
2683 2684 2685 2686

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2687
	sdata_assert_lock(sdata);
2688

2689 2690 2691 2692 2693 2694 2695
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2696 2697
		return NULL;

2698
	rcu_read_lock();
2699
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2700 2701
	if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
		      "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
2702 2703 2704 2705
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2706
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2707
					(u32) -1, cbss->channel,
2708
					ssid + 2, ssid_len,
2709
					NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
2710
	rcu_read_unlock();
2711 2712 2713 2714 2715

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733
static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
					const u8 *buf, size_t len, bool tx,
					u16 reason)
{
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
		.u.mlme.reason = reason,
	};

	if (tx)
		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
	else
		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);

	drv_event_callback(sdata->local, sdata, &event);
}

2734
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2735
{
2736
	struct ieee80211_local *local = sdata->local;
2737
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2738
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2739
	bool tx;
2740

2741
	sdata_lock(sdata);
2742
	if (!ifmgd->associated) {
2743
		sdata_unlock(sdata);
2744 2745 2746
		return;
	}

2747 2748
	tx = !sdata->csa_block_tx;

2749 2750 2751 2752 2753
	/* AP is probably out of range (or not reachable for another reason) so
	 * remove the bss struct for that AP.
	 */
	cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);

2754 2755
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2756
			       tx, frame_buf);
2757
	mutex_lock(&local->mtx);
2758
	sdata->vif.csa_active = false;
2759
	ifmgd->csa_waiting_bcn = false;
2760 2761 2762 2763 2764
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2765
	mutex_unlock(&local->mtx);
2766

2767
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
2768 2769
				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);

2770
	sdata_unlock(sdata);
2771 2772
}

2773
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2774 2775 2776
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2777
			     u.mgd.beacon_connection_loss_work);
2778 2779
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

2780 2781
	if (ifmgd->associated)
		ifmgd->beacon_loss_count++;
J
Johannes Berg 已提交
2782

2783
	if (ifmgd->connection_loss) {
2784 2785
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2786
		__ieee80211_disconnect(sdata);
2787
	} else {
2788
		ieee80211_mgd_probe_ap(sdata, true);
2789 2790 2791 2792 2793 2794 2795 2796 2797
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2798
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2799 2800
}

2801 2802 2803
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2804
	struct ieee80211_hw *hw = &sdata->local->hw;
2805

J
Johannes Berg 已提交
2806 2807
	trace_api_beacon_loss(sdata);

2808
	sdata->u.mgd.connection_loss = false;
2809
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2810 2811 2812
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2813 2814 2815 2816 2817
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2818 2819
	trace_api_connection_loss(sdata);

2820
	sdata->u.mgd.connection_loss = true;
2821 2822 2823 2824 2825
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2826 2827 2828 2829 2830
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2831
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2832 2833

	if (!assoc) {
2834 2835 2836 2837 2838 2839
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2840 2841
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

2842
		eth_zero_addr(sdata->u.mgd.bssid);
J
Johannes Berg 已提交
2843
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2844
		sdata->u.mgd.flags = 0;
2845
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2846
		ieee80211_vif_release_channel(sdata);
2847
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2848 2849
	}

2850
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2851 2852 2853 2854
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

2855
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2856
					 bool assoc, bool abandon)
2857 2858 2859 2860 2861 2862 2863 2864 2865 2866 2867 2868 2869 2870 2871 2872 2873
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

	sdata_assert_lock(sdata);

	if (!assoc) {
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		eth_zero_addr(sdata->u.mgd.bssid);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
		sdata->u.mgd.flags = 0;
2874 2875
		sdata->vif.mu_mimo_owner = false;

2876 2877 2878
		mutex_lock(&sdata->local->mtx);
		ieee80211_vif_release_channel(sdata);
		mutex_unlock(&sdata->local->mtx);
2879 2880 2881

		if (abandon)
			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
2882 2883 2884 2885 2886 2887
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

J
Johannes Berg 已提交
2888 2889 2890
static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2891
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2892 2893 2894
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2895
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2896 2897

	pos = mgmt->u.auth.variable;
2898 2899
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, auth_data->bss->bssid);
J
Johannes Berg 已提交
2900 2901 2902
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
2903
	drv_mgd_prepare_tx(sdata->local, sdata, 0);
2904
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2905 2906
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2907
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2908 2909 2910
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2911
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2912 2913
}

2914 2915 2916
static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
				    const u8 *bssid)
{
2917
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2918
	struct sta_info *sta;
2919
	bool result = true;
2920

2921 2922 2923 2924 2925 2926
	sdata_info(sdata, "authenticated\n");
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
	ifmgd->auth_data->timeout_started = true;
	run_again(sdata, ifmgd->auth_data->timeout);

2927 2928 2929 2930 2931
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2932 2933
		result = false;
		goto out;
2934 2935 2936
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2937 2938
		result = false;
		goto out;
2939 2940
	}

2941 2942 2943
out:
	mutex_unlock(&sdata->local->sta_mtx);
	return result;
2944 2945
}

2946 2947
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2948 2949 2950 2951
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
2952 2953 2954 2955
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = AUTH_EVENT,
	};
J
Johannes Berg 已提交
2956

2957
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2958 2959

	if (len < 24 + 6)
2960
		return;
J
Johannes Berg 已提交
2961 2962

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2963
		return;
J
Johannes Berg 已提交
2964 2965 2966

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2967
	if (!ether_addr_equal(bssid, mgmt->bssid))
2968
		return;
J
Johannes Berg 已提交
2969 2970 2971 2972 2973 2974

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2975 2976 2977 2978 2979
	    (auth_alg != WLAN_AUTH_SAE &&
	     auth_transaction != ifmgd->auth_data->expected_transaction) ||
	    (auth_alg == WLAN_AUTH_SAE &&
	     (auth_transaction < ifmgd->auth_data->expected_transaction ||
	      auth_transaction > 2))) {
2980 2981 2982 2983
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2984
		return;
2985
	}
J
Johannes Berg 已提交
2986 2987

	if (status_code != WLAN_STATUS_SUCCESS) {
2988 2989 2990 2991 2992 2993
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);

		if (auth_alg == WLAN_AUTH_SAE &&
		    status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED)
			return;

J
Johannes Berg 已提交
2994 2995
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2996
		ieee80211_destroy_auth_data(sdata, false);
2997 2998 2999
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
3000
		return;
J
Johannes Berg 已提交
3001 3002 3003 3004 3005 3006
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
3007
	case WLAN_AUTH_SAE:
3008 3009 3010
	case WLAN_AUTH_FILS_SK:
	case WLAN_AUTH_FILS_SK_PFS:
	case WLAN_AUTH_FILS_PK:
J
Johannes Berg 已提交
3011 3012 3013 3014 3015
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
3016
			return;
J
Johannes Berg 已提交
3017 3018 3019 3020 3021
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
3022
		return;
J
Johannes Berg 已提交
3023 3024
	}

3025 3026
	event.u.mlme.status = MLME_SUCCESS;
	drv_event_callback(sdata->local, sdata, &event);
3027 3028 3029 3030
	if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
	    (auth_transaction == 2 &&
	     ifmgd->auth_data->expected_transaction == 2)) {
		if (!ieee80211_mark_sta_auth(sdata, bssid))
3031
			return; /* ignore frame -- wait for timeout */
3032 3033 3034 3035
	} else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
		   auth_transaction == 2) {
		sdata_info(sdata, "SAE peer confirmed\n");
		ifmgd->auth_data->peer_confirmed = true;
3036 3037
	}

3038
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
J
Johannes Berg 已提交
3039 3040
}

3041 3042 3043
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

3044
const char *ieee80211_get_reason_code_string(u16 reason_code)
3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070 3071 3072 3073 3074 3075 3076 3077 3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
3097

3098 3099
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
3100
{
3101
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3102
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3103

3104
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3105

3106
	if (len < 24 + 2)
3107
		return;
3108

3109 3110 3111 3112 3113
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3114 3115 3116
	if (ifmgd->associated &&
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
		const u8 *bssid = ifmgd->associated->bssid;
3117

3118 3119 3120
		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));
3121

3122
		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3123

3124 3125 3126 3127
		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
					    reason_code);
		return;
	}
3128

3129 3130 3131
	if (ifmgd->assoc_data &&
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
		const u8 *bssid = ifmgd->assoc_data->bss->bssid;
3132

3133 3134 3135 3136 3137
		sdata_info(sdata,
			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));

3138
		ieee80211_destroy_assoc_data(sdata, false, true);
3139 3140 3141 3142

		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
		return;
	}
3143 3144 3145
}


3146 3147
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
3148
{
3149
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3150 3151
	u16 reason_code;

3152
	sdata_assert_lock(sdata);
3153

J
Johannes Berg 已提交
3154
	if (len < 24 + 2)
3155
		return;
3156

J
Johannes Berg 已提交
3157
	if (!ifmgd->associated ||
3158
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3159
		return;
3160 3161 3162

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

3163 3164 3165 3166 3167
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3168 3169 3170
	sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
		   mgmt->sa, reason_code,
		   ieee80211_get_reason_code_string(reason_code));
3171

3172 3173
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

3174
	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
3175 3176
}

3177 3178 3179 3180
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
3181
				int *min_rate, int *min_rate_index,
3182
				int shift)
3183 3184 3185 3186
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
3187
		int rate = supp_rates[i] & 0x7f;
3188 3189
		bool is_basic = !!(supp_rates[i] & 0x80);

3190
		if ((rate * 5 * (1 << shift)) > 110)
3191 3192 3193
			*have_higher_than_11mbit = true;

		/*
3194 3195
		 * Skip HT, VHT and HE BSS membership selectors since they're
		 * not rates.
3196
		 *
3197
		 * Note: Even though the membership selector and the basic
3198 3199 3200
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
3201
		if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3202 3203
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY))
3204 3205 3206
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
3207 3208 3209 3210 3211 3212 3213
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
3214 3215 3216
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
3217 3218
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
3219 3220 3221 3222 3223 3224 3225
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
3226

3227 3228 3229 3230 3231 3232 3233 3234 3235 3236 3237 3238 3239
static bool ieee80211_twt_req_supported(const struct sta_info *sta,
					const struct ieee802_11_elems *elems)
{
	if (elems->ext_capab_len < 10)
		return false;

	if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
		return false;

	return sta->sta.he_cap.he_cap_elem.mac_cap_info[0] &
		IEEE80211_HE_MAC_CAP0_TWT_RES;
}

3240 3241 3242 3243 3244 3245 3246 3247 3248 3249 3250 3251 3252
static int ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee802_11_elems *elems)
{
	bool twt = ieee80211_twt_req_supported(sta, elems);

	if (sdata->vif.bss_conf.twt_requester != twt) {
		sdata->vif.bss_conf.twt_requester = twt;
		return BSS_CHANGED_TWT;
	}
	return 0;
}

J
Johannes Berg 已提交
3253 3254
static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
3255 3256
				    struct ieee80211_mgmt *mgmt, size_t len,
				    struct ieee802_11_elems *elems)
3257
{
3258
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3259
	struct ieee80211_local *local = sdata->local;
3260
	struct ieee80211_supported_band *sband;
3261
	struct sta_info *sta;
J
Johannes Berg 已提交
3262
	u16 capab_info, aid;
J
Johannes Berg 已提交
3263
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3264 3265
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
3266
	bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
J
Johannes Berg 已提交
3267
	u32 changed = 0;
3268
	int err;
3269
	bool ret;
3270

J
Johannes Berg 已提交
3271
	/* AssocResp and ReassocResp have identical structure */
3272 3273

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
3274
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3275

3276 3277 3278 3279 3280
	/*
	 * The 5 MSB of the AID field are reserved
	 * (802.11-2016 9.4.1.8 AID field)
	 */
	aid &= 0x7ff;
3281

3282 3283 3284
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
3285 3286
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
3287 3288 3289 3290
		aid = 0;
		ifmgd->broken_ap = true;
	}

3291
	if (!elems->supp_rates) {
J
Johannes Berg 已提交
3292
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
3293
		return false;
3294 3295
	}

3296
	sdata->vif.bss_conf.aid = aid;
3297
	ifmgd->tdls_chan_switch_prohibited =
3298 3299
		elems->ext_capab && elems->ext_capab_len >= 5 &&
		(elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
3300

3301 3302 3303 3304 3305 3306 3307
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
3308 3309 3310 3311 3312 3313
	if (!is_6ghz &&
	    ((assoc_data->wmm && !elems->wmm_param) ||
	     (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	      (!elems->ht_cap_elem || !elems->ht_operation)) ||
	     (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	      (!elems->vht_cap_elem || !elems->vht_operation)))) {
3314 3315 3316 3317 3318 3319 3320 3321 3322 3323 3324 3325 3326
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
3327 3328 3329
				       false, &bss_elems,
				       mgmt->bssid,
				       assoc_data->bss->bssid);
3330
		if (assoc_data->wmm &&
3331 3332
		    !elems->wmm_param && bss_elems.wmm_param) {
			elems->wmm_param = bss_elems.wmm_param;
3333 3334 3335 3336 3337 3338 3339 3340
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
3341
		if (!elems->ht_cap_elem && bss_elems.ht_cap_elem &&
3342
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3343
			elems->ht_cap_elem = bss_elems.ht_cap_elem;
3344 3345 3346
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
3347
		if (!elems->ht_operation && bss_elems.ht_operation &&
3348
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3349
			elems->ht_operation = bss_elems.ht_operation;
3350 3351 3352
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
3353
		if (!elems->vht_cap_elem && bss_elems.vht_cap_elem &&
3354
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3355
			elems->vht_cap_elem = bss_elems.vht_cap_elem;
3356 3357 3358
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
3359
		if (!elems->vht_operation && bss_elems.vht_operation &&
3360
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3361
			elems->vht_operation = bss_elems.vht_operation;
3362 3363 3364 3365 3366
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

3367 3368 3369 3370
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
3371
	if (!is_6ghz && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3372
	    (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
3373
		sdata_info(sdata,
3374 3375 3376
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
3377 3378
	}

3379
	if (!is_6ghz && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3380
	    (!elems->vht_cap_elem || !elems->vht_operation)) {
3381
		sdata_info(sdata,
3382 3383 3384
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
3385 3386
	}

3387 3388 3389 3390 3391 3392 3393 3394
	if (is_6ghz && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
	    !elems->he_6ghz_capa) {
		sdata_info(sdata,
			   "HE 6 GHz AP is missing HE 6 GHz band capability\n");
		ret = false;
		goto out;
	}

3395 3396 3397 3398 3399
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
3400
	sta = sta_info_get(sdata, cbss->bssid);
3401 3402
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
3403 3404
		ret = false;
		goto out;
3405
	}
3406

3407 3408 3409 3410 3411 3412
	sband = ieee80211_get_sband(sdata);
	if (!sband) {
		mutex_unlock(&sdata->local->sta_mtx);
		ret = false;
		goto out;
	}
3413

L
Luca Coelho 已提交
3414
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3415
	    (!elems->he_cap || !elems->he_operation)) {
L
Luca Coelho 已提交
3416 3417 3418 3419 3420 3421 3422
		mutex_unlock(&sdata->local->sta_mtx);
		sdata_info(sdata,
			   "HE AP is missing HE capability/operation\n");
		ret = false;
		goto out;
	}

3423
	/* Set up internal HT/VHT capabilities */
3424
	if (elems->ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
3425
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3426
						  elems->ht_cap_elem, sta);
3427

3428
	if (elems->vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
M
Mahesh Palivela 已提交
3429
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3430
						    elems->vht_cap_elem, sta);
M
Mahesh Palivela 已提交
3431

3432 3433
	if (elems->he_operation && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
	    elems->he_cap) {
L
Luca Coelho 已提交
3434
		ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
3435 3436
						  elems->he_cap,
						  elems->he_cap_len,
3437
						  elems->he_6ghz_capa,
L
Luca Coelho 已提交
3438 3439 3440
						  sta);

		bss_conf->he_support = sta->sta.he_cap.has_he;
3441 3442 3443 3444 3445 3446 3447 3448
		if (elems->rsnx && elems->rsnx_len &&
		    (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
		    wiphy_ext_feature_isset(local->hw.wiphy,
					    NL80211_EXT_FEATURE_PROTECTED_TWT))
			bss_conf->twt_protected = true;
		else
			bss_conf->twt_protected = false;

3449
		changed |= ieee80211_recalc_twt_req(sdata, sta, elems);
L
Luca Coelho 已提交
3450 3451
	} else {
		bss_conf->he_support = false;
3452
		bss_conf->twt_requester = false;
3453
		bss_conf->twt_protected = false;
L
Luca Coelho 已提交
3454 3455 3456
	}

	if (bss_conf->he_support) {
3457
		bss_conf->he_bss_color.color =
3458
			le32_get_bits(elems->he_operation->he_oper_params,
3459
				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3460 3461 3462 3463 3464 3465 3466
		bss_conf->he_bss_color.partial =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
		bss_conf->he_bss_color.disabled =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
		changed |= BSS_CHANGED_HE_BSS_COLOR;
L
Luca Coelho 已提交
3467 3468

		bss_conf->htc_trig_based_pkt_ext =
3469
			le32_get_bits(elems->he_operation->he_oper_params,
3470
			      IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
L
Luca Coelho 已提交
3471
		bss_conf->frame_time_rts_th =
3472
			le32_get_bits(elems->he_operation->he_oper_params,
3473
			      IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
L
Luca Coelho 已提交
3474 3475 3476 3477 3478 3479 3480 3481 3482

		bss_conf->multi_sta_back_32bit =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP;

		bss_conf->ack_enabled =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_ACK_EN;

3483 3484 3485
		bss_conf->uora_exists = !!elems->uora_element;
		if (elems->uora_element)
			bss_conf->uora_ocw_range = elems->uora_element[0];
L
Luca Coelho 已提交
3486

3487 3488
		ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
		ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
L
Luca Coelho 已提交
3489 3490 3491
		/* TODO: OPEN: what happens if BSS color disable is set? */
	}

S
Sara Sharon 已提交
3492 3493 3494 3495 3496 3497 3498 3499
	if (cbss->transmitted_bss) {
		bss_conf->nontransmitted = true;
		ether_addr_copy(bss_conf->transmitter_bssid,
				cbss->transmitted_bss->bssid);
		bss_conf->bssid_indicator = cbss->max_bssid_indicator;
		bss_conf->bssid_index = cbss->bssid_index;
	}

3500 3501 3502 3503 3504 3505
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
3506

3507 3508 3509 3510 3511
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
3512 3513
	if (elems->opmode_notif &&
	    !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
3514 3515
		u8 nss;

3516
		nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
3517 3518 3519 3520 3521
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

3522
	rate_control_rate_init(sta);
3523

3524
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
J
Johannes Berg 已提交
3525
		set_sta_flag(sta, WLAN_STA_MFP);
3526 3527 3528 3529
		sta->sta.mfp = true;
	} else {
		sta->sta.mfp = false;
	}
3530

3531
	sta->sta.wme = elems->wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3532

3533
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3534 3535 3536
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
3537 3538 3539
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
3540 3541
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
3542 3543
		ret = false;
		goto out;
3544 3545
	}

3546
	mutex_unlock(&sdata->local->sta_mtx);
3547

3548 3549 3550 3551 3552 3553 3554
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;
3555
	ifmgd->mu_edca_last_param_set = -1;
3556

3557
	if (ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
3558
		ieee80211_set_wmm_default(sdata, false, false);
3559 3560 3561
	} else if (!ieee80211_sta_wmm_params(local, sdata, elems->wmm_param,
					     elems->wmm_param_len,
					     elems->mu_edca_param_set)) {
3562 3563 3564 3565 3566 3567 3568 3569 3570 3571 3572
		/* still enable QoS since we might have HT/VHT */
		ieee80211_set_wmm_default(sdata, false, true);
		/* set the disable-WMM flag in this case to disable
		 * tracking WMM parameter changes in the beacon if
		 * the parameters weren't actually valid. Doing so
		 * avoids changing parameters very strangely when
		 * the AP is going back and forth between valid and
		 * invalid parameters.
		 */
		ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
	}
3573
	changed |= BSS_CHANGED_QOS;
3574

3575
	if (elems->max_idle_period_ie) {
3576
		bss_conf->max_idle_period =
3577
			le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
3578
		bss_conf->protected_keep_alive =
3579
			!!(elems->max_idle_period_ie->idle_options &
3580 3581 3582 3583 3584 3585 3586
			   WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
		changed |= BSS_CHANGED_KEEP_ALIVE;
	} else {
		bss_conf->max_idle_period = 0;
		bss_conf->protected_keep_alive = false;
	}

3587
	/* set assoc capability (AID was already set earlier),
J
Johannes Berg 已提交
3588 3589
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->assoc_capability = capab_info;
3590
	ieee80211_set_associated(sdata, cbss, changed);
3591

3592 3593 3594 3595 3596 3597 3598
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3599
	/*
J
Johannes Berg 已提交
3600 3601
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3602
	 */
J
Johannes Berg 已提交
3603
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3604
	ieee80211_sta_reset_beacon_monitor(sdata);
3605

3606 3607 3608 3609
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3610 3611
}

3612 3613 3614
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3615 3616 3617 3618 3619
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3620
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3621 3622
	u8 *pos;
	bool reassoc;
3623
	struct cfg80211_bss *bss;
3624 3625 3626 3627
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = ASSOC_EVENT,
	};
J
Johannes Berg 已提交
3628

3629
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3630 3631

	if (!assoc_data)
3632
		return;
3633
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3634
		return;
J
Johannes Berg 已提交
3635 3636 3637 3638 3639 3640 3641

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3642
		return;
J
Johannes Berg 已提交
3643

3644
	reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
J
Johannes Berg 已提交
3645 3646 3647 3648
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3649 3650 3651 3652
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3653

3654 3655 3656 3657
	if (assoc_data->fils_kek_len &&
	    fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
		return;

J
Johannes Berg 已提交
3658
	pos = mgmt->u.assoc_resp.variable;
3659 3660
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, assoc_data->bss->bssid);
J
Johannes Berg 已提交
3661 3662

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3663 3664
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3665
		u32 tu, ms;
3666
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3667
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3668 3669 3670
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3671
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3672
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3673
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3674 3675
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3676 3677
	}

3678
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3679 3680

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3681 3682
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
3683
		ieee80211_destroy_assoc_data(sdata, false, false);
3684 3685 3686
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3687
	} else {
3688
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len, &elems)) {
J
Johannes Berg 已提交
3689
			/* oops -- internal error -- send timeout for now */
3690
			ieee80211_destroy_assoc_data(sdata, false, false);
3691
			cfg80211_assoc_timeout(sdata->dev, bss);
3692
			return;
J
Johannes Berg 已提交
3693
		}
3694 3695
		event.u.mlme.status = MLME_SUCCESS;
		drv_event_callback(sdata->local, sdata, &event);
3696
		sdata_info(sdata, "associated\n");
3697 3698 3699 3700 3701 3702

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
3703
		ieee80211_destroy_assoc_data(sdata, true, false);
3704 3705 3706 3707 3708

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
3709
				uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
J
Johannes Berg 已提交
3710 3711
	}

3712 3713
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues,
			       ifmgd->assoc_req_ies, ifmgd->assoc_req_ies_len);
J
Johannes Berg 已提交
3714
}
J
Johannes Berg 已提交
3715

3716
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3717
				  struct ieee80211_mgmt *mgmt, size_t len,
3718
				  struct ieee80211_rx_status *rx_status)
3719 3720
{
	struct ieee80211_local *local = sdata->local;
3721
	struct ieee80211_bss *bss;
3722
	struct ieee80211_channel *channel;
3723

3724
	sdata_assert_lock(sdata);
3725

3726 3727
	channel = ieee80211_get_channel_khz(local->hw.wiphy,
					ieee80211_rx_status_to_khz(rx_status));
3728
	if (!channel)
3729 3730
		return;

3731
	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
3732 3733
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3734
		ieee80211_rx_bss_put(local, bss);
3735
	}
3736 3737 3738
}


3739
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3740
					 struct sk_buff *skb)
3741
{
J
Johannes Berg 已提交
3742
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3743
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3744
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
3745
	struct ieee80211_channel *channel;
J
Johannes Berg 已提交
3746
	size_t baselen, len = skb->len;
3747

3748 3749
	ifmgd = &sdata->u.mgd;

3750
	sdata_assert_lock(sdata);
3751

3752 3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763 3764 3765 3766
	/*
	 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
	 * "If a 6 GHz AP receives a Probe Request frame  and responds with
	 * a Probe Response frame [..], the Address 1 field of the Probe
	 * Response frame shall be set to the broadcast address [..]"
	 * So, on 6GHz band we should also accept broadcast responses.
	 */
	channel = ieee80211_get_channel(sdata->local->hw.wiphy,
					rx_status->freq);
	if (!channel)
		return;

	if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
	    (channel->band != NL80211_BAND_6GHZ ||
	     !is_broadcast_ether_addr(mgmt->da)))
3767 3768
		return; /* ignore ProbeResp to foreign address */

3769 3770 3771 3772
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

3773
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
3774

3775
	if (ifmgd->associated &&
3776
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3777
		ieee80211_reset_ap_probe(sdata);
3778 3779
}

3780 3781 3782
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3783 3784 3785
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3786 3787 3788 3789 3790 3791 3792 3793 3794 3795
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3796 3797 3798 3799 3800
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3801 3802
	(1ULL << WLAN_EID_HT_OPERATION) |
	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3803

3804 3805 3806 3807 3808
static void ieee80211_handle_beacon_sig(struct ieee80211_sub_if_data *sdata,
					struct ieee80211_if_managed *ifmgd,
					struct ieee80211_bss_conf *bss_conf,
					struct ieee80211_local *local,
					struct ieee80211_rx_status *rx_status)
3809
{
3810
	/* Track average RSSI from the Beacon frames of the current AP */
3811

3812 3813
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3814
		ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3815
		ifmgd->last_cqm_event_signal = 0;
3816
		ifmgd->count_beacon_signal = 1;
3817
		ifmgd->last_ave_beacon_signal = 0;
3818
	} else {
3819
		ifmgd->count_beacon_signal++;
3820
	}
3821

3822 3823
	ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);

3824 3825
	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3826
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3827
		int last_sig = ifmgd->last_ave_beacon_signal;
3828 3829 3830
		struct ieee80211_event event = {
			.type = RSSI_EVENT,
		};
3831 3832 3833 3834 3835 3836 3837 3838

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3839 3840
			event.u.rssi.data = RSSI_EVENT_HIGH;
			drv_event_callback(local, sdata, &event);
3841 3842 3843 3844
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3845 3846
			event.u.rssi.data = RSSI_EVENT_LOW;
			drv_event_callback(local, sdata, &event);
3847 3848 3849
		}
	}

3850
	if (bss_conf->cqm_rssi_thold &&
3851
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3852
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3853
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3854 3855 3856
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
3857

3858 3859 3860 3861 3862 3863
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3864
				sig, GFP_KERNEL);
3865 3866 3867 3868 3869 3870
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3871
				sig, GFP_KERNEL);
3872 3873 3874
		}
	}

3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897
	if (bss_conf->cqm_rssi_low &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
		int last_event = ifmgd->last_cqm_event_signal;
		int low = bss_conf->cqm_rssi_low;
		int high = bss_conf->cqm_rssi_high;

		if (sig < low &&
		    (last_event == 0 || last_event >= low)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				sig, GFP_KERNEL);
		} else if (sig > high &&
			   (last_event == 0 || last_event <= high)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				sig, GFP_KERNEL);
		}
	}
3898 3899
}

S
Sara Sharon 已提交
3900 3901 3902 3903 3904 3905 3906 3907 3908 3909
static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
				    struct cfg80211_bss *bss)
{
	if (ether_addr_equal(tx_bssid, bss->bssid))
		return true;
	if (!bss->transmitted_bss)
		return false;
	return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
}

3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
	size_t baselen;
	struct ieee802_11_elems elems;
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
	struct sta_info *sta;
	u32 changed = 0;
	bool erp_valid;
	u8 erp_value = 0;
	u32 ncrc;
	u8 *bssid;
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_assert_lock(sdata);

	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
		return;
	}

3943 3944
	if (ieee80211_rx_status_to_khz(rx_status) !=
	    ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
3945 3946 3947 3948 3949 3950 3951
		rcu_read_unlock();
		return;
	}
	chan = chanctx_conf->def.chan;
	rcu_read_unlock();

	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
S
Sara Sharon 已提交
3952
	    ieee80211_rx_our_beacon(mgmt->bssid, ifmgd->assoc_data->bss)) {
3953
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3954 3955 3956
				       len - baselen, false, &elems,
				       mgmt->bssid,
				       ifmgd->assoc_data->bss->bssid);
3957

3958
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
S
Sara Sharon 已提交
3959 3960 3961

		if (elems.dtim_period)
			ifmgd->dtim_period = elems.dtim_period;
3962 3963 3964 3965 3966 3967 3968
		ifmgd->have_beacon = true;
		ifmgd->assoc_data->need_beacon = false;
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
S
Sara Sharon 已提交
3969
			sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
3970
		}
S
Sara Sharon 已提交
3971 3972 3973 3974 3975 3976 3977 3978 3979

		if (elems.mbssid_config_ie)
			bss_conf->profile_periodicity =
				elems.mbssid_config_ie->profile_periodicity;

		if (elems.ext_capab_len >= 11 &&
		    (elems.ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			bss_conf->ema_ap = true;

3980 3981 3982 3983 3984 3985 3986 3987
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
		ifmgd->assoc_data->timeout_started = true;
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
	}

	if (!ifmgd->associated ||
S
Sara Sharon 已提交
3988
	    !ieee80211_rx_our_beacon(mgmt->bssid,  ifmgd->associated))
3989 3990 3991 3992 3993 3994
		return;
	bssid = ifmgd->associated->bssid;

	if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
		ieee80211_handle_beacon_sig(sdata, ifmgd, bss_conf,
					    local, rx_status);
3995

3996
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3997
		mlme_dbg_ratelimited(sdata,
3998
				     "cancelling AP probe due to a received beacon\n");
3999
		ieee80211_reset_ap_probe(sdata);
4000 4001
	}

J
Johannes Berg 已提交
4002 4003 4004 4005
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
4006
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
4007

4008 4009
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
4010
					  len - baselen, false, &elems,
4011 4012
					  care_about_ies, ncrc,
					  mgmt->bssid, bssid);
4013

4014
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
4015
	    ieee80211_check_tim(elems.tim, elems.tim_len, bss_conf->aid)) {
4016 4017 4018 4019 4020
		if (local->hw.conf.dynamic_ps_timeout > 0) {
			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
				ieee80211_hw_config(local,
						    IEEE80211_CONF_CHANGE_PS);
4021
			}
4022
			ieee80211_send_nullfunc(local, sdata, false);
4023 4024 4025 4026 4027 4028 4029 4030 4031 4032 4033 4034
		} else if (!local->pspolling && sdata->u.mgd.powersave) {
			local->pspolling = true;

			/*
			 * Here is assumed that the driver will be
			 * able to send ps-poll frame and receive a
			 * response even though power save mode is
			 * enabled, but some drivers might require
			 * to disable power save here. This needs
			 * to be investigated.
			 */
			ieee80211_send_pspoll(local, sdata);
4035 4036
		}
	}
J
Johannes Berg 已提交
4037

4038 4039
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
J
Janusz Dziedzic 已提交
4040
		struct ieee80211_p2p_noa_attr noa = {};
4041 4042 4043 4044 4045
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
4046
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
4047 4048 4049 4050 4051 4052 4053 4054 4055 4056 4057 4058 4059 4060 4061 4062
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
4063 4064 4065 4066 4067
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

4068 4069 4070
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

4071 4072 4073 4074 4075 4076 4077 4078
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
4079
	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4080 4081 4082 4083
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
S
Sara Sharon 已提交
4084
		sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
4085 4086
	}

4087
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
4088
		return;
4089
	ifmgd->beacon_crc = ncrc;
4090
	ifmgd->beacon_crc_valid = true;
4091

4092
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
4093

4094
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
4095
					 rx_status->device_timestamp,
4096 4097
					 &elems, true);

4098 4099
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
L
Luca Coelho 已提交
4100 4101
				     elems.wmm_param_len,
				     elems.mu_edca_param_set))
4102 4103
		changed |= BSS_CHANGED_QOS;

4104 4105
	/*
	 * If we haven't had a beacon before, tell the driver about the
4106
	 * DTIM period (and beacon timing if desired) now.
4107
	 */
4108
	if (!ifmgd->have_beacon) {
4109
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
S
Sara Sharon 已提交
4110
		bss_conf->dtim_period = elems.dtim_period ?: 1;
4111

4112 4113
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
4114 4115

		mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
4116
		ieee80211_recalc_ps(local);
4117 4118
		mutex_unlock(&local->iflist_mtx);

4119
		ieee80211_recalc_ps_vif(sdata);
4120 4121
	}

4122
	if (elems.erp_info) {
J
Johannes Berg 已提交
4123 4124 4125 4126
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
4127
	}
J
Johannes Berg 已提交
4128 4129 4130
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
4131

4132
	mutex_lock(&local->sta_mtx);
4133 4134
	sta = sta_info_get(sdata, bssid);

4135 4136
	changed |= ieee80211_recalc_twt_req(sdata, sta, &elems);

4137 4138
	if (ieee80211_config_bw(sdata, sta, elems.ht_cap_elem,
				elems.vht_cap_elem, elems.ht_operation,
L
Luca Coelho 已提交
4139 4140
				elems.vht_operation, elems.he_operation,
				bssid, &changed)) {
4141
		mutex_unlock(&local->sta_mtx);
4142 4143 4144
		sdata_info(sdata,
			   "failed to follow AP %pM bandwidth change, disconnect\n",
			   bssid);
4145 4146 4147
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
4148 4149 4150
		ieee80211_report_disconnect(sdata, deauth_buf,
					    sizeof(deauth_buf), true,
					    WLAN_REASON_DEAUTH_LEAVING);
4151
		return;
4152
	}
4153 4154 4155

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
4156
					    rx_status->band);
4157
	mutex_unlock(&local->sta_mtx);
4158

4159 4160 4161
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
4162 4163
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
4164

4165
	ieee80211_bss_info_change_notify(sdata, changed);
4166 4167
}

4168 4169
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
4170 4171 4172 4173
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
4174 4175
	struct ieee802_11_elems elems;
	int ies_len;
4176 4177 4178 4179 4180

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

4181
	sdata_lock(sdata);
4182

J
Johannes Berg 已提交
4183 4184
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
4185
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
4186 4187 4188 4189 4190
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
4191
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4192 4193
		break;
	case IEEE80211_STYPE_DEAUTH:
4194
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4195 4196
		break;
	case IEEE80211_STYPE_DISASSOC:
4197
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4198 4199 4200
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
4201
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4202 4203
		break;
	case IEEE80211_STYPE_ACTION:
4204
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
4205 4206 4207
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
4208 4209 4210 4211

			if (ies_len < 0)
				break;

4212
			/* CSA IE cannot be overridden, no need for BSSID */
4213 4214
			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
4215
				ies_len, true, &elems, mgmt->bssid, NULL);
4216 4217 4218 4219

			if (elems.parse_error)
				break;

4220
			ieee80211_sta_process_chanswitch(sdata,
4221 4222 4223
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4224 4225 4226 4227 4228 4229 4230 4231
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

4232 4233 4234 4235
			/*
			 * extended CSA IE can't be overridden, no need for
			 * BSSID
			 */
4236 4237
			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
4238
				ies_len, true, &elems, mgmt->bssid, NULL);
4239 4240 4241 4242 4243 4244 4245 4246

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
4247
			ieee80211_sta_process_chanswitch(sdata,
4248 4249 4250
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4251
		}
4252
		break;
4253
	}
4254
	sdata_unlock(sdata);
4255 4256
}

4257
static void ieee80211_sta_timer(struct timer_list *t)
4258
{
J
Johannes Berg 已提交
4259
	struct ieee80211_sub_if_data *sdata =
4260
		from_timer(sdata, t, u.mgd.timer);
4261

4262
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
4263 4264
}

4265
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
4266
					  u8 *bssid, u8 reason, bool tx)
4267
{
4268
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4269

4270
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
4271
			       tx, frame_buf);
4272

4273 4274
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    reason);
4275 4276
}

4277
static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4278 4279 4280 4281
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
4282
	u32 tx_flags = 0;
4283 4284
	u16 trans = 1;
	u16 status = 0;
4285
	u16 prepare_tx_duration = 0;
J
Johannes Berg 已提交
4286

4287
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4288 4289 4290 4291 4292 4293 4294

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
4295 4296
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
4297 4298 4299 4300 4301 4302 4303 4304 4305 4306

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

4307 4308 4309 4310 4311
	if (auth_data->algorithm == WLAN_AUTH_SAE)
		prepare_tx_duration =
			jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);

	drv_mgd_prepare_tx(local, sdata, prepare_tx_duration);
J
Johannes Berg 已提交
4312

4313 4314 4315
	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
		   auth_data->bss->bssid, auth_data->tries,
		   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
4316

4317
	auth_data->expected_transaction = 2;
4318

4319 4320 4321 4322 4323
	if (auth_data->algorithm == WLAN_AUTH_SAE) {
		trans = auth_data->sae_trans;
		status = auth_data->sae_status;
		auth_data->expected_transaction = trans;
	}
J
Johannes Berg 已提交
4324

4325 4326 4327
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
4328

4329 4330 4331 4332 4333
	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
			    auth_data->data, auth_data->data_len,
			    auth_data->bss->bssid,
			    auth_data->bss->bssid, NULL, 0, 0,
			    tx_flags);
J
Johannes Berg 已提交
4334

4335
	if (tx_flags == 0) {
4336 4337 4338 4339 4340
		if (auth_data->algorithm == WLAN_AUTH_SAE)
			auth_data->timeout = jiffies +
				IEEE80211_AUTH_TIMEOUT_SAE;
		else
			auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
4341
	} else {
4342 4343
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
4344
	}
J
Johannes Berg 已提交
4345

4346 4347 4348
	auth_data->timeout_started = true;
	run_again(sdata, auth_data->timeout);

J
Johannes Berg 已提交
4349 4350 4351 4352 4353 4354 4355 4356
	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

4357
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4358 4359 4360

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
4361 4362
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
4363 4364 4365 4366 4367 4368 4369 4370 4371 4372

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
4373 4374 4375
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
4376 4377
	ieee80211_send_assoc(sdata);

4378
	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
4379
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
4380
		assoc_data->timeout_started = true;
4381
		run_again(sdata, assoc_data->timeout);
4382
	} else {
4383 4384 4385 4386 4387
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
4388
	}
J
Johannes Berg 已提交
4389 4390 4391 4392

	return 0;
}

4393 4394 4395 4396 4397 4398 4399 4400 4401 4402 4403 4404
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

4405
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4406 4407
{
	struct ieee80211_local *local = sdata->local;
4408
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4409

4410
	sdata_lock(sdata);
4411

4412 4413 4414 4415 4416
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
4417
		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
4418
			if (status_acked) {
4419 4420 4421 4422 4423 4424 4425 4426 4427
				if (ifmgd->auth_data->algorithm ==
				    WLAN_AUTH_SAE)
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SAE;
				else
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SHORT;
4428
				run_again(sdata, ifmgd->auth_data->timeout);
4429 4430 4431
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
4432
			ifmgd->auth_data->timeout_started = true;
4433 4434 4435 4436 4437 4438
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
4439
				run_again(sdata, ifmgd->assoc_data->timeout);
4440 4441 4442
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
4443
			ifmgd->assoc_data->timeout_started = true;
4444 4445 4446
		}
	}

4447
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
4448 4449 4450 4451 4452 4453 4454
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
4455
		} else if (ieee80211_auth(sdata)) {
J
Johannes Berg 已提交
4456
			u8 bssid[ETH_ALEN];
4457 4458 4459 4460 4461
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = AUTH_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4462 4463 4464 4465 4466

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

4467
			cfg80211_auth_timeout(sdata->dev, bssid);
4468
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4469
		}
4470
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
4471
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
4472

4473
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
4474
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
4475
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
4476
		    ieee80211_do_assoc(sdata)) {
4477
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4478 4479 4480 4481 4482
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = ASSOC_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4483

4484
			ieee80211_destroy_assoc_data(sdata, false, false);
4485
			cfg80211_assoc_timeout(sdata->dev, bss);
4486
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4487
		}
4488
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
4489
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
4490

4491
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
4492
	    ifmgd->associated) {
4493
		u8 bssid[ETH_ALEN];
4494
		int max_tries;
4495

4496
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
4497

4498
		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
4499
			max_tries = max_nullfunc_tries;
4500
		else
4501
			max_tries = max_probe_tries;
4502

4503 4504 4505
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
4506 4507
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4508 4509 4510 4511
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
4512 4513
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
4514 4515 4516
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
4517
				ieee80211_sta_connection_lost(sdata, bssid,
4518 4519
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
4520 4521
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
4522
			run_again(sdata, ifmgd->probe_timeout);
4523
		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
J
Johannes Berg 已提交
4524 4525 4526
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
4527
			ieee80211_sta_connection_lost(sdata, bssid,
4528
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
4529
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4530 4531 4532 4533
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
4534 4535
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
4536 4537 4538 4539
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
4540 4541 4542
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, disconnecting.\n",
				 bssid, probe_wait_ms);
4543

4544
			ieee80211_sta_connection_lost(sdata, bssid,
4545
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
4546 4547 4548
		}
	}

4549
	sdata_unlock(sdata);
4550 4551
}

4552
static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4553 4554
{
	struct ieee80211_sub_if_data *sdata =
4555
		from_timer(sdata, t, u.mgd.bcn_mon_timer);
4556
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4557

4558
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4559 4560
		return;

4561
	sdata->u.mgd.connection_loss = false;
4562 4563
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
4564 4565
}

4566
static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4567 4568
{
	struct ieee80211_sub_if_data *sdata =
4569
		from_timer(sdata, t, u.mgd.conn_mon_timer);
J
Johannes Berg 已提交
4570 4571 4572
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

4573
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4574 4575
		return;

4576
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
4577 4578 4579 4580 4581 4582 4583 4584 4585 4586 4587
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
4588 4589
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
4590
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
4591
		__ieee80211_stop_poll(sdata);
4592

J
Johannes Berg 已提交
4593
		/* let's probe the connection once */
4594
		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
4595 4596
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
4597
	}
J
Johannes Berg 已提交
4598
}
4599

4600
#ifdef CONFIG_PM
4601 4602 4603 4604 4605 4606 4607
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

4608 4609 4610 4611 4612
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

4613
		/*
4614 4615 4616
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
4617
		 */
4618
		ieee80211_send_deauth_disassoc(sdata, bssid, bssid,
4619 4620 4621
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
4622
		if (ifmgd->assoc_data)
4623
			ieee80211_destroy_assoc_data(sdata, false, true);
4624 4625
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
4626 4627 4628 4629
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

4630 4631 4632 4633 4634 4635 4636 4637 4638 4639 4640 4641 4642 4643 4644 4645 4646 4647 4648 4649 4650 4651 4652 4653 4654 4655 4656 4657
	/* This is a bit of a hack - we should find a better and more generic
	 * solution to this. Normally when suspending, cfg80211 will in fact
	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
	 * auth (not so important) or assoc (this is the problem) process.
	 *
	 * As a consequence, it can happen that we are in the process of both
	 * associating and suspending, and receive an association response
	 * after cfg80211 has checked if it needs to disconnect, but before
	 * we actually set the flag to drop incoming frames. This will then
	 * cause the workqueue flush to process the association response in
	 * the suspend, resulting in a successful association just before it
	 * tries to remove the interface from the driver, which now though
	 * has a channel context assigned ... this results in issues.
	 *
	 * To work around this (for now) simply deauth here again if we're
	 * now connected.
	 */
	if (ifmgd->associated && !sdata->local->wowlan) {
		u8 bssid[ETH_ALEN];
		struct cfg80211_deauth_request req = {
			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
			.bssid = bssid,
		};

		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
		ieee80211_mgd_deauth(sdata, &req);
	}

4658 4659 4660
	sdata_unlock(sdata);
}

4661 4662 4663 4664
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4665
	sdata_lock(sdata);
4666
	if (!ifmgd->associated) {
4667
		sdata_unlock(sdata);
4668 4669 4670 4671 4672 4673 4674 4675 4676 4677
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4678
		sdata_unlock(sdata);
4679 4680
		return;
	}
4681
	sdata_unlock(sdata);
4682 4683 4684
}
#endif

J
Johannes Berg 已提交
4685 4686
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4687
{
4688
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4689

4690
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4691
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4692
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4693 4694
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4695 4696
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4697
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4698 4699
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4700 4701 4702 4703
	timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
	timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
	timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
	timer_setup(&ifmgd->chswitch_timer, ieee80211_chswitch_timer, 0);
4704 4705
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4706

4707
	ifmgd->flags = 0;
4708
	ifmgd->powersave = sdata->wdev.ps;
4709 4710
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4711
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4712

4713
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4714 4715 4716
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4717 4718 4719 4720 4721

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4722 4723
}

4724 4725
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4726
{
4727
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4728

4729 4730
	/* Restart STA timers */
	rcu_read_lock();
4731 4732 4733 4734
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4735 4736
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4737

J
Johannes Berg 已提交
4738 4739 4740 4741 4742 4743 4744 4745 4746 4747 4748 4749
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4750
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4751 4752 4753 4754 4755 4756 4757 4758 4759 4760 4761 4762
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4763
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779 4780 4781
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

L
Luca Coelho 已提交
4782 4783 4784 4785 4786 4787
static bool
ieee80211_verify_sta_he_mcs_support(struct ieee80211_supported_band *sband,
				    const struct ieee80211_he_operation *he_op)
{
	const struct ieee80211_sta_he_cap *sta_he_cap =
		ieee80211_get_he_sta_cap(sband);
4788
	u16 ap_min_req_set;
L
Luca Coelho 已提交
4789 4790 4791 4792 4793
	int i;

	if (!sta_he_cap || !he_op)
		return false;

4794 4795
	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);

L
Luca Coelho 已提交
4796 4797 4798 4799 4800 4801 4802 4803 4804 4805 4806 4807 4808 4809 4810 4811 4812 4813 4814 4815 4816 4817 4818 4819 4820 4821 4822 4823 4824 4825 4826 4827 4828 4829 4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840 4841 4842 4843
	/* Need to go over for 80MHz, 160MHz and for 80+80 */
	for (i = 0; i < 3; i++) {
		const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
			&sta_he_cap->he_mcs_nss_supp;
		u16 sta_mcs_map_rx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
		u16 sta_mcs_map_tx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
		u8 nss;
		bool verified = true;

		/*
		 * For each band there is a maximum of 8 spatial streams
		 * possible. Each of the sta_mcs_map_* is a 16-bit struct built
		 * of 2 bits per NSS (1-8), with the values defined in enum
		 * ieee80211_he_mcs_support. Need to make sure STA TX and RX
		 * capabilities aren't less than the AP's minimum requirements
		 * for this HE BSS per SS.
		 * It is enough to find one such band that meets the reqs.
		 */
		for (nss = 8; nss > 0; nss--) {
			u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
			u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
			u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;

			if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
				continue;

			/*
			 * Make sure the HE AP doesn't require MCSs that aren't
			 * supported by the client
			 */
			if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
				verified = false;
				break;
			}
		}

		if (verified)
			return true;
	}

	/* If here, STA doesn't meet AP's HE min requirements */
	return false;
}

4844 4845
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4846 4847 4848
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4849
	const struct ieee80211_ht_cap *ht_cap = NULL;
4850
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4851
	const struct ieee80211_vht_operation *vht_oper = NULL;
L
Luca Coelho 已提交
4852
	const struct ieee80211_he_operation *he_oper = NULL;
4853
	struct ieee80211_supported_band *sband;
4854
	struct cfg80211_chan_def chandef;
4855
	bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4856
	struct ieee80211_bss *bss = (void *)cbss->priv;
J
Johannes Berg 已提交
4857
	int ret;
4858 4859
	u32 i;
	bool have_80mhz;
4860

4861 4862
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4863 4864 4865 4866
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4867
	/* disable HT/VHT/HE if we don't support them */
4868
	if (!sband->ht_cap.ht_supported && !is_6ghz) {
4869 4870 4871 4872 4873
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

4874
	if (!sband->vht_cap.vht_supported && !is_6ghz) {
4875
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4876 4877
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}
4878 4879 4880 4881

	if (!ieee80211_get_he_sta_cap(sband))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

4882 4883
	rcu_read_lock();

4884
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) && !is_6ghz) {
4885
		const u8 *ht_oper_ie, *ht_cap_ie;
4886

4887
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4888 4889
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4890

4891 4892 4893 4894 4895
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4896 4897 4898
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4899 4900
	}

4901
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) && !is_6ghz) {
4902
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4903

4904 4905
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4906 4907 4908 4909
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4910
			sdata_info(sdata,
4911
				   "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4912 4913
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4914
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
4915
		}
4916 4917 4918 4919 4920 4921

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4922 4923
	}

4924
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE)) {
L
Luca Coelho 已提交
4925 4926 4927 4928 4929 4930 4931 4932 4933 4934 4935 4936
		const struct cfg80211_bss_ies *ies;
		const u8 *he_oper_ie;

		ies = rcu_dereference(cbss->ies);
		he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
						  ies->data, ies->len);
		if (he_oper_ie &&
		    he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3]))
			he_oper = (void *)(he_oper_ie + 3);
		else
			he_oper = NULL;

4937
		if (!ieee80211_verify_sta_he_mcs_support(sband, he_oper))
L
Luca Coelho 已提交
4938 4939 4940
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

4941 4942 4943 4944 4945 4946 4947 4948 4949 4950 4951 4952 4953 4954
	/* Allow VHT if at least one channel on the sband supports 80 MHz */
	have_80mhz = false;
	for (i = 0; i < sband->n_channels; i++) {
		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
						IEEE80211_CHAN_NO_80MHZ))
			continue;

		have_80mhz = true;
		break;
	}

	if (!have_80mhz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4955 4956
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
4957
						     bss->vht_cap_info,
L
Luca Coelho 已提交
4958
						     ht_oper, vht_oper, he_oper,
4959
						     &chandef, false);
4960

J
Johannes Berg 已提交
4961 4962
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4963

4964 4965
	rcu_read_unlock();

4966 4967 4968 4969 4970
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HE && is_6ghz) {
		sdata_info(sdata, "Rejecting non-HE 6/7 GHz connection");
		return -EINVAL;
	}

4971 4972 4973
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4974
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4975 4976 4977 4978 4979 4980 4981
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4982 4983 4984 4985

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4986
		goto out;
4987

4988
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4989
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4990 4991 4992
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4993 4994
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4995
	return ret;
4996 4997
}

S
Sara Sharon 已提交
4998 4999 5000 5001 5002 5003 5004 5005 5006 5007 5008 5009 5010 5011 5012 5013 5014 5015 5016 5017 5018 5019 5020 5021 5022 5023 5024 5025 5026 5027 5028 5029 5030 5031
static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
			       u8 *dtim_count, u8 *dtim_period)
{
	const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
	const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
					 ies->len);
	const struct ieee80211_tim_ie *tim = NULL;
	const struct ieee80211_bssid_index *idx;
	bool valid = tim_ie && tim_ie[1] >= 2;

	if (valid)
		tim = (void *)(tim_ie + 2);

	if (dtim_count)
		*dtim_count = valid ? tim->dtim_count : 0;

	if (dtim_period)
		*dtim_period = valid ? tim->dtim_period : 0;

	/* Check if value is overridden by non-transmitted profile */
	if (!idx_ie || idx_ie[1] < 3)
		return valid;

	idx = (void *)(idx_ie + 2);

	if (dtim_count)
		*dtim_count = idx->dtim_count;

	if (dtim_period)
		*dtim_period = idx->dtim_period;

	return true;
}

5032
static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
5033 5034
				     struct cfg80211_bss *cbss, bool assoc,
				     bool override)
5035 5036 5037 5038 5039
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
5040
	struct ieee80211_supported_band *sband;
5041
	bool have_sta = false;
5042 5043
	int err;

5044 5045
	sband = local->hw.wiphy->bands[cbss->channel->band];

5046 5047 5048
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

5049 5050 5051 5052
	/* If a reconfig is happening, bail out */
	if (local->in_reconfig)
		return -EBUSY;

5053 5054 5055 5056 5057 5058 5059 5060 5061 5062 5063
	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
5064

5065 5066 5067 5068 5069 5070 5071 5072 5073 5074 5075 5076 5077
	/*
	 * Set up the information for the new channel before setting the
	 * new channel. We can't - completely race-free - change the basic
	 * rates bitmap and the channel (sband) that it refers to, but if
	 * we set it up before we at least avoid calling into the driver's
	 * bss_info_changed() method with invalid information (since we do
	 * call that from changing the channel - only for IDLE and perhaps
	 * some others, but ...).
	 *
	 * So to avoid that, just set up all the new information before the
	 * channel, but tell the driver to apply it only afterwards, since
	 * it might need the new channel for that.
	 */
J
Johannes Berg 已提交
5078
	if (new_sta) {
5079 5080 5081
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
J
Johannes Berg 已提交
5082
		const struct cfg80211_bss_ies *ies;
5083
		int shift = ieee80211_vif_get_shift(&sdata->vif);
5084 5085 5086 5087 5088

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
5089
				    &min_rate, &min_rate_index,
5090
				    shift);
5091 5092 5093 5094 5095 5096 5097 5098

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
5099 5100
		 * Allow this workaround only in case the AP provided at least
		 * one rate.
5101
		 */
5102 5103 5104 5105 5106 5107 5108
		if (min_rate_index < 0) {
			sdata_info(sdata,
				   "No legacy rates in association response\n");

			sta_info_free(local, new_sta);
			return -EINVAL;
		} else if (!basic_rates) {
J
Johannes Berg 已提交
5109 5110
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
5111 5112 5113
			basic_rates = BIT(min_rate_index);
		}

5114 5115 5116 5117 5118 5119
		if (rates)
			new_sta->sta.supp_rates[cbss->channel->band] = rates;
		else
			sdata_info(sdata,
				   "No rates found, keeping mandatory only\n");

5120 5121 5122
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
5123
		if (cbss->channel->band == NL80211_BAND_2GHZ &&
5124 5125 5126 5127 5128 5129 5130
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

5131 5132
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
5133
		rcu_read_lock();
5134 5135 5136 5137 5138
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
S
Sara Sharon 已提交
5139 5140 5141 5142

			ieee80211_get_dtim(ies,
					   &sdata->vif.bss_conf.sync_dtim_count,
					   NULL);
5143 5144
		} else if (!ieee80211_hw_check(&sdata->local->hw,
					       TIMING_BEACON_ONLY)) {
5145 5146 5147 5148 5149 5150 5151 5152 5153 5154 5155
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
5156
		rcu_read_unlock();
5157
	}
5158

5159 5160 5161 5162 5163 5164 5165 5166 5167 5168 5169 5170 5171 5172
	if (new_sta || override) {
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

	if (new_sta) {
		/*
		 * tell driver about BSSID, basic rates and timing
		 * this was set up above, before setting the channel
		 */
5173
		ieee80211_bss_info_change_notify(sdata,
5174 5175
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
5176 5177

		if (assoc)
J
Johannes Berg 已提交
5178
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
5179

J
Johannes Berg 已提交
5180 5181
		err = sta_info_insert(new_sta);
		new_sta = NULL;
5182
		if (err) {
J
Johannes Berg 已提交
5183 5184 5185
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
5186 5187 5188
			return err;
		}
	} else
5189
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
5190

5191 5192 5193 5194
	/* Cancel scan to ensure that nothing interferes with connection */
	if (local->scanning)
		ieee80211_scan_cancel(local);

5195 5196 5197
	return 0;
}

5198 5199 5200
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
5201
{
J
Johannes Berg 已提交
5202 5203 5204
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
5205
	u16 auth_alg;
J
Johannes Berg 已提交
5206
	int err;
5207
	bool cont_auth;
J
Johannes Berg 已提交
5208 5209

	/* prepare auth data structure */
J
Johannes Berg 已提交
5210

5211 5212 5213 5214 5215
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
5216
		if (fips_enabled)
5217
			return -EOPNOTSUPP;
5218 5219 5220 5221 5222 5223 5224 5225
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
5226 5227 5228
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
5229 5230 5231 5232 5233 5234 5235 5236 5237
	case NL80211_AUTHTYPE_FILS_SK:
		auth_alg = WLAN_AUTH_FILS_SK;
		break;
	case NL80211_AUTHTYPE_FILS_SK_PFS:
		auth_alg = WLAN_AUTH_FILS_SK_PFS;
		break;
	case NL80211_AUTHTYPE_FILS_PK:
		auth_alg = WLAN_AUTH_FILS_PK;
		break;
5238 5239
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
5240
	}
5241

5242
	if (ifmgd->assoc_data)
5243 5244
		return -EBUSY;

5245
	auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
5246
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
5247
	if (!auth_data)
J
Johannes Berg 已提交
5248
		return -ENOMEM;
5249

J
Johannes Berg 已提交
5250
	auth_data->bss = req->bss;
5251

5252
	if (req->auth_data_len >= 4) {
5253 5254 5255 5256 5257 5258
		if (req->auth_type == NL80211_AUTHTYPE_SAE) {
			__le16 *pos = (__le16 *) req->auth_data;

			auth_data->sae_trans = le16_to_cpu(pos[0]);
			auth_data->sae_status = le16_to_cpu(pos[1]);
		}
5259 5260 5261
		memcpy(auth_data->data, req->auth_data + 4,
		       req->auth_data_len - 4);
		auth_data->data_len += req->auth_data_len - 4;
5262 5263
	}

5264 5265 5266 5267 5268 5269 5270
	/* Check if continuing authentication or trying to authenticate with the
	 * same BSS that we were in the process of authenticating with and avoid
	 * removal and re-addition of the STA entry in
	 * ieee80211_prep_connection().
	 */
	cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss;

5271
	if (req->ie && req->ie_len) {
5272 5273 5274
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
5275
	}
5276

J
Johannes Berg 已提交
5277
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
5278 5279 5280
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
5281 5282
	}

J
Johannes Berg 已提交
5283
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
5284

J
Johannes Berg 已提交
5285
	/* try to authenticate/probe */
5286

5287 5288 5289 5290 5291 5292 5293
	if (ifmgd->auth_data) {
		if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
			auth_data->peer_confirmed =
				ifmgd->auth_data->peer_confirmed;
		}
		ieee80211_destroy_auth_data(sdata, cont_auth);
	}
5294

J
Johannes Berg 已提交
5295 5296
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
5297

5298 5299 5300 5301 5302 5303 5304 5305 5306
	/* If this is continuation of an ongoing SAE authentication exchange
	 * (i.e., request to send SAE Confirm) and the peer has already
	 * confirmed, mark authentication completed since we are about to send
	 * out SAE Confirm.
	 */
	if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
	    auth_data->peer_confirmed && auth_data->sae_trans == 2)
		ieee80211_mark_sta_auth(sdata, req->bss->bssid);

5307 5308 5309
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5310 5311 5312
		sdata_info(sdata,
			   "disconnect from AP %pM for new auth to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5313 5314 5315 5316
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5317 5318 5319
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5320
	}
J
Johannes Berg 已提交
5321

J
Johannes Berg 已提交
5322
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
5323

5324
	err = ieee80211_prep_connection(sdata, req->bss, cont_auth, false);
5325
	if (err)
J
Johannes Berg 已提交
5326
		goto err_clear;
J
Johannes Berg 已提交
5327

5328
	err = ieee80211_auth(sdata);
J
Johannes Berg 已提交
5329 5330 5331 5332 5333 5334
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
5335
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
5336
	return 0;
J
Johannes Berg 已提交
5337 5338

 err_clear:
5339
	eth_zero_addr(ifmgd->bssid);
5340
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5341
	ifmgd->auth_data = NULL;
5342 5343 5344
	mutex_lock(&sdata->local->mtx);
	ieee80211_vif_release_channel(sdata);
	mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
5345 5346
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
5347 5348
}

5349 5350
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
5351
{
5352
	bool is_6ghz = req->bss->channel->band == NL80211_BAND_6GHZ;
J
Johannes Berg 已提交
5353
	struct ieee80211_local *local = sdata->local;
5354
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5355
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
5356
	struct ieee80211_mgd_assoc_data *assoc_data;
5357
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
5358
	struct ieee80211_supported_band *sband;
5359
	const u8 *ssidie, *ht_ie, *vht_ie;
5360
	int i, err;
5361
	bool override = false;
5362

J
Johannes Berg 已提交
5363 5364 5365 5366
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

5367 5368
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
5369
	if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
5370 5371 5372 5373 5374 5375 5376 5377
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

5378 5379 5380
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5381 5382 5383
		sdata_info(sdata,
			   "disconnect from AP %pM for new assoc to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5384 5385 5386 5387
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5388 5389 5390
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5391
	}
J
Johannes Berg 已提交
5392 5393 5394 5395

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
5396
	}
5397

J
Johannes Berg 已提交
5398 5399 5400 5401
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
5402

J
Johannes Berg 已提交
5403 5404 5405 5406
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
5407
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
5408
		ieee80211_destroy_auth_data(sdata, match);
5409 5410
	}

J
Johannes Berg 已提交
5411
	/* prepare assoc data */
5412

5413 5414
	ifmgd->beacon_crc_valid = false;

5415 5416 5417
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);

J
Johannes Berg 已提交
5418 5419 5420 5421 5422 5423 5424
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
5425
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
5426 5427
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
5428
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
5429
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5430
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
L
Luca Coelho 已提交
5431
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5432
			netdev_info(sdata->dev,
5433
				    "disabling HT/VHT/HE due to WEP/TKIP use\n");
5434 5435
		}
	}
5436

J
Johannes Berg 已提交
5437 5438
	sband = local->hw.wiphy->bands[req->bss->channel->band];

5439 5440 5441
	/* also disable HT/VHT/HE if the AP doesn't use WMM */
	if (!bss->wmm_used) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5442
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5443 5444 5445
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
		netdev_info(sdata->dev,
			    "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
5446 5447
	}

B
Ben Greear 已提交
5448 5449 5450 5451
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

5452 5453 5454 5455
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

5456
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
5457 5458 5459
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
5460

5461 5462 5463 5464 5465 5466 5467 5468 5469 5470 5471 5472 5473 5474 5475
	if (req->fils_kek) {
		/* should already be checked in cfg80211 - so warn */
		if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
			err = -EINVAL;
			goto err_free;
		}
		memcpy(assoc_data->fils_kek, req->fils_kek,
		       req->fils_kek_len);
		assoc_data->fils_kek_len = req->fils_kek_len;
	}

	if (req->fils_nonces)
		memcpy(assoc_data->fils_nonces, req->fils_nonces,
		       2 * FILS_NONCE_LEN);

J
Johannes Berg 已提交
5476
	assoc_data->bss = req->bss;
5477

J
Johannes Berg 已提交
5478 5479
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
5480
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
5481
		else
5482
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
5483
	} else
5484
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
5485

J
Johannes Berg 已提交
5486 5487 5488
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
5489

5490
	rcu_read_lock();
5491 5492 5493 5494
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
5495
	else if (!is_6ghz)
5496
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5497 5498 5499 5500
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
5501 5502 5503
	else if (!is_6ghz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT |
				IEEE80211_STA_DISABLE_HE;
5504
	rcu_read_unlock();
5505

5506
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
5507
		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
5508 5509 5510
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
5511
	if (bss->wmm_used && bss->uapsd_supported &&
5512
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
5513
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
5514 5515
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
5516
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
5517 5518 5519
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

5520
	if (req->prev_bssid)
J
Johannes Berg 已提交
5521
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
5522 5523 5524 5525 5526 5527 5528 5529 5530

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

5531 5532 5533 5534 5535
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

5536 5537 5538 5539 5540
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

5541 5542
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
5543 5544
	sdata->control_port_over_nl80211 =
					req->crypto.control_port_over_nl80211;
5545
	sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
5546 5547
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
5548

J
Johannes Berg 已提交
5549 5550 5551
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
5552
	ifmgd->dtim_period = 0;
5553
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
5554

5555 5556 5557 5558 5559 5560 5561 5562 5563 5564 5565 5566 5567 5568 5569 5570 5571 5572 5573 5574 5575 5576 5577 5578
	/* override HT/VHT configuration only if the AP and we support it */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
		struct ieee80211_sta_ht_cap sta_ht_cap;

		if (req->flags & ASSOC_REQ_DISABLE_HT)
			override = true;

		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

		/* check for 40 MHz disable override */
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
		    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
		    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
			override = true;

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
		    req->flags & ASSOC_REQ_DISABLE_VHT)
			override = true;
	}

	if (req->flags & ASSOC_REQ_DISABLE_HT) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5579
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5580 5581 5582 5583 5584 5585
	}

	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	err = ieee80211_prep_connection(sdata, req->bss, true, override);
5586 5587
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
5588

5589 5590
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
5591

5592
	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
5593 5594 5595 5596 5597 5598 5599 5600
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
5601
		assoc_data->timeout_started = true;
5602 5603
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
5604
		const struct element *elem;
5605 5606
		u8 dtim_count = 0;

S
Sara Sharon 已提交
5607 5608 5609
		ieee80211_get_dtim(beacon_ies, &dtim_count,
				   &ifmgd->dtim_period);

5610
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
5611
		assoc_data->timeout = jiffies;
5612
		assoc_data->timeout_started = true;
5613

5614
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5615 5616 5617 5618 5619
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
S
Sara Sharon 已提交
5620

5621 5622 5623 5624
		elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
					      beacon_ies->data, beacon_ies->len);
		if (elem && elem->datalen >= 3)
			sdata->vif.bss_conf.profile_periodicity = elem->data[2];
S
Sara Sharon 已提交
5625

5626 5627 5628 5629
		elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
					  beacon_ies->data, beacon_ies->len);
		if (elem && elem->datalen >= 11 &&
		    (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
S
Sara Sharon 已提交
5630
			sdata->vif.bss_conf.ema_ap = true;
5631 5632
	} else {
		assoc_data->timeout = jiffies;
5633
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
5634
	}
5635 5636
	rcu_read_unlock();

5637
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
5638

P
Paul Stewart 已提交
5639 5640 5641 5642 5643 5644 5645 5646 5647 5648
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
5649 5650
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
5651 5652
	}

5653
	return 0;
J
Johannes Berg 已提交
5654
 err_clear:
5655
	eth_zero_addr(ifmgd->bssid);
5656
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5657 5658 5659 5660
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
5661 5662
}

5663
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
5664
			 struct cfg80211_deauth_request *req)
5665
{
5666
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5667
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5668
	bool tx = !req->local_state_change;
5669

5670 5671 5672 5673 5674 5675
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
5676

5677
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5678
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5679
					       IEEE80211_STYPE_DEAUTH,
5680
					       req->reason_code, tx,
5681
					       frame_buf);
5682
		ieee80211_destroy_auth_data(sdata, false);
5683 5684 5685
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5686

5687
		return 0;
5688 5689
	}

5690 5691 5692 5693 5694 5695 5696
	if (ifmgd->assoc_data &&
	    ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting association with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5697
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5698
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5699 5700 5701
					       IEEE80211_STYPE_DEAUTH,
					       req->reason_code, tx,
					       frame_buf);
5702
		ieee80211_destroy_assoc_data(sdata, false, true);
5703 5704 5705 5706 5707 5708
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
		return 0;
	}

5709 5710
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
5711 5712 5713 5714 5715
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5716 5717
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
5718 5719 5720
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5721 5722
		return 0;
	}
5723

5724
	return -ENOTCONN;
5725
}
5726

5727
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
5728
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
5729
{
5730
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5731
	u8 bssid[ETH_ALEN];
5732
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
5733

J
Johannes Berg 已提交
5734 5735 5736 5737 5738 5739
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
5740
	if (ifmgd->associated != req->bss)
5741 5742
		return -ENOLINK;

J
Johannes Berg 已提交
5743
	sdata_info(sdata,
5744 5745
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
5746

5747
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
5748 5749 5750
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
5751

5752 5753
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    req->reason_code);
5754

5755 5756
	return 0;
}
5757

5758
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
5759 5760 5761
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

5762 5763 5764 5765 5766 5767 5768 5769 5770 5771
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
5772
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5773

5774
	sdata_lock(sdata);
5775 5776
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5777
		ieee80211_destroy_assoc_data(sdata, false, false);
5778 5779
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
5780 5781
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
5782 5783 5784 5785 5786 5787
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
5788 5789 5790
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = NULL;
	ifmgd->assoc_req_ies_len = 0;
5791
	spin_unlock_bh(&ifmgd->teardown_lock);
5792
	del_timer_sync(&ifmgd->timer);
5793
	sdata_unlock(sdata);
5794 5795
}

5796 5797
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
5798
			       s32 rssi_level,
5799 5800 5801 5802
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

5803
	trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
J
Johannes Berg 已提交
5804

5805
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
5806 5807
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
5808 5809 5810 5811 5812 5813 5814 5815 5816 5817

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);