mlme.c 165.1 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-only
2 3
/*
 * BSS client mode implementation
4
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
5 6 7 8
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9
 * Copyright 2013-2014  Intel Mobile Communications GmbH
10
 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
11
 * Copyright (C) 2018 - 2020 Intel Corporation
12 13
 */

14
#include <linux/delay.h>
15
#include <linux/fips.h>
16 17 18 19
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
20
#include <linux/moduleparam.h>
21
#include <linux/rtnetlink.h>
22
#include <linux/crc32.h>
23
#include <linux/slab.h>
24
#include <linux/export.h>
25
#include <net/mac80211.h>
26
#include <asm/unaligned.h>
J
Johannes Berg 已提交
27

28
#include "ieee80211_i.h"
29
#include "driver-ops.h"
J
Johannes Berg 已提交
30 31
#include "rate.h"
#include "led.h"
32
#include "fils_aead.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
37
#define IEEE80211_AUTH_TIMEOUT_SAE	(HZ * 2)
38 39 40
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
41
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
42 43
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
44

45 46 47 48 49 50 51 52 53
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
54 55

/*
56 57 58 59 60 61
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
62
 */
63 64 65 66
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
67

J
Johannes Berg 已提交
68 69 70 71
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
72
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
73 74 75 76 77
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
78 79 80 81 82
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
83

84 85 86 87 88 89
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
90 91 92 93 94 95 96 97 98 99
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
100 101
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
102
{
103
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
104

105 106 107
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
108 109
}

110
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
111
{
112
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
113 114
		return;

115
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
116 117
		return;

J
Johannes Berg 已提交
118
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
119
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
120 121
}

122 123
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
124 125
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

126
	if (unlikely(!ifmgd->associated))
127 128
		return;

129 130
	if (ifmgd->probe_send_count)
		ifmgd->probe_send_count = 0;
131

132
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
133 134
		return;

135
	mod_timer(&ifmgd->conn_mon_timer,
136 137 138
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

139
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
140
{
141
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
142 143
}

144 145 146 147 148 149
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
150
			     const struct ieee80211_he_operation *he_oper,
151
			     struct cfg80211_chan_def *chandef, bool tracking)
152
{
153
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
154
	struct cfg80211_chan_def vht_chandef;
155
	struct ieee80211_sta_ht_cap sta_ht_cap;
156 157
	u32 ht_cfreq, ret;

158 159 160
	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

161
	memset(chandef, 0, sizeof(struct cfg80211_chan_def));
162 163 164 165
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;

166
	if (!ht_oper || !sta_ht_cap.ht_supported) {
167 168 169
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
170 171 172 173 174 175 176 177
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
178
	if (!tracking && channel->center_freq != ht_cfreq) {
179 180 181 182 183 184 185
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
186 187 188 189
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
190 191 192
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
193 194 195 196
		goto out;
	}

	/* check 40 MHz support, if we have it */
197
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
198
		ieee80211_chandef_ht_oper(ht_oper, chandef);
199 200 201
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
202 203
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
204 205 206 207 208 209 210 211
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

212
	vht_chandef = *chandef;
L
Luca Coelho 已提交
213 214 215 216 217 218 219 220 221 222 223 224
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && he_oper &&
	    (le32_to_cpu(he_oper->he_oper_params) &
	     IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
		struct ieee80211_vht_operation he_oper_vht_cap;

		/*
		 * Set only first 3 bytes (other 2 aren't used in
		 * ieee80211_chandef_vht_oper() anyway)
		 */
		memcpy(&he_oper_vht_cap, he_oper->optional, 3);
		he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);

225 226
		if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
						&he_oper_vht_cap, ht_oper,
L
Luca Coelho 已提交
227 228 229 230 231 232 233
						&vht_chandef)) {
			if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
				sdata_info(sdata,
					   "HE AP VHT information is invalid, disable HE\n");
			ret = IEEE80211_STA_DISABLE_HE;
			goto out;
		}
234 235
	} else if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_oper,
					       ht_oper, &vht_chandef)) {
236
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
237
			sdata_info(sdata,
238
				   "AP VHT information is invalid, disable VHT\n");
239 240 241 242 243
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
244
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
245 246
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
247 248 249 250 251 252 253 254 255 256
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
257
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
258 259
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
260 261 262 263 264 265 266 267 268
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

291 292 293 294
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

295 296 297 298 299 300 301 302
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
303
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
304 305
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
306 307
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
308 309
			      IEEE80211_STA_DISABLE_VHT |
			      IEEE80211_STA_DISABLE_HE;
310
			break;
311 312
		}

313
		ret |= ieee80211_chandef_downgrade(chandef);
314 315
	}

316 317
	if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
						 IEEE80211_CHAN_NO_HE))
318 319
		ret |= IEEE80211_STA_DISABLE_HE;

320
	if (chandef->width != vht_chandef.width && !tracking)
321 322 323 324 325 326 327
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

328 329
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
330
			       const struct ieee80211_ht_cap *ht_cap,
331 332
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
333
			       const struct ieee80211_he_operation *he_oper,
334
			       const u8 *bssid, u32 *changed)
335 336
{
	struct ieee80211_local *local = sdata->local;
337
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
L
Luca Coelho 已提交
338 339 340
	struct ieee80211_channel *chan = sdata->vif.bss_conf.chandef.chan;
	struct ieee80211_supported_band *sband =
		local->hw.wiphy->bands[chan->band];
341
	struct cfg80211_chan_def chandef;
342
	u16 ht_opmode;
343 344 345
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
346

347 348
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
349 350
		return 0;

351 352 353 354
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

L
Luca Coelho 已提交
355 356 357 358 359
	/* don't check HE if we associated as non-HE station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HE ||
	    !ieee80211_get_he_sta_cap(sband))
		he_oper = NULL;

360 361 362
	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

363 364 365 366 367 368 369 370 371 372
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

L
Luca Coelho 已提交
373
	/* calculate new channel (type) based on HT/VHT/HE operation IEs */
374
	flags = ieee80211_determine_chantype(sdata, sband, chan,
L
Luca Coelho 已提交
375
					     ht_oper, vht_oper, he_oper,
376
					     &chandef, true);
377 378 379 380 381 382 383 384 385 386

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
387
		flags |= ieee80211_chandef_downgrade(&chandef);
388 389
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
390
		flags |= ieee80211_chandef_downgrade(&chandef);
391 392
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
393
		flags |= ieee80211_chandef_downgrade(&chandef);
394 395 396 397 398 399 400 401 402 403 404

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
		   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
		   chandef.center_freq1, chandef.center_freq2);

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
405
				      IEEE80211_STA_DISABLE_HE |
406 407 408 409 410 411 412 413 414 415 416 417 418 419 420
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
421
	case NL80211_CHAN_WIDTH_40:
422
		new_sta_bw = IEEE80211_STA_RX_BW_40;
423
		break;
424 425 426 427 428 429
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
430
		break;
431 432
	default:
		return -EINVAL;
433
	}
434

435 436
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
437

438 439 440 441 442
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
443

444 445 446 447 448 449 450
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
451

452 453 454 455
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
456
	}
457

458
	return 0;
459 460
}

J
Johannes Berg 已提交
461 462
/* frame sending functions */

J
Johannes Berg 已提交
463
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
464
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

482
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
483 484 485 486 487 488 489 490 491 492 493 494 495 496
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

497 498 499 500 501 502 503 504 505 506
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
507 508 509 510 511 512
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
513
		/* fall through */
J
Johannes Berg 已提交
514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

533 534 535 536
/* This function determines vht capability flags for the association
 * and builds the IE.
 * Note - the function may set the owner of the MU-MIMO capability
 */
537 538
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
539 540
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
541
{
542
	struct ieee80211_local *local = sdata->local;
543 544 545
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
546
	u32 mask, ap_bf_sts, our_bf_sts;
547 548 549 550

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
551
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
552 553 554 555

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
556
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
557 558 559 560 561 562
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
563 564 565 566
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
567
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
568 569
	}

570 571 572 573 574 575
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593
		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
	else if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

	/*
	 * If some other vif is using the MU-MIMO capablity we cannot associate
	 * using MU-MIMO - this will lead to contradictions in the group-id
	 * mechanism.
	 * Ownership is defined since association request, in order to avoid
	 * simultaneous associations with MU-MIMO.
	 */
	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
		bool disable_mu_mimo = false;
		struct ieee80211_sub_if_data *other;

		list_for_each_entry_rcu(other, &local->interfaces, list) {
594
			if (other->vif.mu_mimo_owner) {
595 596 597 598 599 600 601
				disable_mu_mimo = true;
				break;
			}
		}
		if (disable_mu_mimo)
			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
		else
602
			sdata->vif.mu_mimo_owner = true;
603
	}
604

605 606 607 608 609 610 611 612 613 614
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

615
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
616
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
617 618 619
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

L
Luca Coelho 已提交
620 621 622 623 624 625 626 627 628
/* This function determines HE capability flags for the association
 * and builds the IE.
 */
static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
				struct sk_buff *skb,
				struct ieee80211_supported_band *sband)
{
	u8 *pos;
	const struct ieee80211_sta_he_cap *he_cap = NULL;
629
	struct ieee80211_chanctx_conf *chanctx_conf;
L
Luca Coelho 已提交
630
	u8 he_cap_size;
631 632 633 634 635 636 637 638 639 640
	bool reg_cap = false;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!WARN_ON_ONCE(!chanctx_conf))
		reg_cap = cfg80211_chandef_usable(sdata->wdev.wiphy,
						  &chanctx_conf->def,
						  IEEE80211_CHAN_NO_HE);

	rcu_read_unlock();
L
Luca Coelho 已提交
641 642

	he_cap = ieee80211_get_he_sta_cap(sband);
643
	if (!he_cap || !reg_cap)
L
Luca Coelho 已提交
644 645 646 647 648 649 650 651 652 653 654 655 656 657 658
		return;

	/*
	 * TODO: the 1 added is because this temporarily is under the EXTENSION
	 * IE. Get rid of it when it moves.
	 */
	he_cap_size =
		2 + 1 + sizeof(he_cap->he_cap_elem) +
		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
		ieee80211_he_ppe_size(he_cap->ppe_thres[0],
				      he_cap->he_cap_elem.phy_cap_info);
	pos = skb_put(skb, he_cap_size);
	ieee80211_ie_build_he_cap(pos, he_cap, pos + he_cap_size);
}

J
Johannes Berg 已提交
659 660 661 662 663 664 665
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
666
	u8 *pos, qos_info, *ie_start;
J
Johannes Berg 已提交
667
	size_t offset = 0, noffset;
668
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
669 670
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
671 672
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
673
	u32 rates = 0;
674 675 676 677 678 679 680
	struct element *ext_capa = NULL;

	/* we know it's writable, cast away the const */
	if (assoc_data->ie_len)
		ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
						      assoc_data->ie,
						      assoc_data->ie_len);
J
Johannes Berg 已提交
681

682
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
683

J
Johannes Berg 已提交
684 685 686 687 688 689
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
690
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
691 692
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
693
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
694 695 696 697 698 699 700 701

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
702 703 704 705
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
706 707 708 709 710 711
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
712 713 714 715 716
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
717 718 719 720 721 722 723 724 725
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
726
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
L
Luca Coelho 已提交
727 728 729
			2 + 1 + sizeof(struct ieee80211_he_cap_elem) + /* HE */
				sizeof(struct ieee80211_he_mcs_nss_supp) +
				IEEE80211_HE_PPE_THRES_MAX_LEN +
J
Johannes Berg 已提交
730
			assoc_data->ie_len + /* extra IEs */
731
			(assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
J
Johannes Berg 已提交
732 733 734 735 736 737 738 739 740
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

741
	if (sband->band == NL80211_BAND_2GHZ) {
742 743
		capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
J
Johannes Berg 已提交
744 745 746 747 748 749
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
750
	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
J
Johannes Berg 已提交
751 752
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

753 754 755
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

756
	mgmt = skb_put_zero(skb, 24);
J
Johannes Berg 已提交
757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
781
	ie_start = pos;
J
Johannes Berg 已提交
782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
798 799 800
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
801 802 803 804 805 806 807 808 809 810 811 812
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
813 814 815 816
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
817 818 819 820
			}
		}
	}

821 822
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
823 824 825 826
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
827 828
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
829
	}
J
Johannes Berg 已提交
830

831 832 833 834 835 836 837 838 839
	/*
	 * Per spec, we shouldn't include the list of channels if we advertise
	 * support for extended channel switching, but we've always done that;
	 * (for now?) apply this restriction only on the (new) 6 GHz band.
	 */
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
	    (sband->band != NL80211_BAND_6GHZ ||
	     !ext_capa || ext_capa->datalen < 1 ||
	     !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
J
Johannes Berg 已提交
840 841 842 843 844 845 846 847 848 849 850
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

851 852
	/* Set MBSSID support for HE AP if needed */
	if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
853 854 855
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && assoc_data->ie_len &&
	    ext_capa && ext_capa->datalen >= 3)
		ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
856

J
Johannes Berg 已提交
857
	/* if present, add any custom IEs that go before HT */
858
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
859 860 861 862 863 864 865 866 867 868
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
869 870
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
871 872
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
873 874 875 876
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
877
			/* luckily this is almost always there */
878 879 880 881
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
882
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
883 884 885 886 887 888 889 890 891 892 893
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
894
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
895 896 897
		offset = noffset;
	}

J
Johannes Berg 已提交
898 899 900 901
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

902
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
903
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
904
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
905

906 907 908
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
909 910 911 912
			/*
			 * no need to list the ones split off before HT
			 * or generated here
			 */
913 914 915 916 917
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
918
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
919
		};
920 921

		/* RIC already taken above, so no need to handle here anymore */
922 923 924
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
925
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
926 927 928
		offset = noffset;
	}

L
Luca Coelho 已提交
929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955
	/* if present, add any custom IEs that go before HE */
	if (assoc_data->ie_len) {
		static const u8 before_he[] = {
			/*
			 * no need to list the ones split off before VHT
			 * or generated here
			 */
			WLAN_EID_OPMODE_NOTIF,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
			/* 11ai elements */
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
			/* TODO: add 11ah/11aj/11ak elements */
		};

		/* RIC already taken above, so no need to handle here anymore */
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_he, ARRAY_SIZE(before_he),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

956
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
957 958
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
959

960 961 962 963 964 965 966 967 968
	/*
	 * If AP doesn't support HT, mark HE as disabled.
	 * If on the 5GHz band, make sure it supports VHT.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT ||
	    (sband->band == NL80211_BAND_5GHZ &&
	     ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

L
Luca Coelho 已提交
969 970 971 972
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		ieee80211_add_he_ie(sdata, skb, sband);

	/* if present, add any custom non-vendor IEs that go after HE */
973
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
974 975 976
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
977
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
978 979 980
		offset = noffset;
	}

981 982
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
983 984
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
985 986 987 988 989
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

990
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
991 992 993
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
994
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
995
		noffset = assoc_data->ie_len;
996
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
997 998
	}

999 1000 1001 1002 1003 1004
	if (assoc_data->fils_kek_len &&
	    fils_encrypt_assoc_req(skb, assoc_data) < 0) {
		dev_kfree_skb(skb);
		return;
	}

1005 1006 1007 1008 1009
	pos = skb_tail_pointer(skb);
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
	ifmgd->assoc_req_ies_len = pos - ie_start;

1010
	drv_mgd_prepare_tx(local, sdata, 0);
J
Johannes Berg 已提交
1011

J
Johannes Berg 已提交
1012
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1013
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1014 1015
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
1016 1017 1018
	ieee80211_tx_skb(sdata, skb);
}

1019 1020 1021 1022 1023 1024
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

1025 1026
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
1027 1028
		return;

1029 1030
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1031

1032 1033
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
1034 1035
}

1036 1037
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
1038
			     bool powersave)
1039 1040
{
	struct sk_buff *skb;
1041
	struct ieee80211_hdr_3addr *nullfunc;
1042
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1043

L
Luca Coelho 已提交
1044 1045 1046 1047 1048
	/* Don't send NDPs when STA is connected HE */
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		return;

1049 1050
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
		!ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
1051
	if (!skb)
1052 1053
		return;

1054
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1055
	if (powersave)
1056
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1057

1058 1059
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1060

1061
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1062 1063
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

1064
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1065 1066
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

1067
	ieee80211_tx_skb(sdata, skb);
1068 1069
}

1070 1071 1072 1073 1074 1075 1076 1077 1078 1079
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

L
Luca Coelho 已提交
1080 1081 1082 1083
	/* Don't send NDPs when connected HE */
	if (!(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
		return;

1084
	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1085
	if (!skb)
1086
		return;
1087

1088 1089
	skb_reserve(skb, local->hw.extra_tx_headroom);

1090
	nullfunc = skb_put_zero(skb, 30);
1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

1103 1104 1105 1106 1107
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
1108
	struct ieee80211_local *local = sdata->local;
1109
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1110
	int ret;
1111

1112
	if (!ieee80211_sdata_running(sdata))
1113 1114
		return;

1115
	sdata_lock(sdata);
1116 1117 1118
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

1119 1120
	if (!ifmgd->associated)
		goto out;
1121

1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
1133 1134 1135 1136
		struct ieee80211_supported_band *sband = NULL;
		struct sta_info *mgd_sta = NULL;
		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;

1137 1138 1139 1140 1141 1142 1143 1144
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186
		if (sdata->vif.bss_conf.chandef.width !=
		    sdata->csa_chandef.width) {
			/*
			 * For managed interface, we need to also update the AP
			 * station bandwidth and align the rate scale algorithm
			 * on the bandwidth change. Here we only consider the
			 * bandwidth of the new channel definition (as channel
			 * switch flow does not have the full HT/VHT/HE
			 * information), assuming that if additional changes are
			 * required they would be done as part of the processing
			 * of the next beacon from the AP.
			 */
			switch (sdata->csa_chandef.width) {
			case NL80211_CHAN_WIDTH_20_NOHT:
			case NL80211_CHAN_WIDTH_20:
			default:
				bw = IEEE80211_STA_RX_BW_20;
				break;
			case NL80211_CHAN_WIDTH_40:
				bw = IEEE80211_STA_RX_BW_40;
				break;
			case NL80211_CHAN_WIDTH_80:
				bw = IEEE80211_STA_RX_BW_80;
				break;
			case NL80211_CHAN_WIDTH_80P80:
			case NL80211_CHAN_WIDTH_160:
				bw = IEEE80211_STA_RX_BW_160;
				break;
			}

			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
			sband =
				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
		}

		if (sdata->vif.bss_conf.chandef.width >
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1187 1188 1189 1190 1191 1192 1193 1194 1195 1196
		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

1197 1198 1199 1200 1201 1202 1203
		if (sdata->vif.bss_conf.chandef.width <
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1204 1205 1206 1207 1208
		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1209
		sdata_info(sdata,
1210
			   "failed to finalize channel switch, disconnecting\n");
1211 1212 1213 1214
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1215

1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1236

1237 1238 1239 1240 1241
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1242

1243 1244 1245
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1246 1247 1248 1249 1250 1251
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1252
		return;
1253
	}
1254 1255

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1256 1257
}

1258 1259
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1260 1261
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1262 1263 1264

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1265 1266 1267 1268 1269 1270
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1271 1272 1273 1274
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1275
static void ieee80211_chswitch_timer(struct timer_list *t)
1276 1277
{
	struct ieee80211_sub_if_data *sdata =
1278
		from_timer(sdata, t, u.mgd.chswitch_timer);
1279

1280
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1281 1282
}

1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308
static void
ieee80211_sta_abort_chanswitch(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;

	if (!local->ops->abort_channel_switch)
		return;

	mutex_lock(&local->mtx);

	mutex_lock(&local->chanctx_mtx);
	ieee80211_vif_unreserve_chanctx(sdata);
	mutex_unlock(&local->chanctx_mtx);

	if (sdata->csa_block_tx)
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);

	sdata->csa_block_tx = false;
	sdata->vif.csa_active = false;

	mutex_unlock(&local->mtx);

	drv_abort_channel_switch(sdata);
}

1309
static void
J
Johannes Berg 已提交
1310
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1311 1312
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1313
				 bool beacon)
1314
{
1315
	struct ieee80211_local *local = sdata->local;
1316
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1317
	struct cfg80211_bss *cbss = ifmgd->associated;
1318
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1319
	struct ieee80211_chanctx *chanctx;
1320
	enum nl80211_band current_band;
1321
	struct ieee80211_csa_ie csa_ie;
1322
	struct ieee80211_channel_switch ch_switch;
1323
	int res;
1324

1325
	sdata_assert_lock(sdata);
1326

1327
	if (!cbss)
1328 1329
		return;

1330
	if (local->scanning)
1331 1332
		return;

1333
	current_band = cbss->channel->band;
1334
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1335
					   ifmgd->flags,
1336
					   ifmgd->associated->bssid, &csa_ie);
1337 1338 1339 1340

	if (!res) {
		ch_switch.timestamp = timestamp;
		ch_switch.device_timestamp = device_timestamp;
1341
		ch_switch.block_tx = csa_ie.mode;
1342 1343 1344 1345 1346
		ch_switch.chandef = csa_ie.chandef;
		ch_switch.count = csa_ie.count;
		ch_switch.delay = csa_ie.max_switch_time;
	}

1347
	if (res < 0) {
1348
		ieee80211_queue_work(&local->hw,
1349
				     &ifmgd->csa_connection_drop_work);
1350
		return;
1351 1352
	}

1353 1354 1355 1356 1357
	if (beacon && sdata->vif.csa_active && !ifmgd->csa_waiting_bcn) {
		if (res)
			ieee80211_sta_abort_chanswitch(sdata);
		else
			drv_channel_switch_rx_beacon(sdata, &ch_switch);
1358 1359 1360 1361 1362
		return;
	} else if (sdata->vif.csa_active || res) {
		/* disregard subsequent announcements if already processing */
		return;
	}
1363

1364
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1365 1366 1367
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1368
			   ifmgd->associated->bssid,
1369 1370 1371
			   csa_ie.chandef.chan->center_freq,
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
			   csa_ie.chandef.center_freq2);
1372 1373 1374 1375 1376
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1377
	if (cfg80211_chandef_identical(&csa_ie.chandef,
1378 1379
				       &sdata->vif.bss_conf.chandef) &&
	    (!csa_ie.mode || !beacon)) {
1380 1381 1382 1383 1384 1385 1386 1387 1388
		if (ifmgd->csa_ignored_same_chan)
			return;
		sdata_info(sdata,
			   "AP %pM tries to chanswitch to same channel, ignore\n",
			   ifmgd->associated->bssid);
		ifmgd->csa_ignored_same_chan = true;
		return;
	}

1389 1390 1391 1392 1393 1394 1395 1396
	/*
	 * Drop all TDLS peers - either we disconnect or move to a different
	 * channel from this point on. There's no telling what our peer will do.
	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
	 * have an incompatible wider chandef.
	 */
	ieee80211_teardown_tdls_peers(sdata);

1397
	mutex_lock(&local->mtx);
1398
	mutex_lock(&local->chanctx_mtx);
1399 1400 1401 1402 1403
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
1404
		goto drop_connection;
1405 1406 1407 1408
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1409
	if (local->use_chanctx &&
1410
	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1411 1412
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
1413
		goto drop_connection;
J
Johannes Berg 已提交
1414 1415
	}

1416 1417 1418
	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
1419
		goto drop_connection;
1420 1421
	}

1422 1423 1424
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1425
		sdata_info(sdata,
1426 1427
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1428
		goto drop_connection;
J
Johannes Berg 已提交
1429
	}
1430
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1431

1432
	sdata->vif.csa_active = true;
1433
	sdata->csa_chandef = csa_ie.chandef;
1434
	sdata->csa_block_tx = csa_ie.mode;
1435
	ifmgd->csa_ignored_same_chan = false;
J
Johannes Berg 已提交
1436

1437
	if (sdata->csa_block_tx)
1438 1439
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1440
	mutex_unlock(&local->mtx);
1441

1442 1443 1444
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1445
	if (local->ops->channel_switch) {
1446
		/* use driver's channel switch callback */
1447
		drv_channel_switch(local, sdata, &ch_switch);
1448 1449 1450 1451
		return;
	}

	/* channel switch handled in software */
1452
	if (csa_ie.count <= 1)
1453
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1454
	else
1455
		mod_timer(&ifmgd->chswitch_timer,
1456 1457
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1458 1459
	return;
 drop_connection:
1460 1461 1462 1463 1464 1465 1466 1467
	/*
	 * This is just so that the disconnect flow will know that
	 * we were trying to switch channel and failed. In case the
	 * mode is 1 (we are not allowed to Tx), we will know not to
	 * send a deauthentication frame. Those two fields will be
	 * reset when the disconnection worker runs.
	 */
	sdata->vif.csa_active = true;
1468
	sdata->csa_block_tx = csa_ie.mode;
1469

1470 1471 1472
	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
1473 1474
}

1475 1476 1477 1478 1479 1480
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1481
{
1482 1483
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1484
	int i, chan_increment;
1485
	bool have_chan_pwr = false;
1486

1487 1488
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1489
		return false;
1490

1491 1492 1493 1494 1495 1496 1497
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
1498 1499
	case NL80211_BAND_2GHZ:
	case NL80211_BAND_60GHZ:
1500 1501
		chan_increment = 1;
		break;
1502
	case NL80211_BAND_5GHZ:
1503 1504
		chan_increment = 4;
		break;
1505
	}
1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1517
				*chan_pwr = triplet->chans.max_power;
1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1529
	if (have_chan_pwr && pwr_constr_elem)
1530
		*pwr_reduction = *pwr_constr_elem;
1531 1532 1533
	else
		*pwr_reduction = 0;

1534 1535 1536
	return have_chan_pwr;
}

1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1551 1552 1553 1554
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1555 1556
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1557
{
1558 1559 1560
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1561
	int new_ap_level;
1562
	__le16 capab = mgmt->u.probe_resp.capab_info;
1563

1564 1565 1566
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1567 1568 1569
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1570 1571 1572 1573 1574 1575 1576 1577
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1578
	}
1579

1580
	if (!has_80211h_pwr && !has_cisco_pwr)
1581
		return 0;
1582

1583 1584 1585 1586 1587
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1588 1589 1590 1591 1592
		new_ap_level = pwr_level_80211h;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1593 1594 1595 1596
		sdata_dbg(sdata,
			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			  sdata->u.mgd.bssid);
1597
	} else {  /* has_cisco_pwr is always true here. */
1598 1599 1600 1601 1602
		new_ap_level = pwr_level_cisco;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1603 1604 1605
		sdata_dbg(sdata,
			  "Limiting TX power to %d dBm as advertised by %pM\n",
			  pwr_level_cisco, sdata->u.mgd.bssid);
1606
	}
1607

1608 1609 1610 1611
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1612 1613
}

1614 1615 1616 1617 1618 1619
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1620 1621 1622 1623
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1624
	if (local->scanning)
J
Johannes Berg 已提交
1625 1626
		return;

1627
	if (conf->dynamic_ps_timeout > 0 &&
1628
	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1629 1630 1631
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
1632
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1633
			ieee80211_send_nullfunc(local, sdata, true);
1634

1635 1636
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1637 1638 1639 1640
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1658 1659 1660 1661
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1662
	bool authorized = false;
1663 1664 1665 1666

	if (!mgd->powersave)
		return false;

1667 1668 1669
	if (mgd->broken_ap)
		return false;

1670 1671 1672
	if (!mgd->associated)
		return false;

1673
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1674 1675
		return false;

1676
	if (!mgd->have_beacon)
1677 1678
		return false;

1679 1680 1681
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1682
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1683 1684
	rcu_read_unlock();

J
Johannes Berg 已提交
1685
	return authorized;
1686 1687
}

1688
/* need to hold RTNL or interface lock */
J
Johannes Berg 已提交
1689
void ieee80211_recalc_ps(struct ieee80211_local *local)
1690 1691 1692
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1693
	int timeout;
1694

1695
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1696 1697 1698 1699 1700
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1701
		if (!ieee80211_sdata_running(sdata))
1702
			continue;
1703 1704 1705 1706 1707 1708 1709 1710
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1711 1712 1713 1714 1715 1716
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1717
	if (count == 1 && ieee80211_powersave_allowed(found)) {
J
Johannes Berg 已提交
1718
		u8 dtimper = found->u.mgd.dtim_period;
1719

1720
		timeout = local->dynamic_ps_forced_timeout;
J
Johannes Berg 已提交
1721 1722
		if (timeout < 0)
			timeout = 100;
1723
		local->hw.conf.dynamic_ps_timeout = timeout;
1724

J
Johannes Berg 已提交
1725 1726 1727 1728 1729 1730
		/* If the TIM IE is invalid, pretend the value is 1 */
		if (!dtimper)
			dtimper = 1;

		local->hw.conf.ps_dtim_period = dtimper;
		local->ps_sdata = found;
1731
	} else {
1732
		local->ps_sdata = NULL;
1733
	}
1734 1735 1736 1737

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1738 1739 1740 1741 1742 1743 1744 1745 1746 1747
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1760
					IEEE80211_MAX_QUEUE_MAP,
1761 1762
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1763 1764 1765 1766 1767 1768 1769 1770
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1771
	struct ieee80211_if_managed *ifmgd;
1772 1773
	unsigned long flags;
	int q;
1774 1775 1776 1777 1778

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1779 1780
	ifmgd = &sdata->u.mgd;

1781 1782 1783
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1784
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1785 1786
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1787 1788 1789 1790 1791
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1810 1811
	}

1812
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1813
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1814
		if (drv_tx_frames_pending(local)) {
1815 1816 1817
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1818
		} else {
1819
			ieee80211_send_nullfunc(local, sdata, true);
1820
			/* Flush to get the tx status of nullfunc frame */
1821
			ieee80211_flush_queues(local, sdata, false);
1822
		}
1823 1824
	}

1825 1826
	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1827 1828 1829 1830 1831
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1832 1833
}

1834
void ieee80211_dynamic_ps_timer(struct timer_list *t)
1835
{
1836
	struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
1837

1838
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1839 1840
}

1841 1842
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
1843
	struct delayed_work *delayed_work = to_delayed_work(work);
1844 1845 1846
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1847
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1848

1849 1850 1851 1852 1853 1854 1855 1856
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1857 1858
}

1859 1860 1861 1862 1863
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1864
	bool ret = false;
1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
1909 1910 1911 1912 1913 1914
			/* Usually the loop will result in using BK even if it
			 * requires admission control, but such a configuration
			 * makes no sense and we have to transmit somehow - the
			 * AC selection does the same thing.
			 * If we started out trying to downgrade from BK, then
			 * the extra condition here might be needed.
1915
			 */
1916 1917
			if (non_acm_ac >= IEEE80211_NUM_ACS)
				non_acm_ac = IEEE80211_AC_BK;
1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1952
/* MLME */
L
Luca Coelho 已提交
1953 1954 1955 1956 1957
static bool
ieee80211_sta_wmm_params(struct ieee80211_local *local,
			 struct ieee80211_sub_if_data *sdata,
			 const u8 *wmm_param, size_t wmm_param_len,
			 const struct ieee80211_mu_edca_param_set *mu_edca)
1958
{
1959
	struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1960
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1961
	size_t left;
1962
	int count, mu_edca_count, ac;
J
Johannes Berg 已提交
1963 1964
	const u8 *pos;
	u8 uapsd_queues = 0;
1965

1966
	if (!local->ops->conf_tx)
1967
		return false;
1968

J
Johannes Berg 已提交
1969
	if (local->hw.queues < IEEE80211_NUM_ACS)
1970
		return false;
1971 1972

	if (!wmm_param)
1973
		return false;
1974

1975
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1976
		return false;
K
Kalle Valo 已提交
1977 1978

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1979
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
1980

1981
	count = wmm_param[6] & 0x0f;
1982 1983 1984 1985 1986 1987 1988
	/* -1 is the initial value of ifmgd->mu_edca_last_param_set.
	 * if mu_edca was preset before and now it disappeared tell
	 * the driver about it.
	 */
	mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
	if (count == ifmgd->wmm_last_param_set &&
	    mu_edca_count == ifmgd->mu_edca_last_param_set)
1989
		return false;
1990
	ifmgd->wmm_last_param_set = count;
1991
	ifmgd->mu_edca_last_param_set = mu_edca_count;
1992 1993 1994 1995 1996 1997

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
1998
	sdata->wmm_acm = 0;
1999 2000 2001
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
2002
		bool uapsd = false;
2003 2004

		switch (aci) {
2005
		case 1: /* AC_BK */
2006
			ac = IEEE80211_AC_BK;
J
Johannes Berg 已提交
2007
			if (acm)
Y
Yoni Divinsky 已提交
2008
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
2009 2010
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
L
Luca Coelho 已提交
2011 2012 2013
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2014
			break;
2015
		case 2: /* AC_VI */
2016
			ac = IEEE80211_AC_VI;
J
Johannes Berg 已提交
2017
			if (acm)
Y
Yoni Divinsky 已提交
2018
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
2019 2020
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
L
Luca Coelho 已提交
2021 2022 2023
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2024
			break;
2025
		case 3: /* AC_VO */
2026
			ac = IEEE80211_AC_VO;
J
Johannes Berg 已提交
2027
			if (acm)
Y
Yoni Divinsky 已提交
2028
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
2029 2030
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
L
Luca Coelho 已提交
2031 2032 2033
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2034
			break;
2035
		case 0: /* AC_BE */
2036
		default:
2037
			ac = IEEE80211_AC_BE;
J
Johannes Berg 已提交
2038
			if (acm)
Y
Yoni Divinsky 已提交
2039
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
2040 2041
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
L
Luca Coelho 已提交
2042 2043 2044
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_be;
2045 2046 2047
			break;
		}

2048
		params[ac].aifs = pos[0] & 0x0f;
2049

2050
		if (params[ac].aifs < 2) {
2051 2052
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2053 2054
				   params[ac].aifs, aci);
			params[ac].aifs = 2;
2055
		}
2056 2057 2058 2059 2060
		params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
		params[ac].txop = get_unaligned_le16(pos + 2);
		params[ac].acm = acm;
		params[ac].uapsd = uapsd;
K
Kalle Valo 已提交
2061

2062
		if (params[ac].cw_min == 0 ||
2063
		    params[ac].cw_min > params[ac].cw_max) {
2064 2065 2066 2067 2068
			sdata_info(sdata,
				   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
				   params[ac].cw_min, params[ac].cw_max, aci);
			return false;
		}
2069
		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2070 2071
	}

2072 2073 2074 2075 2076 2077 2078 2079 2080 2081
	/* WMM specification requires all 4 ACIs. */
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		if (params[ac].cw_min == 0) {
			sdata_info(sdata,
				   "AP has invalid WMM params (missing AC %d), using defaults\n",
				   ac);
			return false;
		}
	}

2082
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
J
Johannes Berg 已提交
2083
		mlme_dbg(sdata,
2084 2085 2086 2087 2088 2089 2090 2091
			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
			 ac, params[ac].acm,
			 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
			 params[ac].txop, params[ac].uapsd,
			 ifmgd->tx_tspec[ac].downgraded);
		sdata->tx_conf[ac] = params[ac];
		if (!ifmgd->tx_tspec[ac].downgraded &&
		    drv_conf_tx(local, sdata, ac, &params[ac]))
J
Johannes Berg 已提交
2092
			sdata_err(sdata,
2093 2094
				  "failed to set TX queue parameters for AC %d\n",
				  ac);
2095
	}
2096 2097

	/* enable WMM or activate new settings */
2098
	sdata->vif.bss_conf.qos = true;
2099
	return true;
2100 2101
}

2102 2103 2104 2105
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

2106
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2107 2108 2109 2110 2111 2112 2113 2114 2115 2116
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
2117 2118
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
2119
{
J
Johannes Berg 已提交
2120
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2121
	struct ieee80211_supported_band *sband;
2122
	u32 changed = 0;
J
Johannes Berg 已提交
2123 2124 2125 2126
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

2127 2128 2129 2130
	sband = ieee80211_get_sband(sdata);
	if (!sband)
		return changed;

J
Johannes Berg 已提交
2131 2132 2133 2134 2135 2136 2137 2138 2139
	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2140
	if (sband->band == NL80211_BAND_5GHZ)
2141
		use_short_slot = true;
2142

2143 2144 2145
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
2146
	}
2147

2148 2149
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
2150
		changed |= BSS_CHANGED_ERP_PREAMBLE;
2151
	}
2152

J
Johannes Berg 已提交
2153 2154 2155
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
2156 2157 2158 2159 2160
	}

	return changed;
}

2161
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2162
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2163
				     u32 bss_info_changed)
2164
{
2165
	struct ieee80211_bss *bss = (void *)cbss->priv;
2166
	struct ieee80211_local *local = sdata->local;
2167
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2168

J
Johannes Berg 已提交
2169
	bss_info_changed |= BSS_CHANGED_ASSOC;
2170
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
2171
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
2172

2173
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
2174
		beacon_loss_count * bss_conf->beacon_int));
2175

2176 2177
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2178

2179 2180
	ieee80211_check_rate_mask(sdata);

2181 2182
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

2183 2184
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2185
		const struct cfg80211_bss_ies *ies;
2186

2187 2188 2189 2190 2191 2192 2193 2194
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
2195 2196
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
2197
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
2198 2199
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
2200 2201
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
2202
		}
2203
		rcu_read_unlock();
2204 2205
	}

J
Johannes Berg 已提交
2206
	/* just to be sure */
2207
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
2208

2209
	ieee80211_led_assoc(local, 1);
2210

2211
	if (sdata->u.mgd.have_beacon) {
2212 2213 2214 2215 2216 2217 2218
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
2219
		bss_conf->beacon_rate = bss->beacon_rate;
2220
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
2221
	} else {
2222
		bss_conf->beacon_rate = NULL;
2223
		bss_conf->dtim_period = 0;
2224
	}
2225

2226
	bss_conf->assoc = 1;
2227

2228
	/* Tell the driver to monitor connection quality (if supported) */
2229
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2230
	    bss_conf->cqm_rssi_thold)
2231 2232
		bss_info_changed |= BSS_CHANGED_CQM;

2233
	/* Enable ARP filtering */
2234
	if (bss_conf->arp_addr_cnt)
2235 2236
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
2237
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
2238

J
Johannes Berg 已提交
2239
	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2240
	ieee80211_recalc_ps(local);
J
Johannes Berg 已提交
2241
	mutex_unlock(&local->iflist_mtx);
2242

2243
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
2244 2245
	ieee80211_recalc_ps_vif(sdata);

2246
	netif_carrier_on(sdata->dev);
2247 2248
}

2249
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2250 2251
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
2252
{
2253
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2254
	struct ieee80211_local *local = sdata->local;
2255
	u32 changed = 0;
2256

2257
	sdata_assert_lock(sdata);
2258

2259 2260 2261
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
2262 2263 2264
	if (WARN_ON(!ifmgd->associated))
		return;

2265 2266
	ieee80211_stop_poll(sdata);

2267
	ifmgd->associated = NULL;
2268 2269
	netif_carrier_off(sdata->dev);

2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2281 2282 2283
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2284 2285 2286
	/* make sure ongoing transmission finishes */
	synchronize_net();

2287 2288 2289 2290 2291 2292
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2293
	if (tx)
2294
		ieee80211_flush_queues(local, sdata, true);
2295

2296
	/* deauthenticate/disassociate now */
2297 2298 2299 2300 2301 2302 2303 2304 2305
	if (tx || frame_buf) {
		/*
		 * In multi channel scenarios guarantee that the virtual
		 * interface is granted immediate airtime to transmit the
		 * deauthentication frame by calling mgd_prepare_tx, if the
		 * driver requested so.
		 */
		if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
		    !ifmgd->have_beacon)
2306
			drv_mgd_prepare_tx(sdata->local, sdata, 0);
2307

2308 2309 2310
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid,
					       ifmgd->bssid, stype, reason,
					       tx, frame_buf);
2311
	}
2312

2313
	/* flush out frame - make sure the deauth was actually sent */
2314
	if (tx)
2315
		ieee80211_flush_queues(local, sdata, false);
2316

2317
	/* clear bssid only after building the needed mgmt frames */
2318
	eth_zero_addr(ifmgd->bssid);
2319

2320
	/* remove AP and TDLS peers */
2321
	sta_info_flush(sdata);
2322 2323

	/* finally reset all BSS / config parameters */
2324 2325 2326
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2327 2328
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2329

J
Janusz Dziedzic 已提交
2330 2331 2332
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2333

2334
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2335 2336
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2337 2338
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2339 2340 2341 2342 2343 2344 2345

	/* reset MU-MIMO ownership and group data */
	memset(sdata->vif.bss_conf.mu_group.membership, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.membership));
	memset(sdata->vif.bss_conf.mu_group.position, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.position));
	changed |= BSS_CHANGED_MU_GROUPS;
2346
	sdata->vif.mu_mimo_owner = false;
2347

2348
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2349

2350 2351 2352
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2353
	/* Disable ARP filtering */
2354
	if (sdata->vif.bss_conf.arp_addr_cnt)
2355 2356
		changed |= BSS_CHANGED_ARP_FILTER;

2357 2358 2359
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2360 2361
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2362
	ieee80211_bss_info_change_notify(sdata, changed);
2363

2364
	/* disassociated - set to defaults now */
2365
	ieee80211_set_wmm_default(sdata, false, false);
2366

2367 2368 2369 2370
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2371

2372
	sdata->vif.bss_conf.dtim_period = 0;
2373 2374
	sdata->vif.bss_conf.beacon_rate = NULL;

2375
	ifmgd->have_beacon = false;
2376

2377
	ifmgd->flags = 0;
2378
	mutex_lock(&local->mtx);
2379
	ieee80211_vif_release_channel(sdata);
2380 2381

	sdata->vif.csa_active = false;
2382
	ifmgd->csa_waiting_bcn = false;
2383
	ifmgd->csa_ignored_same_chan = false;
2384 2385 2386 2387 2388
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2389
	mutex_unlock(&local->mtx);
2390

2391 2392 2393 2394
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2395
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2396
}
2397

2398 2399 2400 2401 2402 2403 2404 2405
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2406 2407
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2408
	 */
J
Johannes Berg 已提交
2409 2410 2411
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2412
	ieee80211_sta_reset_conn_monitor(sdata);
2413
}
2414

2415 2416 2417
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2418
	struct ieee80211_local *local = sdata->local;
2419

2420
	mutex_lock(&local->mtx);
2421 2422
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2423

2424
	__ieee80211_stop_poll(sdata);
2425 2426

	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2427
	ieee80211_recalc_ps(local);
2428
	mutex_unlock(&local->iflist_mtx);
2429

2430
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2431
		goto out;
2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2443 2444
out:
	mutex_unlock(&local->mtx);
2445 2446
}

2447 2448 2449 2450 2451
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
S
Sara Sharon 已提交
2452
	u16 tid = ieee80211_get_tid(hdr);
2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2482
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2483
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2484
{
2485 2486
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2487
	if (!ieee80211_is_data(hdr->frame_control))
2488 2489
	    return;

2490
	if (ieee80211_is_any_nullfunc(hdr->frame_control) &&
2491
	    sdata->u.mgd.probe_send_count > 0) {
2492
		if (ack)
2493
			ieee80211_sta_reset_conn_monitor(sdata);
2494 2495
		else
			sdata->u.mgd.nullfunc_failed = true;
2496
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2497
		return;
2498
	}
2499 2500 2501

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2502 2503
}

2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517
static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
					  const u8 *src, const u8 *dst,
					  const u8 *ssid, size_t ssid_len,
					  struct ieee80211_channel *channel)
{
	struct sk_buff *skb;

	skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
					ssid, ssid_len, NULL, 0,
					IEEE80211_PROBE_FLAG_DIRECTED);
	if (skb)
		ieee80211_tx_skb(sdata, skb);
}

2518 2519 2520 2521
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2522
	u8 *dst = ifmgd->associated->bssid;
2523
	u8 unicast_limit = max(1, max_probe_tries - 3);
J
Johannes Berg 已提交
2524
	struct sta_info *sta;
2525 2526 2527 2528 2529 2530 2531 2532

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2533

2534 2535 2536 2537 2538 2539 2540
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2541 2542
	ifmgd->probe_send_count++;

J
Johannes Berg 已提交
2543 2544 2545 2546 2547 2548 2549 2550
	if (dst) {
		mutex_lock(&sdata->local->sta_mtx);
		sta = sta_info_get(sdata, dst);
		if (!WARN_ON(!sta))
			ieee80211_check_fast_rx(sta);
		mutex_unlock(&sdata->local->sta_mtx);
	}

2551
	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2552
		ifmgd->nullfunc_failed = false;
2553 2554 2555 2556
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
			ifmgd->probe_send_count--;
		else
			ieee80211_send_nullfunc(sdata->local, sdata, false);
2557
	} else {
2558 2559
		int ssid_len;

2560
		rcu_read_lock();
2561
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2562 2563 2564 2565 2566
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2567 2568 2569
		ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
					      ssid + 2, ssid_len,
					      ifmgd->associated->channel);
2570
		rcu_read_unlock();
2571
	}
2572

2573
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2574
	run_again(sdata, ifmgd->probe_timeout);
2575 2576
}

J
Johannes Berg 已提交
2577 2578
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2579 2580
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2581
	bool already = false;
2582

2583
	if (!ieee80211_sdata_running(sdata))
2584 2585
		return;

2586
	sdata_lock(sdata);
2587 2588 2589 2590

	if (!ifmgd->associated)
		goto out;

2591 2592 2593 2594 2595 2596 2597
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2598
	if (beacon) {
J
Johannes Berg 已提交
2599
		mlme_dbg_ratelimited(sdata,
2600 2601
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2602

2603
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2604
	}
2605

J
Johannes Berg 已提交
2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2617
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2618 2619
		already = true;

E
Eliad Peller 已提交
2620 2621
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2622 2623
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2624 2625 2626
	if (already)
		goto out;

2627
	mutex_lock(&sdata->local->iflist_mtx);
J
Johannes Berg 已提交
2628
	ieee80211_recalc_ps(sdata->local);
2629 2630
	mutex_unlock(&sdata->local->iflist_mtx);

2631 2632
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2633
 out:
2634
	sdata_unlock(sdata);
2635 2636
}

2637 2638 2639 2640 2641
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2642
	struct cfg80211_bss *cbss;
2643 2644
	struct sk_buff *skb;
	const u8 *ssid;
2645
	int ssid_len;
2646 2647 2648 2649

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2650
	sdata_assert_lock(sdata);
2651

2652 2653 2654 2655 2656 2657 2658
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2659 2660
		return NULL;

2661
	rcu_read_lock();
2662
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2663 2664
	if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
		      "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
2665 2666 2667 2668
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2669
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2670
					(u32) -1, cbss->channel,
2671
					ssid + 2, ssid_len,
2672
					NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
2673
	rcu_read_unlock();
2674 2675 2676 2677 2678

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696
static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
					const u8 *buf, size_t len, bool tx,
					u16 reason)
{
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
		.u.mlme.reason = reason,
	};

	if (tx)
		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
	else
		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);

	drv_event_callback(sdata->local, sdata, &event);
}

2697
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2698
{
2699
	struct ieee80211_local *local = sdata->local;
2700
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2701
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2702
	bool tx;
2703

2704
	sdata_lock(sdata);
2705
	if (!ifmgd->associated) {
2706
		sdata_unlock(sdata);
2707 2708 2709
		return;
	}

2710 2711
	tx = !sdata->csa_block_tx;

2712 2713 2714 2715 2716
	/* AP is probably out of range (or not reachable for another reason) so
	 * remove the bss struct for that AP.
	 */
	cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);

2717 2718
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2719
			       tx, frame_buf);
2720
	mutex_lock(&local->mtx);
2721
	sdata->vif.csa_active = false;
2722
	ifmgd->csa_waiting_bcn = false;
2723 2724 2725 2726 2727
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2728
	mutex_unlock(&local->mtx);
2729

2730
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
2731 2732
				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);

2733
	sdata_unlock(sdata);
2734 2735
}

2736
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2737 2738 2739
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2740
			     u.mgd.beacon_connection_loss_work);
2741 2742
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

2743 2744
	if (ifmgd->associated)
		ifmgd->beacon_loss_count++;
J
Johannes Berg 已提交
2745

2746
	if (ifmgd->connection_loss) {
2747 2748
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2749
		__ieee80211_disconnect(sdata);
2750
	} else {
2751
		ieee80211_mgd_probe_ap(sdata, true);
2752 2753 2754 2755 2756 2757 2758 2759 2760
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2761
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2762 2763
}

2764 2765 2766
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2767
	struct ieee80211_hw *hw = &sdata->local->hw;
2768

J
Johannes Berg 已提交
2769 2770
	trace_api_beacon_loss(sdata);

2771
	sdata->u.mgd.connection_loss = false;
2772
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2773 2774 2775
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2776 2777 2778 2779 2780
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2781 2782
	trace_api_connection_loss(sdata);

2783
	sdata->u.mgd.connection_loss = true;
2784 2785 2786 2787 2788
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2789 2790 2791 2792 2793
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2794
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2795 2796

	if (!assoc) {
2797 2798 2799 2800 2801 2802
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2803 2804
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

2805
		eth_zero_addr(sdata->u.mgd.bssid);
J
Johannes Berg 已提交
2806
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2807
		sdata->u.mgd.flags = 0;
2808
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2809
		ieee80211_vif_release_channel(sdata);
2810
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2811 2812
	}

2813
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2814 2815 2816 2817
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

2818
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2819
					 bool assoc, bool abandon)
2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

	sdata_assert_lock(sdata);

	if (!assoc) {
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		eth_zero_addr(sdata->u.mgd.bssid);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
		sdata->u.mgd.flags = 0;
2837 2838
		sdata->vif.mu_mimo_owner = false;

2839 2840 2841
		mutex_lock(&sdata->local->mtx);
		ieee80211_vif_release_channel(sdata);
		mutex_unlock(&sdata->local->mtx);
2842 2843 2844

		if (abandon)
			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
2845 2846 2847 2848 2849 2850
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

J
Johannes Berg 已提交
2851 2852 2853
static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2854
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2855 2856 2857
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2858
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2859 2860

	pos = mgmt->u.auth.variable;
2861 2862
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, auth_data->bss->bssid);
J
Johannes Berg 已提交
2863 2864 2865
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
2866
	drv_mgd_prepare_tx(sdata->local, sdata, 0);
2867
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2868 2869
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2870
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2871 2872 2873
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2874
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2875 2876
}

2877 2878 2879
static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
				    const u8 *bssid)
{
2880
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2881
	struct sta_info *sta;
2882
	bool result = true;
2883

2884 2885 2886 2887 2888 2889
	sdata_info(sdata, "authenticated\n");
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
	ifmgd->auth_data->timeout_started = true;
	run_again(sdata, ifmgd->auth_data->timeout);

2890 2891 2892 2893 2894
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2895 2896
		result = false;
		goto out;
2897 2898 2899
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2900 2901
		result = false;
		goto out;
2902 2903
	}

2904 2905 2906
out:
	mutex_unlock(&sdata->local->sta_mtx);
	return result;
2907 2908
}

2909 2910
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2911 2912 2913 2914
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
2915 2916 2917 2918
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = AUTH_EVENT,
	};
J
Johannes Berg 已提交
2919

2920
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2921 2922

	if (len < 24 + 6)
2923
		return;
J
Johannes Berg 已提交
2924 2925

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2926
		return;
J
Johannes Berg 已提交
2927 2928 2929

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2930
	if (!ether_addr_equal(bssid, mgmt->bssid))
2931
		return;
J
Johannes Berg 已提交
2932 2933 2934 2935 2936 2937

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2938 2939 2940 2941 2942
	    (auth_alg != WLAN_AUTH_SAE &&
	     auth_transaction != ifmgd->auth_data->expected_transaction) ||
	    (auth_alg == WLAN_AUTH_SAE &&
	     (auth_transaction < ifmgd->auth_data->expected_transaction ||
	      auth_transaction > 2))) {
2943 2944 2945 2946
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2947
		return;
2948
	}
J
Johannes Berg 已提交
2949 2950

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
2951 2952
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2953
		ieee80211_destroy_auth_data(sdata, false);
2954
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2955 2956 2957
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
2958
		return;
J
Johannes Berg 已提交
2959 2960 2961 2962 2963 2964
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
2965
	case WLAN_AUTH_SAE:
2966 2967 2968
	case WLAN_AUTH_FILS_SK:
	case WLAN_AUTH_FILS_SK_PFS:
	case WLAN_AUTH_FILS_PK:
J
Johannes Berg 已提交
2969 2970 2971 2972 2973
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
2974
			return;
J
Johannes Berg 已提交
2975 2976 2977 2978 2979
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
2980
		return;
J
Johannes Berg 已提交
2981 2982
	}

2983 2984
	event.u.mlme.status = MLME_SUCCESS;
	drv_event_callback(sdata->local, sdata, &event);
2985 2986 2987 2988
	if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
	    (auth_transaction == 2 &&
	     ifmgd->auth_data->expected_transaction == 2)) {
		if (!ieee80211_mark_sta_auth(sdata, bssid))
2989
			return; /* ignore frame -- wait for timeout */
2990 2991 2992 2993
	} else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
		   auth_transaction == 2) {
		sdata_info(sdata, "SAE peer confirmed\n");
		ifmgd->auth_data->peer_confirmed = true;
2994 2995
	}

2996
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
J
Johannes Berg 已提交
2997 2998
}

2999 3000 3001
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

3002
const char *ieee80211_get_reason_code_string(u16 reason_code)
3003 3004 3005 3006 3007 3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
3055

3056 3057
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
3058
{
3059
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3060
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3061

3062
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3063

3064
	if (len < 24 + 2)
3065
		return;
3066

3067 3068 3069 3070 3071
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3072 3073 3074
	if (ifmgd->associated &&
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
		const u8 *bssid = ifmgd->associated->bssid;
3075

3076 3077 3078
		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));
3079

3080
		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3081

3082 3083 3084 3085
		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
					    reason_code);
		return;
	}
3086

3087 3088 3089
	if (ifmgd->assoc_data &&
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
		const u8 *bssid = ifmgd->assoc_data->bss->bssid;
3090

3091 3092 3093 3094 3095
		sdata_info(sdata,
			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));

3096
		ieee80211_destroy_assoc_data(sdata, false, true);
3097 3098 3099 3100

		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
		return;
	}
3101 3102 3103
}


3104 3105
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
3106
{
3107
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3108 3109
	u16 reason_code;

3110
	sdata_assert_lock(sdata);
3111

J
Johannes Berg 已提交
3112
	if (len < 24 + 2)
3113
		return;
3114

J
Johannes Berg 已提交
3115
	if (!ifmgd->associated ||
3116
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3117
		return;
3118 3119 3120

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

3121 3122 3123 3124 3125
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3126 3127 3128
	sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
		   mgmt->sa, reason_code,
		   ieee80211_get_reason_code_string(reason_code));
3129

3130 3131
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

3132
	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
3133 3134
}

3135 3136 3137 3138
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
3139
				int *min_rate, int *min_rate_index,
3140
				int shift)
3141 3142 3143 3144
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
3145
		int rate = supp_rates[i] & 0x7f;
3146 3147
		bool is_basic = !!(supp_rates[i] & 0x80);

3148
		if ((rate * 5 * (1 << shift)) > 110)
3149 3150 3151
			*have_higher_than_11mbit = true;

		/*
3152 3153
		 * Skip HT and VHT BSS membership selectors since they're not
		 * rates.
3154
		 *
3155
		 * Note: Even though the membership selector and the basic
3156 3157 3158
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
3159 3160
		if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY))
3161 3162 3163
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
3164 3165 3166 3167 3168 3169 3170
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
3171 3172 3173
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
3174 3175
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
3176 3177 3178 3179 3180 3181 3182
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
3183

3184 3185 3186 3187 3188 3189 3190 3191 3192 3193 3194 3195 3196
static bool ieee80211_twt_req_supported(const struct sta_info *sta,
					const struct ieee802_11_elems *elems)
{
	if (elems->ext_capab_len < 10)
		return false;

	if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
		return false;

	return sta->sta.he_cap.he_cap_elem.mac_cap_info[0] &
		IEEE80211_HE_MAC_CAP0_TWT_RES;
}

3197 3198 3199 3200 3201 3202 3203 3204 3205 3206 3207 3208 3209
static int ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee802_11_elems *elems)
{
	bool twt = ieee80211_twt_req_supported(sta, elems);

	if (sdata->vif.bss_conf.twt_requester != twt) {
		sdata->vif.bss_conf.twt_requester = twt;
		return BSS_CHANGED_TWT;
	}
	return 0;
}

J
Johannes Berg 已提交
3210 3211
static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
3212 3213
				    struct ieee80211_mgmt *mgmt, size_t len,
				    struct ieee802_11_elems *elems)
3214
{
3215
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3216
	struct ieee80211_local *local = sdata->local;
3217
	struct ieee80211_supported_band *sband;
3218
	struct sta_info *sta;
J
Johannes Berg 已提交
3219
	u16 capab_info, aid;
J
Johannes Berg 已提交
3220
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3221 3222
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
J
Johannes Berg 已提交
3223
	u32 changed = 0;
3224
	int err;
3225
	bool ret;
3226

J
Johannes Berg 已提交
3227
	/* AssocResp and ReassocResp have identical structure */
3228 3229

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
3230
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3231

3232 3233 3234 3235 3236
	/*
	 * The 5 MSB of the AID field are reserved
	 * (802.11-2016 9.4.1.8 AID field)
	 */
	aid &= 0x7ff;
3237

3238 3239 3240
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
3241 3242
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
3243 3244 3245 3246
		aid = 0;
		ifmgd->broken_ap = true;
	}

3247
	if (!elems->supp_rates) {
J
Johannes Berg 已提交
3248
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
3249
		return false;
3250 3251
	}

3252
	ifmgd->aid = aid;
3253
	ifmgd->tdls_chan_switch_prohibited =
3254 3255
		elems->ext_capab && elems->ext_capab_len >= 5 &&
		(elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
3256

3257 3258 3259 3260 3261 3262 3263
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
3264
	if ((assoc_data->wmm && !elems->wmm_param) ||
3265
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3266
	     (!elems->ht_cap_elem || !elems->ht_operation)) ||
3267
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3268
	     (!elems->vht_cap_elem || !elems->vht_operation))) {
3269 3270 3271 3272 3273 3274 3275 3276 3277 3278 3279 3280 3281
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
3282 3283 3284
				       false, &bss_elems,
				       mgmt->bssid,
				       assoc_data->bss->bssid);
3285
		if (assoc_data->wmm &&
3286 3287
		    !elems->wmm_param && bss_elems.wmm_param) {
			elems->wmm_param = bss_elems.wmm_param;
3288 3289 3290 3291 3292 3293 3294 3295
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
3296
		if (!elems->ht_cap_elem && bss_elems.ht_cap_elem &&
3297
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3298
			elems->ht_cap_elem = bss_elems.ht_cap_elem;
3299 3300 3301
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
3302
		if (!elems->ht_operation && bss_elems.ht_operation &&
3303
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3304
			elems->ht_operation = bss_elems.ht_operation;
3305 3306 3307
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
3308
		if (!elems->vht_cap_elem && bss_elems.vht_cap_elem &&
3309
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3310
			elems->vht_cap_elem = bss_elems.vht_cap_elem;
3311 3312 3313
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
3314
		if (!elems->vht_operation && bss_elems.vht_operation &&
3315
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3316
			elems->vht_operation = bss_elems.vht_operation;
3317 3318 3319 3320 3321
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

3322 3323 3324 3325 3326
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3327
	    (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
3328
		sdata_info(sdata,
3329 3330 3331
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
3332 3333 3334
	}

	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3335
	    (!elems->vht_cap_elem || !elems->vht_operation)) {
3336
		sdata_info(sdata,
3337 3338 3339
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
3340 3341
	}

3342 3343 3344 3345 3346
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
3347
	sta = sta_info_get(sdata, cbss->bssid);
3348 3349
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
3350 3351
		ret = false;
		goto out;
3352
	}
3353

3354 3355 3356 3357 3358 3359
	sband = ieee80211_get_sband(sdata);
	if (!sband) {
		mutex_unlock(&sdata->local->sta_mtx);
		ret = false;
		goto out;
	}
3360

L
Luca Coelho 已提交
3361
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3362
	    (!elems->he_cap || !elems->he_operation)) {
L
Luca Coelho 已提交
3363 3364 3365 3366 3367 3368 3369
		mutex_unlock(&sdata->local->sta_mtx);
		sdata_info(sdata,
			   "HE AP is missing HE capability/operation\n");
		ret = false;
		goto out;
	}

3370
	/* Set up internal HT/VHT capabilities */
3371
	if (elems->ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
3372
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3373
						  elems->ht_cap_elem, sta);
3374

3375
	if (elems->vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
M
Mahesh Palivela 已提交
3376
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3377
						    elems->vht_cap_elem, sta);
M
Mahesh Palivela 已提交
3378

3379 3380
	if (elems->he_operation && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
	    elems->he_cap) {
L
Luca Coelho 已提交
3381
		ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
3382 3383
						  elems->he_cap,
						  elems->he_cap_len,
L
Luca Coelho 已提交
3384 3385 3386
						  sta);

		bss_conf->he_support = sta->sta.he_cap.has_he;
3387
		changed |= ieee80211_recalc_twt_req(sdata, sta, elems);
L
Luca Coelho 已提交
3388 3389
	} else {
		bss_conf->he_support = false;
3390
		bss_conf->twt_requester = false;
L
Luca Coelho 已提交
3391 3392 3393
	}

	if (bss_conf->he_support) {
3394
		bss_conf->he_bss_color.color =
3395
			le32_get_bits(elems->he_operation->he_oper_params,
3396
				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3397 3398 3399 3400 3401 3402 3403
		bss_conf->he_bss_color.partial =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
		bss_conf->he_bss_color.disabled =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
		changed |= BSS_CHANGED_HE_BSS_COLOR;
L
Luca Coelho 已提交
3404 3405

		bss_conf->htc_trig_based_pkt_ext =
3406
			le32_get_bits(elems->he_operation->he_oper_params,
3407
			      IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
L
Luca Coelho 已提交
3408
		bss_conf->frame_time_rts_th =
3409
			le32_get_bits(elems->he_operation->he_oper_params,
3410
			      IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
L
Luca Coelho 已提交
3411 3412 3413 3414 3415 3416 3417 3418 3419

		bss_conf->multi_sta_back_32bit =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP;

		bss_conf->ack_enabled =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_ACK_EN;

3420 3421 3422
		bss_conf->uora_exists = !!elems->uora_element;
		if (elems->uora_element)
			bss_conf->uora_ocw_range = elems->uora_element[0];
L
Luca Coelho 已提交
3423

3424 3425
		ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
		ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
L
Luca Coelho 已提交
3426 3427 3428
		/* TODO: OPEN: what happens if BSS color disable is set? */
	}

S
Sara Sharon 已提交
3429 3430 3431 3432 3433 3434 3435 3436
	if (cbss->transmitted_bss) {
		bss_conf->nontransmitted = true;
		ether_addr_copy(bss_conf->transmitter_bssid,
				cbss->transmitted_bss->bssid);
		bss_conf->bssid_indicator = cbss->max_bssid_indicator;
		bss_conf->bssid_index = cbss->bssid_index;
	}

3437 3438 3439 3440 3441 3442
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
3443

3444 3445 3446 3447 3448
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
3449 3450
	if (elems->opmode_notif &&
	    !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
3451 3452
		u8 nss;

3453
		nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
3454 3455 3456 3457 3458
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

3459
	rate_control_rate_init(sta);
3460

3461
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
J
Johannes Berg 已提交
3462
		set_sta_flag(sta, WLAN_STA_MFP);
3463 3464 3465 3466
		sta->sta.mfp = true;
	} else {
		sta->sta.mfp = false;
	}
3467

3468
	sta->sta.wme = elems->wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3469

3470
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3471 3472 3473
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
3474 3475 3476
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
3477 3478
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
3479 3480
		ret = false;
		goto out;
3481 3482
	}

3483
	mutex_unlock(&sdata->local->sta_mtx);
3484

3485 3486 3487 3488 3489 3490 3491
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;
3492
	ifmgd->mu_edca_last_param_set = -1;
3493

3494
	if (ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
3495
		ieee80211_set_wmm_default(sdata, false, false);
3496 3497 3498
	} else if (!ieee80211_sta_wmm_params(local, sdata, elems->wmm_param,
					     elems->wmm_param_len,
					     elems->mu_edca_param_set)) {
3499 3500 3501 3502 3503 3504 3505 3506 3507 3508 3509
		/* still enable QoS since we might have HT/VHT */
		ieee80211_set_wmm_default(sdata, false, true);
		/* set the disable-WMM flag in this case to disable
		 * tracking WMM parameter changes in the beacon if
		 * the parameters weren't actually valid. Doing so
		 * avoids changing parameters very strangely when
		 * the AP is going back and forth between valid and
		 * invalid parameters.
		 */
		ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
	}
3510
	changed |= BSS_CHANGED_QOS;
3511

3512
	if (elems->max_idle_period_ie) {
3513
		bss_conf->max_idle_period =
3514
			le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
3515
		bss_conf->protected_keep_alive =
3516
			!!(elems->max_idle_period_ie->idle_options &
3517 3518 3519 3520 3521 3522 3523
			   WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
		changed |= BSS_CHANGED_KEEP_ALIVE;
	} else {
		bss_conf->max_idle_period = 0;
		bss_conf->protected_keep_alive = false;
	}

J
Johannes Berg 已提交
3524 3525 3526 3527
	/* set AID and assoc capability,
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->aid = aid;
	bss_conf->assoc_capability = capab_info;
3528
	ieee80211_set_associated(sdata, cbss, changed);
3529

3530 3531 3532 3533 3534 3535 3536
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3537
	/*
J
Johannes Berg 已提交
3538 3539
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3540
	 */
J
Johannes Berg 已提交
3541
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3542
	ieee80211_sta_reset_beacon_monitor(sdata);
3543

3544 3545 3546 3547
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3548 3549
}

3550 3551 3552
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3553 3554 3555 3556 3557
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3558
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3559 3560
	u8 *pos;
	bool reassoc;
3561
	struct cfg80211_bss *bss;
3562 3563 3564 3565
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = ASSOC_EVENT,
	};
J
Johannes Berg 已提交
3566

3567
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3568 3569

	if (!assoc_data)
3570
		return;
3571
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3572
		return;
J
Johannes Berg 已提交
3573 3574 3575 3576 3577 3578 3579

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3580
		return;
J
Johannes Berg 已提交
3581

3582
	reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
J
Johannes Berg 已提交
3583 3584 3585 3586
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3587 3588 3589 3590
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3591

3592 3593 3594 3595
	if (assoc_data->fils_kek_len &&
	    fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
		return;

J
Johannes Berg 已提交
3596
	pos = mgmt->u.assoc_resp.variable;
3597 3598
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, assoc_data->bss->bssid);
J
Johannes Berg 已提交
3599 3600

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3601 3602
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3603
		u32 tu, ms;
3604
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3605
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3606 3607 3608
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3609
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3610
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3611
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3612 3613
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3614 3615
	}

3616
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3617 3618

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3619 3620
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
3621
		ieee80211_destroy_assoc_data(sdata, false, false);
3622 3623 3624
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3625
	} else {
3626
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len, &elems)) {
J
Johannes Berg 已提交
3627
			/* oops -- internal error -- send timeout for now */
3628
			ieee80211_destroy_assoc_data(sdata, false, false);
3629
			cfg80211_assoc_timeout(sdata->dev, bss);
3630
			return;
J
Johannes Berg 已提交
3631
		}
3632 3633
		event.u.mlme.status = MLME_SUCCESS;
		drv_event_callback(sdata->local, sdata, &event);
3634
		sdata_info(sdata, "associated\n");
3635 3636 3637 3638 3639 3640

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
3641
		ieee80211_destroy_assoc_data(sdata, true, false);
3642 3643 3644 3645 3646

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
3647
				uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
J
Johannes Berg 已提交
3648 3649
	}

3650 3651
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues,
			       ifmgd->assoc_req_ies, ifmgd->assoc_req_ies_len);
J
Johannes Berg 已提交
3652
}
J
Johannes Berg 已提交
3653

3654
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3655
				  struct ieee80211_mgmt *mgmt, size_t len,
3656
				  struct ieee80211_rx_status *rx_status)
3657 3658
{
	struct ieee80211_local *local = sdata->local;
3659
	struct ieee80211_bss *bss;
3660
	struct ieee80211_channel *channel;
3661

3662
	sdata_assert_lock(sdata);
3663

3664 3665
	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
	if (!channel)
3666 3667
		return;

3668
	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
3669 3670
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3671
		ieee80211_rx_bss_put(local, bss);
3672
	}
3673 3674 3675
}


3676
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3677
					 struct sk_buff *skb)
3678
{
J
Johannes Berg 已提交
3679
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3680
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3681
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
3682
	struct ieee80211_channel *channel;
J
Johannes Berg 已提交
3683
	size_t baselen, len = skb->len;
3684

3685 3686
	ifmgd = &sdata->u.mgd;

3687
	sdata_assert_lock(sdata);
3688

3689 3690 3691 3692 3693 3694 3695 3696 3697 3698 3699 3700 3701 3702 3703
	/*
	 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
	 * "If a 6 GHz AP receives a Probe Request frame  and responds with
	 * a Probe Response frame [..], the Address 1 field of the Probe
	 * Response frame shall be set to the broadcast address [..]"
	 * So, on 6GHz band we should also accept broadcast responses.
	 */
	channel = ieee80211_get_channel(sdata->local->hw.wiphy,
					rx_status->freq);
	if (!channel)
		return;

	if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
	    (channel->band != NL80211_BAND_6GHZ ||
	     !is_broadcast_ether_addr(mgmt->da)))
3704 3705
		return; /* ignore ProbeResp to foreign address */

3706 3707 3708 3709
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

3710
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
3711

3712
	if (ifmgd->associated &&
3713
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3714
		ieee80211_reset_ap_probe(sdata);
3715 3716
}

3717 3718 3719
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3720 3721 3722
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3723 3724 3725 3726 3727 3728 3729 3730 3731 3732
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3733 3734 3735 3736 3737
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3738 3739
	(1ULL << WLAN_EID_HT_OPERATION) |
	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3740

3741 3742 3743 3744 3745
static void ieee80211_handle_beacon_sig(struct ieee80211_sub_if_data *sdata,
					struct ieee80211_if_managed *ifmgd,
					struct ieee80211_bss_conf *bss_conf,
					struct ieee80211_local *local,
					struct ieee80211_rx_status *rx_status)
3746
{
3747
	/* Track average RSSI from the Beacon frames of the current AP */
3748

3749 3750
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3751
		ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3752
		ifmgd->last_cqm_event_signal = 0;
3753
		ifmgd->count_beacon_signal = 1;
3754
		ifmgd->last_ave_beacon_signal = 0;
3755
	} else {
3756
		ifmgd->count_beacon_signal++;
3757
	}
3758

3759 3760
	ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);

3761 3762
	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3763
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3764
		int last_sig = ifmgd->last_ave_beacon_signal;
3765 3766 3767
		struct ieee80211_event event = {
			.type = RSSI_EVENT,
		};
3768 3769 3770 3771 3772 3773 3774 3775

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3776 3777
			event.u.rssi.data = RSSI_EVENT_HIGH;
			drv_event_callback(local, sdata, &event);
3778 3779 3780 3781
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3782 3783
			event.u.rssi.data = RSSI_EVENT_LOW;
			drv_event_callback(local, sdata, &event);
3784 3785 3786
		}
	}

3787
	if (bss_conf->cqm_rssi_thold &&
3788
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3789
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3790
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3791 3792 3793
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
3794

3795 3796 3797 3798 3799 3800
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3801
				sig, GFP_KERNEL);
3802 3803 3804 3805 3806 3807
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3808
				sig, GFP_KERNEL);
3809 3810 3811
		}
	}

3812 3813 3814 3815 3816 3817 3818 3819 3820 3821 3822 3823 3824 3825 3826 3827 3828 3829 3830 3831 3832 3833 3834
	if (bss_conf->cqm_rssi_low &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
		int last_event = ifmgd->last_cqm_event_signal;
		int low = bss_conf->cqm_rssi_low;
		int high = bss_conf->cqm_rssi_high;

		if (sig < low &&
		    (last_event == 0 || last_event >= low)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				sig, GFP_KERNEL);
		} else if (sig > high &&
			   (last_event == 0 || last_event <= high)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				sig, GFP_KERNEL);
		}
	}
3835 3836
}

S
Sara Sharon 已提交
3837 3838 3839 3840 3841 3842 3843 3844 3845 3846
static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
				    struct cfg80211_bss *bss)
{
	if (ether_addr_equal(tx_bssid, bss->bssid))
		return true;
	if (!bss->transmitted_bss)
		return false;
	return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
}

3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
	size_t baselen;
	struct ieee802_11_elems elems;
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
	struct sta_info *sta;
	u32 changed = 0;
	bool erp_valid;
	u8 erp_value = 0;
	u32 ncrc;
	u8 *bssid;
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_assert_lock(sdata);

	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
		return;
	}

	if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
		rcu_read_unlock();
		return;
	}
	chan = chanctx_conf->def.chan;
	rcu_read_unlock();

	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
S
Sara Sharon 已提交
3888
	    ieee80211_rx_our_beacon(mgmt->bssid, ifmgd->assoc_data->bss)) {
3889
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3890 3891 3892
				       len - baselen, false, &elems,
				       mgmt->bssid,
				       ifmgd->assoc_data->bss->bssid);
3893

3894
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
S
Sara Sharon 已提交
3895 3896 3897

		if (elems.dtim_period)
			ifmgd->dtim_period = elems.dtim_period;
3898 3899 3900 3901 3902 3903 3904
		ifmgd->have_beacon = true;
		ifmgd->assoc_data->need_beacon = false;
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
S
Sara Sharon 已提交
3905
			sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
3906
		}
S
Sara Sharon 已提交
3907 3908 3909 3910 3911 3912 3913 3914 3915

		if (elems.mbssid_config_ie)
			bss_conf->profile_periodicity =
				elems.mbssid_config_ie->profile_periodicity;

		if (elems.ext_capab_len >= 11 &&
		    (elems.ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			bss_conf->ema_ap = true;

3916 3917 3918 3919 3920 3921 3922 3923
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
		ifmgd->assoc_data->timeout_started = true;
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
	}

	if (!ifmgd->associated ||
S
Sara Sharon 已提交
3924
	    !ieee80211_rx_our_beacon(mgmt->bssid,  ifmgd->associated))
3925 3926 3927 3928 3929 3930
		return;
	bssid = ifmgd->associated->bssid;

	if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
		ieee80211_handle_beacon_sig(sdata, ifmgd, bss_conf,
					    local, rx_status);
3931

3932
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3933
		mlme_dbg_ratelimited(sdata,
3934
				     "cancelling AP probe due to a received beacon\n");
3935
		ieee80211_reset_ap_probe(sdata);
3936 3937
	}

J
Johannes Berg 已提交
3938 3939 3940 3941
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
3942
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
3943

3944 3945
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3946
					  len - baselen, false, &elems,
3947 3948
					  care_about_ies, ncrc,
					  mgmt->bssid, bssid);
3949

3950 3951 3952 3953 3954 3955 3956
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
	    ieee80211_check_tim(elems.tim, elems.tim_len, ifmgd->aid)) {
		if (local->hw.conf.dynamic_ps_timeout > 0) {
			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
				ieee80211_hw_config(local,
						    IEEE80211_CONF_CHANGE_PS);
3957
			}
3958
			ieee80211_send_nullfunc(local, sdata, false);
3959 3960 3961 3962 3963 3964 3965 3966 3967 3968 3969 3970
		} else if (!local->pspolling && sdata->u.mgd.powersave) {
			local->pspolling = true;

			/*
			 * Here is assumed that the driver will be
			 * able to send ps-poll frame and receive a
			 * response even though power save mode is
			 * enabled, but some drivers might require
			 * to disable power save here. This needs
			 * to be investigated.
			 */
			ieee80211_send_pspoll(local, sdata);
3971 3972
		}
	}
J
Johannes Berg 已提交
3973

3974 3975
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
J
Janusz Dziedzic 已提交
3976
		struct ieee80211_p2p_noa_attr noa = {};
3977 3978 3979 3980 3981
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3982
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994 3995 3996 3997 3998
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3999 4000 4001 4002 4003
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

4004 4005 4006
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

4007 4008 4009 4010 4011 4012 4013 4014
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
4015
	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4016 4017 4018 4019
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
S
Sara Sharon 已提交
4020
		sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
4021 4022
	}

4023
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
4024
		return;
4025
	ifmgd->beacon_crc = ncrc;
4026
	ifmgd->beacon_crc_valid = true;
4027

4028
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
4029

4030
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
4031
					 rx_status->device_timestamp,
4032 4033
					 &elems, true);

4034 4035
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
L
Luca Coelho 已提交
4036 4037
				     elems.wmm_param_len,
				     elems.mu_edca_param_set))
4038 4039
		changed |= BSS_CHANGED_QOS;

4040 4041
	/*
	 * If we haven't had a beacon before, tell the driver about the
4042
	 * DTIM period (and beacon timing if desired) now.
4043
	 */
4044
	if (!ifmgd->have_beacon) {
4045
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
S
Sara Sharon 已提交
4046
		bss_conf->dtim_period = elems.dtim_period ?: 1;
4047

4048 4049
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
4050 4051

		mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
4052
		ieee80211_recalc_ps(local);
4053 4054
		mutex_unlock(&local->iflist_mtx);

4055
		ieee80211_recalc_ps_vif(sdata);
4056 4057
	}

4058
	if (elems.erp_info) {
J
Johannes Berg 已提交
4059 4060 4061 4062
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
4063
	}
J
Johannes Berg 已提交
4064 4065 4066
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
4067

4068
	mutex_lock(&local->sta_mtx);
4069 4070
	sta = sta_info_get(sdata, bssid);

4071 4072
	changed |= ieee80211_recalc_twt_req(sdata, sta, &elems);

4073 4074
	if (ieee80211_config_bw(sdata, sta,
				elems.ht_cap_elem, elems.ht_operation,
L
Luca Coelho 已提交
4075 4076
				elems.vht_operation, elems.he_operation,
				bssid, &changed)) {
4077
		mutex_unlock(&local->sta_mtx);
4078 4079 4080
		sdata_info(sdata,
			   "failed to follow AP %pM bandwidth change, disconnect\n",
			   bssid);
4081 4082 4083
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
4084 4085 4086
		ieee80211_report_disconnect(sdata, deauth_buf,
					    sizeof(deauth_buf), true,
					    WLAN_REASON_DEAUTH_LEAVING);
4087
		return;
4088
	}
4089 4090 4091

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
4092
					    rx_status->band);
4093
	mutex_unlock(&local->sta_mtx);
4094

4095 4096 4097
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
4098 4099
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
4100

4101
	ieee80211_bss_info_change_notify(sdata, changed);
4102 4103
}

4104 4105
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
4106 4107 4108 4109
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
4110 4111
	struct ieee802_11_elems elems;
	int ies_len;
4112 4113 4114 4115 4116

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

4117
	sdata_lock(sdata);
4118

J
Johannes Berg 已提交
4119 4120
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
4121
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
4122 4123 4124 4125 4126
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
4127
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4128 4129
		break;
	case IEEE80211_STYPE_DEAUTH:
4130
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4131 4132
		break;
	case IEEE80211_STYPE_DISASSOC:
4133
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4134 4135 4136
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
4137
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4138 4139
		break;
	case IEEE80211_STYPE_ACTION:
4140
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
4141 4142 4143
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
4144 4145 4146 4147

			if (ies_len < 0)
				break;

4148
			/* CSA IE cannot be overridden, no need for BSSID */
4149 4150
			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
4151
				ies_len, true, &elems, mgmt->bssid, NULL);
4152 4153 4154 4155

			if (elems.parse_error)
				break;

4156
			ieee80211_sta_process_chanswitch(sdata,
4157 4158 4159
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4160 4161 4162 4163 4164 4165 4166 4167
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

4168 4169 4170 4171
			/*
			 * extended CSA IE can't be overridden, no need for
			 * BSSID
			 */
4172 4173
			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
4174
				ies_len, true, &elems, mgmt->bssid, NULL);
4175 4176 4177 4178 4179 4180 4181 4182

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
4183
			ieee80211_sta_process_chanswitch(sdata,
4184 4185 4186
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4187
		}
4188
		break;
4189
	}
4190
	sdata_unlock(sdata);
4191 4192
}

4193
static void ieee80211_sta_timer(struct timer_list *t)
4194
{
J
Johannes Berg 已提交
4195
	struct ieee80211_sub_if_data *sdata =
4196
		from_timer(sdata, t, u.mgd.timer);
4197

4198
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
4199 4200
}

4201
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
4202
					  u8 *bssid, u8 reason, bool tx)
4203
{
4204
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4205

4206
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
4207
			       tx, frame_buf);
4208

4209 4210
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    reason);
4211 4212
}

4213
static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4214 4215 4216 4217
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
4218
	u32 tx_flags = 0;
4219 4220
	u16 trans = 1;
	u16 status = 0;
4221
	u16 prepare_tx_duration = 0;
J
Johannes Berg 已提交
4222

4223
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4224 4225 4226 4227 4228 4229 4230

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
4231 4232
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
4233 4234 4235 4236 4237 4238 4239 4240 4241 4242

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

4243 4244 4245 4246 4247
	if (auth_data->algorithm == WLAN_AUTH_SAE)
		prepare_tx_duration =
			jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);

	drv_mgd_prepare_tx(local, sdata, prepare_tx_duration);
J
Johannes Berg 已提交
4248

4249 4250 4251
	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
		   auth_data->bss->bssid, auth_data->tries,
		   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
4252

4253
	auth_data->expected_transaction = 2;
4254

4255 4256 4257 4258 4259
	if (auth_data->algorithm == WLAN_AUTH_SAE) {
		trans = auth_data->sae_trans;
		status = auth_data->sae_status;
		auth_data->expected_transaction = trans;
	}
J
Johannes Berg 已提交
4260

4261 4262 4263
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
4264

4265 4266 4267 4268 4269
	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
			    auth_data->data, auth_data->data_len,
			    auth_data->bss->bssid,
			    auth_data->bss->bssid, NULL, 0, 0,
			    tx_flags);
J
Johannes Berg 已提交
4270

4271
	if (tx_flags == 0) {
4272 4273 4274 4275 4276
		if (auth_data->algorithm == WLAN_AUTH_SAE)
			auth_data->timeout = jiffies +
				IEEE80211_AUTH_TIMEOUT_SAE;
		else
			auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
4277
	} else {
4278 4279
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
4280
	}
J
Johannes Berg 已提交
4281

4282 4283 4284
	auth_data->timeout_started = true;
	run_again(sdata, auth_data->timeout);

J
Johannes Berg 已提交
4285 4286 4287 4288 4289 4290 4291 4292
	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

4293
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4294 4295 4296

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
4297 4298
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
4299 4300 4301 4302 4303 4304 4305 4306 4307 4308

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
4309 4310 4311
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
4312 4313
	ieee80211_send_assoc(sdata);

4314
	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
4315
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
4316
		assoc_data->timeout_started = true;
4317
		run_again(sdata, assoc_data->timeout);
4318
	} else {
4319 4320 4321 4322 4323
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
4324
	}
J
Johannes Berg 已提交
4325 4326 4327 4328

	return 0;
}

4329 4330 4331 4332 4333 4334 4335 4336 4337 4338 4339 4340
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

4341
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4342 4343
{
	struct ieee80211_local *local = sdata->local;
4344
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4345

4346
	sdata_lock(sdata);
4347

4348 4349 4350 4351 4352
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
4353
		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
4354
			if (status_acked) {
4355 4356 4357 4358 4359 4360 4361 4362 4363
				if (ifmgd->auth_data->algorithm ==
				    WLAN_AUTH_SAE)
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SAE;
				else
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SHORT;
4364
				run_again(sdata, ifmgd->auth_data->timeout);
4365 4366 4367
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
4368
			ifmgd->auth_data->timeout_started = true;
4369 4370 4371 4372 4373 4374
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
4375
				run_again(sdata, ifmgd->assoc_data->timeout);
4376 4377 4378
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
4379
			ifmgd->assoc_data->timeout_started = true;
4380 4381 4382
		}
	}

4383
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
4384 4385 4386 4387 4388 4389 4390
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
4391
		} else if (ieee80211_auth(sdata)) {
J
Johannes Berg 已提交
4392
			u8 bssid[ETH_ALEN];
4393 4394 4395 4396 4397
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = AUTH_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4398 4399 4400 4401 4402

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

4403
			cfg80211_auth_timeout(sdata->dev, bssid);
4404
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4405
		}
4406
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
4407
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
4408

4409
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
4410
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
4411
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
4412
		    ieee80211_do_assoc(sdata)) {
4413
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4414 4415 4416 4417 4418
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = ASSOC_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4419

4420
			ieee80211_destroy_assoc_data(sdata, false, false);
4421
			cfg80211_assoc_timeout(sdata->dev, bss);
4422
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4423
		}
4424
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
4425
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
4426

4427
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
4428
	    ifmgd->associated) {
4429
		u8 bssid[ETH_ALEN];
4430
		int max_tries;
4431

4432
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
4433

4434
		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
4435
			max_tries = max_nullfunc_tries;
4436
		else
4437
			max_tries = max_probe_tries;
4438

4439 4440 4441
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
4442 4443
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4444 4445 4446 4447
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
4448 4449
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
4450 4451 4452
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
4453
				ieee80211_sta_connection_lost(sdata, bssid,
4454 4455
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
4456 4457
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
4458
			run_again(sdata, ifmgd->probe_timeout);
4459
		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
J
Johannes Berg 已提交
4460 4461 4462
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
4463
			ieee80211_sta_connection_lost(sdata, bssid,
4464
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
4465
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4466 4467 4468 4469
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
4470 4471
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
4472 4473 4474 4475
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
4476 4477 4478
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, disconnecting.\n",
				 bssid, probe_wait_ms);
4479

4480
			ieee80211_sta_connection_lost(sdata, bssid,
4481
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
4482 4483 4484
		}
	}

4485
	sdata_unlock(sdata);
4486 4487
}

4488
static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4489 4490
{
	struct ieee80211_sub_if_data *sdata =
4491
		from_timer(sdata, t, u.mgd.bcn_mon_timer);
4492
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4493

4494
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4495 4496
		return;

4497
	sdata->u.mgd.connection_loss = false;
4498 4499
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
4500 4501
}

4502
static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4503 4504
{
	struct ieee80211_sub_if_data *sdata =
4505
		from_timer(sdata, t, u.mgd.conn_mon_timer);
J
Johannes Berg 已提交
4506 4507 4508
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

4509
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4510 4511
		return;

4512
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
4513 4514 4515 4516 4517 4518 4519 4520 4521 4522 4523
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
4524 4525
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
4526
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
4527
		__ieee80211_stop_poll(sdata);
4528

J
Johannes Berg 已提交
4529
		/* let's probe the connection once */
4530
		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
4531 4532
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
4533
	}
J
Johannes Berg 已提交
4534
}
4535

4536
#ifdef CONFIG_PM
4537 4538 4539 4540 4541 4542 4543
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

4544 4545 4546 4547 4548
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

4549
		/*
4550 4551 4552
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
4553
		 */
4554
		ieee80211_send_deauth_disassoc(sdata, bssid, bssid,
4555 4556 4557
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
4558
		if (ifmgd->assoc_data)
4559
			ieee80211_destroy_assoc_data(sdata, false, true);
4560 4561
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
4562 4563 4564 4565
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

4566 4567 4568 4569 4570 4571 4572 4573 4574 4575 4576 4577 4578 4579 4580 4581 4582 4583 4584 4585 4586 4587 4588 4589 4590 4591 4592 4593
	/* This is a bit of a hack - we should find a better and more generic
	 * solution to this. Normally when suspending, cfg80211 will in fact
	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
	 * auth (not so important) or assoc (this is the problem) process.
	 *
	 * As a consequence, it can happen that we are in the process of both
	 * associating and suspending, and receive an association response
	 * after cfg80211 has checked if it needs to disconnect, but before
	 * we actually set the flag to drop incoming frames. This will then
	 * cause the workqueue flush to process the association response in
	 * the suspend, resulting in a successful association just before it
	 * tries to remove the interface from the driver, which now though
	 * has a channel context assigned ... this results in issues.
	 *
	 * To work around this (for now) simply deauth here again if we're
	 * now connected.
	 */
	if (ifmgd->associated && !sdata->local->wowlan) {
		u8 bssid[ETH_ALEN];
		struct cfg80211_deauth_request req = {
			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
			.bssid = bssid,
		};

		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
		ieee80211_mgd_deauth(sdata, &req);
	}

4594 4595 4596
	sdata_unlock(sdata);
}

4597 4598 4599 4600
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4601
	sdata_lock(sdata);
4602
	if (!ifmgd->associated) {
4603
		sdata_unlock(sdata);
4604 4605 4606 4607 4608 4609 4610 4611 4612 4613
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4614
		sdata_unlock(sdata);
4615 4616
		return;
	}
4617
	sdata_unlock(sdata);
4618 4619 4620
}
#endif

J
Johannes Berg 已提交
4621 4622
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4623
{
4624
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4625

4626
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4627
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4628
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4629 4630
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4631 4632
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4633
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4634 4635
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4636 4637 4638 4639
	timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
	timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
	timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
	timer_setup(&ifmgd->chswitch_timer, ieee80211_chswitch_timer, 0);
4640 4641
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4642

4643
	ifmgd->flags = 0;
4644
	ifmgd->powersave = sdata->wdev.ps;
4645 4646
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4647
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4648

4649
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4650 4651 4652
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4653 4654 4655 4656 4657

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4658 4659
}

4660 4661
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4662
{
4663
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4664

4665 4666
	/* Restart STA timers */
	rcu_read_lock();
4667 4668 4669 4670
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4671 4672
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4673

J
Johannes Berg 已提交
4674 4675 4676 4677 4678 4679 4680 4681 4682 4683 4684 4685
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4686
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4687 4688 4689 4690 4691 4692 4693 4694 4695 4696 4697 4698
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4699
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4700 4701 4702 4703 4704 4705 4706 4707 4708 4709 4710 4711 4712 4713 4714 4715 4716 4717
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

L
Luca Coelho 已提交
4718 4719 4720 4721 4722 4723
static bool
ieee80211_verify_sta_he_mcs_support(struct ieee80211_supported_band *sband,
				    const struct ieee80211_he_operation *he_op)
{
	const struct ieee80211_sta_he_cap *sta_he_cap =
		ieee80211_get_he_sta_cap(sband);
4724
	u16 ap_min_req_set;
L
Luca Coelho 已提交
4725 4726 4727 4728 4729
	int i;

	if (!sta_he_cap || !he_op)
		return false;

4730 4731
	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);

L
Luca Coelho 已提交
4732 4733 4734 4735 4736 4737 4738 4739 4740 4741 4742 4743 4744 4745 4746 4747 4748 4749 4750 4751 4752 4753 4754 4755 4756 4757 4758 4759 4760 4761 4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779
	/* Need to go over for 80MHz, 160MHz and for 80+80 */
	for (i = 0; i < 3; i++) {
		const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
			&sta_he_cap->he_mcs_nss_supp;
		u16 sta_mcs_map_rx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
		u16 sta_mcs_map_tx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
		u8 nss;
		bool verified = true;

		/*
		 * For each band there is a maximum of 8 spatial streams
		 * possible. Each of the sta_mcs_map_* is a 16-bit struct built
		 * of 2 bits per NSS (1-8), with the values defined in enum
		 * ieee80211_he_mcs_support. Need to make sure STA TX and RX
		 * capabilities aren't less than the AP's minimum requirements
		 * for this HE BSS per SS.
		 * It is enough to find one such band that meets the reqs.
		 */
		for (nss = 8; nss > 0; nss--) {
			u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
			u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
			u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;

			if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
				continue;

			/*
			 * Make sure the HE AP doesn't require MCSs that aren't
			 * supported by the client
			 */
			if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
				verified = false;
				break;
			}
		}

		if (verified)
			return true;
	}

	/* If here, STA doesn't meet AP's HE min requirements */
	return false;
}

4780 4781
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4782 4783 4784
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4785
	const struct ieee80211_ht_cap *ht_cap = NULL;
4786
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4787
	const struct ieee80211_vht_operation *vht_oper = NULL;
L
Luca Coelho 已提交
4788
	const struct ieee80211_he_operation *he_oper = NULL;
4789
	struct ieee80211_supported_band *sband;
4790
	struct cfg80211_chan_def chandef;
J
Johannes Berg 已提交
4791
	int ret;
4792 4793
	u32 i;
	bool have_80mhz;
4794

4795 4796
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4797 4798 4799 4800
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4801 4802 4803 4804 4805 4806 4807 4808 4809 4810 4811 4812 4813
	/* disable HT/VHT/HE if we don't support them */
	if (!sband->ht_cap.ht_supported) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

	if (!sband->vht_cap.vht_supported)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	if (!ieee80211_get_he_sta_cap(sband))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

4814 4815
	rcu_read_lock();

4816
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
4817
		const u8 *ht_oper_ie, *ht_cap_ie;
4818

4819
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4820 4821
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4822

4823 4824 4825 4826 4827
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4828 4829 4830
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4831 4832
	}

4833
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
4834
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4835

4836 4837
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4838 4839 4840 4841
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4842
			sdata_info(sdata,
4843
				   "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4844 4845
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4846
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
4847
		}
4848 4849 4850 4851 4852 4853

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4854 4855
	}

4856
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE)) {
L
Luca Coelho 已提交
4857 4858 4859 4860 4861 4862 4863 4864 4865 4866 4867 4868
		const struct cfg80211_bss_ies *ies;
		const u8 *he_oper_ie;

		ies = rcu_dereference(cbss->ies);
		he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
						  ies->data, ies->len);
		if (he_oper_ie &&
		    he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3]))
			he_oper = (void *)(he_oper_ie + 3);
		else
			he_oper = NULL;

4869
		if (!ieee80211_verify_sta_he_mcs_support(sband, he_oper))
L
Luca Coelho 已提交
4870 4871 4872
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

4873 4874 4875 4876 4877 4878 4879 4880 4881 4882 4883 4884 4885 4886
	/* Allow VHT if at least one channel on the sband supports 80 MHz */
	have_80mhz = false;
	for (i = 0; i < sband->n_channels; i++) {
		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
						IEEE80211_CHAN_NO_80MHZ))
			continue;

		have_80mhz = true;
		break;
	}

	if (!have_80mhz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4887 4888
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
L
Luca Coelho 已提交
4889
						     ht_oper, vht_oper, he_oper,
4890
						     &chandef, false);
4891

J
Johannes Berg 已提交
4892 4893
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4894

4895 4896
	rcu_read_unlock();

4897 4898 4899
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4900
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4901 4902 4903 4904 4905 4906 4907
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4908 4909 4910 4911

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4912
		goto out;
4913

4914
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4915
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4916 4917 4918
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4919 4920
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4921
	return ret;
4922 4923
}

S
Sara Sharon 已提交
4924 4925 4926 4927 4928 4929 4930 4931 4932 4933 4934 4935 4936 4937 4938 4939 4940 4941 4942 4943 4944 4945 4946 4947 4948 4949 4950 4951 4952 4953 4954 4955 4956 4957
static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
			       u8 *dtim_count, u8 *dtim_period)
{
	const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
	const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
					 ies->len);
	const struct ieee80211_tim_ie *tim = NULL;
	const struct ieee80211_bssid_index *idx;
	bool valid = tim_ie && tim_ie[1] >= 2;

	if (valid)
		tim = (void *)(tim_ie + 2);

	if (dtim_count)
		*dtim_count = valid ? tim->dtim_count : 0;

	if (dtim_period)
		*dtim_period = valid ? tim->dtim_period : 0;

	/* Check if value is overridden by non-transmitted profile */
	if (!idx_ie || idx_ie[1] < 3)
		return valid;

	idx = (void *)(idx_ie + 2);

	if (dtim_count)
		*dtim_count = idx->dtim_count;

	if (dtim_period)
		*dtim_period = idx->dtim_period;

	return true;
}

4958
static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
4959 4960
				     struct cfg80211_bss *cbss, bool assoc,
				     bool override)
4961 4962 4963 4964 4965
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
4966
	struct ieee80211_supported_band *sband;
4967
	bool have_sta = false;
4968 4969
	int err;

4970 4971
	sband = local->hw.wiphy->bands[cbss->channel->band];

4972 4973 4974
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

4975 4976 4977 4978
	/* If a reconfig is happening, bail out */
	if (local->in_reconfig)
		return -EBUSY;

4979 4980 4981 4982 4983 4984 4985 4986 4987 4988 4989
	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
4990

4991 4992 4993 4994 4995 4996 4997 4998 4999 5000 5001 5002 5003
	/*
	 * Set up the information for the new channel before setting the
	 * new channel. We can't - completely race-free - change the basic
	 * rates bitmap and the channel (sband) that it refers to, but if
	 * we set it up before we at least avoid calling into the driver's
	 * bss_info_changed() method with invalid information (since we do
	 * call that from changing the channel - only for IDLE and perhaps
	 * some others, but ...).
	 *
	 * So to avoid that, just set up all the new information before the
	 * channel, but tell the driver to apply it only afterwards, since
	 * it might need the new channel for that.
	 */
J
Johannes Berg 已提交
5004
	if (new_sta) {
5005 5006 5007
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
J
Johannes Berg 已提交
5008
		const struct cfg80211_bss_ies *ies;
5009
		int shift = ieee80211_vif_get_shift(&sdata->vif);
5010 5011 5012 5013 5014

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
5015
				    &min_rate, &min_rate_index,
5016
				    shift);
5017 5018 5019 5020 5021 5022 5023 5024 5025 5026

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
		 */
		if (!basic_rates && min_rate_index >= 0) {
J
Johannes Berg 已提交
5027 5028
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
5029 5030 5031
			basic_rates = BIT(min_rate_index);
		}

5032 5033 5034 5035 5036 5037
		if (rates)
			new_sta->sta.supp_rates[cbss->channel->band] = rates;
		else
			sdata_info(sdata,
				   "No rates found, keeping mandatory only\n");

5038 5039 5040
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
5041
		if (cbss->channel->band == NL80211_BAND_2GHZ &&
5042 5043 5044 5045 5046 5047 5048
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

5049 5050
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
5051
		rcu_read_lock();
5052 5053 5054 5055 5056
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
S
Sara Sharon 已提交
5057 5058 5059 5060

			ieee80211_get_dtim(ies,
					   &sdata->vif.bss_conf.sync_dtim_count,
					   NULL);
5061 5062
		} else if (!ieee80211_hw_check(&sdata->local->hw,
					       TIMING_BEACON_ONLY)) {
5063 5064 5065 5066 5067 5068 5069 5070 5071 5072 5073
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
5074
		rcu_read_unlock();
5075
	}
5076

5077 5078 5079 5080 5081 5082 5083 5084 5085 5086 5087 5088 5089 5090
	if (new_sta || override) {
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

	if (new_sta) {
		/*
		 * tell driver about BSSID, basic rates and timing
		 * this was set up above, before setting the channel
		 */
5091
		ieee80211_bss_info_change_notify(sdata,
5092 5093
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
5094 5095

		if (assoc)
J
Johannes Berg 已提交
5096
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
5097

J
Johannes Berg 已提交
5098 5099
		err = sta_info_insert(new_sta);
		new_sta = NULL;
5100
		if (err) {
J
Johannes Berg 已提交
5101 5102 5103
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
5104 5105 5106
			return err;
		}
	} else
5107
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
5108

5109 5110 5111 5112
	/* Cancel scan to ensure that nothing interferes with connection */
	if (local->scanning)
		ieee80211_scan_cancel(local);

5113 5114 5115
	return 0;
}

5116 5117 5118
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
5119
{
J
Johannes Berg 已提交
5120 5121 5122
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
5123
	u16 auth_alg;
J
Johannes Berg 已提交
5124
	int err;
5125
	bool cont_auth;
J
Johannes Berg 已提交
5126 5127

	/* prepare auth data structure */
J
Johannes Berg 已提交
5128

5129 5130 5131 5132 5133
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
5134
		if (fips_enabled)
5135
			return -EOPNOTSUPP;
5136 5137 5138 5139 5140 5141 5142 5143
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
5144 5145 5146
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
5147 5148 5149 5150 5151 5152 5153 5154 5155
	case NL80211_AUTHTYPE_FILS_SK:
		auth_alg = WLAN_AUTH_FILS_SK;
		break;
	case NL80211_AUTHTYPE_FILS_SK_PFS:
		auth_alg = WLAN_AUTH_FILS_SK_PFS;
		break;
	case NL80211_AUTHTYPE_FILS_PK:
		auth_alg = WLAN_AUTH_FILS_PK;
		break;
5156 5157
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
5158
	}
5159

5160
	if (ifmgd->assoc_data)
5161 5162
		return -EBUSY;

5163
	auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
5164
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
5165
	if (!auth_data)
J
Johannes Berg 已提交
5166
		return -ENOMEM;
5167

J
Johannes Berg 已提交
5168
	auth_data->bss = req->bss;
5169

5170
	if (req->auth_data_len >= 4) {
5171 5172 5173 5174 5175 5176
		if (req->auth_type == NL80211_AUTHTYPE_SAE) {
			__le16 *pos = (__le16 *) req->auth_data;

			auth_data->sae_trans = le16_to_cpu(pos[0]);
			auth_data->sae_status = le16_to_cpu(pos[1]);
		}
5177 5178 5179
		memcpy(auth_data->data, req->auth_data + 4,
		       req->auth_data_len - 4);
		auth_data->data_len += req->auth_data_len - 4;
5180 5181
	}

5182 5183 5184 5185 5186 5187 5188
	/* Check if continuing authentication or trying to authenticate with the
	 * same BSS that we were in the process of authenticating with and avoid
	 * removal and re-addition of the STA entry in
	 * ieee80211_prep_connection().
	 */
	cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss;

5189
	if (req->ie && req->ie_len) {
5190 5191 5192
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
5193
	}
5194

J
Johannes Berg 已提交
5195
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
5196 5197 5198
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
5199 5200
	}

J
Johannes Berg 已提交
5201
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
5202

J
Johannes Berg 已提交
5203
	/* try to authenticate/probe */
5204

5205 5206 5207 5208 5209 5210 5211
	if (ifmgd->auth_data) {
		if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
			auth_data->peer_confirmed =
				ifmgd->auth_data->peer_confirmed;
		}
		ieee80211_destroy_auth_data(sdata, cont_auth);
	}
5212

J
Johannes Berg 已提交
5213 5214
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
5215

5216 5217 5218 5219 5220 5221 5222 5223 5224
	/* If this is continuation of an ongoing SAE authentication exchange
	 * (i.e., request to send SAE Confirm) and the peer has already
	 * confirmed, mark authentication completed since we are about to send
	 * out SAE Confirm.
	 */
	if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
	    auth_data->peer_confirmed && auth_data->sae_trans == 2)
		ieee80211_mark_sta_auth(sdata, req->bss->bssid);

5225 5226 5227
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5228 5229 5230
		sdata_info(sdata,
			   "disconnect from AP %pM for new auth to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5231 5232 5233 5234
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5235 5236 5237
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5238
	}
J
Johannes Berg 已提交
5239

J
Johannes Berg 已提交
5240
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
5241

5242
	err = ieee80211_prep_connection(sdata, req->bss, cont_auth, false);
5243
	if (err)
J
Johannes Berg 已提交
5244
		goto err_clear;
J
Johannes Berg 已提交
5245

5246
	err = ieee80211_auth(sdata);
J
Johannes Berg 已提交
5247 5248 5249 5250 5251 5252
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
5253
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
5254
	return 0;
J
Johannes Berg 已提交
5255 5256

 err_clear:
5257
	eth_zero_addr(ifmgd->bssid);
5258
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5259
	ifmgd->auth_data = NULL;
5260 5261 5262
	mutex_lock(&sdata->local->mtx);
	ieee80211_vif_release_channel(sdata);
	mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
5263 5264
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
5265 5266
}

5267 5268
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
5269
{
J
Johannes Berg 已提交
5270
	struct ieee80211_local *local = sdata->local;
5271
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5272
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
5273
	struct ieee80211_mgd_assoc_data *assoc_data;
5274
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
5275
	struct ieee80211_supported_band *sband;
5276
	const u8 *ssidie, *ht_ie, *vht_ie;
5277
	int i, err;
5278
	bool override = false;
5279

J
Johannes Berg 已提交
5280 5281 5282 5283
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

5284 5285
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
5286
	if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
5287 5288 5289 5290 5291 5292 5293 5294
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

5295 5296 5297
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5298 5299 5300
		sdata_info(sdata,
			   "disconnect from AP %pM for new assoc to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5301 5302 5303 5304
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5305 5306 5307
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5308
	}
J
Johannes Berg 已提交
5309 5310 5311 5312

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
5313
	}
5314

J
Johannes Berg 已提交
5315 5316 5317 5318
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
5319

J
Johannes Berg 已提交
5320 5321 5322 5323
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
5324
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
5325
		ieee80211_destroy_auth_data(sdata, match);
5326 5327
	}

J
Johannes Berg 已提交
5328
	/* prepare assoc data */
5329

5330 5331
	ifmgd->beacon_crc_valid = false;

5332 5333 5334
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);

J
Johannes Berg 已提交
5335 5336 5337 5338 5339 5340 5341
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
5342
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
5343 5344
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
5345
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
5346
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5347
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
L
Luca Coelho 已提交
5348
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5349
			netdev_info(sdata->dev,
5350
				    "disabling HT/VHT/HE due to WEP/TKIP use\n");
5351 5352
		}
	}
5353

J
Johannes Berg 已提交
5354 5355
	sband = local->hw.wiphy->bands[req->bss->channel->band];

5356 5357 5358
	/* also disable HT/VHT/HE if the AP doesn't use WMM */
	if (!bss->wmm_used) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5359
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5360 5361 5362
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
		netdev_info(sdata->dev,
			    "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
5363 5364
	}

B
Ben Greear 已提交
5365 5366 5367 5368
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

5369 5370 5371 5372
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

5373
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
5374 5375 5376
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
5377

5378 5379 5380 5381 5382 5383 5384 5385 5386 5387 5388 5389 5390 5391 5392
	if (req->fils_kek) {
		/* should already be checked in cfg80211 - so warn */
		if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
			err = -EINVAL;
			goto err_free;
		}
		memcpy(assoc_data->fils_kek, req->fils_kek,
		       req->fils_kek_len);
		assoc_data->fils_kek_len = req->fils_kek_len;
	}

	if (req->fils_nonces)
		memcpy(assoc_data->fils_nonces, req->fils_nonces,
		       2 * FILS_NONCE_LEN);

J
Johannes Berg 已提交
5393
	assoc_data->bss = req->bss;
5394

J
Johannes Berg 已提交
5395 5396
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
5397
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
5398
		else
5399
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
5400
	} else
5401
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
5402

J
Johannes Berg 已提交
5403 5404 5405
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
5406

5407
	rcu_read_lock();
5408 5409 5410 5411 5412
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
	else
5413
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5414 5415 5416 5417 5418 5419
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
	else
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5420
	rcu_read_unlock();
5421

5422
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
5423
		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
5424 5425 5426
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
5427
	if (bss->wmm_used && bss->uapsd_supported &&
5428
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
5429
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
5430 5431
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
5432
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
5433 5434 5435
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

5436
	if (req->prev_bssid)
J
Johannes Berg 已提交
5437
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
5438 5439 5440 5441 5442 5443 5444 5445 5446

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

5447 5448 5449 5450 5451
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

5452 5453 5454 5455 5456
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

5457 5458
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
5459 5460
	sdata->control_port_over_nl80211 =
					req->crypto.control_port_over_nl80211;
5461 5462
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
5463

J
Johannes Berg 已提交
5464 5465 5466
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
5467
	ifmgd->dtim_period = 0;
5468
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
5469

5470 5471 5472 5473 5474 5475 5476 5477 5478 5479 5480 5481 5482 5483 5484 5485 5486 5487 5488 5489 5490 5491 5492 5493
	/* override HT/VHT configuration only if the AP and we support it */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
		struct ieee80211_sta_ht_cap sta_ht_cap;

		if (req->flags & ASSOC_REQ_DISABLE_HT)
			override = true;

		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

		/* check for 40 MHz disable override */
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
		    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
		    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
			override = true;

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
		    req->flags & ASSOC_REQ_DISABLE_VHT)
			override = true;
	}

	if (req->flags & ASSOC_REQ_DISABLE_HT) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5494
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5495 5496 5497 5498 5499 5500
	}

	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	err = ieee80211_prep_connection(sdata, req->bss, true, override);
5501 5502
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
5503

5504 5505
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
5506

5507
	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
5508 5509 5510 5511 5512 5513 5514 5515
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
5516
		assoc_data->timeout_started = true;
5517 5518
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
S
Sara Sharon 已提交
5519
		const u8 *ie;
5520 5521
		u8 dtim_count = 0;

S
Sara Sharon 已提交
5522 5523 5524
		ieee80211_get_dtim(beacon_ies, &dtim_count,
				   &ifmgd->dtim_period);

5525
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
5526
		assoc_data->timeout = jiffies;
5527
		assoc_data->timeout_started = true;
5528

5529
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5530 5531 5532 5533 5534
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
S
Sara Sharon 已提交
5535 5536 5537 5538 5539 5540 5541 5542 5543 5544 5545

		ie = cfg80211_find_ext_ie(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
					  beacon_ies->data, beacon_ies->len);
		if (ie && ie[1] >= 3)
			sdata->vif.bss_conf.profile_periodicity = ie[4];

		ie = cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY,
				      beacon_ies->data, beacon_ies->len);
		if (ie && ie[1] >= 11 &&
		    (ie[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			sdata->vif.bss_conf.ema_ap = true;
5546 5547
	} else {
		assoc_data->timeout = jiffies;
5548
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
5549
	}
5550 5551
	rcu_read_unlock();

5552
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
5553

P
Paul Stewart 已提交
5554 5555 5556 5557 5558 5559 5560 5561 5562 5563
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
5564 5565
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
5566 5567
	}

5568
	return 0;
J
Johannes Berg 已提交
5569
 err_clear:
5570
	eth_zero_addr(ifmgd->bssid);
5571
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5572 5573 5574 5575
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
5576 5577
}

5578
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
5579
			 struct cfg80211_deauth_request *req)
5580
{
5581
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5582
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5583
	bool tx = !req->local_state_change;
5584

5585 5586 5587 5588 5589 5590
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
5591

5592
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5593
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5594
					       IEEE80211_STYPE_DEAUTH,
5595
					       req->reason_code, tx,
5596
					       frame_buf);
5597
		ieee80211_destroy_auth_data(sdata, false);
5598 5599 5600
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5601

5602
		return 0;
5603 5604
	}

5605 5606 5607 5608 5609 5610 5611
	if (ifmgd->assoc_data &&
	    ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting association with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5612
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5613
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5614 5615 5616
					       IEEE80211_STYPE_DEAUTH,
					       req->reason_code, tx,
					       frame_buf);
5617
		ieee80211_destroy_assoc_data(sdata, false, true);
5618 5619 5620 5621 5622 5623
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
		return 0;
	}

5624 5625
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
5626 5627 5628 5629 5630
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5631 5632
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
5633 5634 5635
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5636 5637
		return 0;
	}
5638

5639
	return -ENOTCONN;
5640
}
5641

5642
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
5643
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
5644
{
5645
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5646
	u8 bssid[ETH_ALEN];
5647
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
5648

J
Johannes Berg 已提交
5649 5650 5651 5652 5653 5654
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
5655
	if (ifmgd->associated != req->bss)
5656 5657
		return -ENOLINK;

J
Johannes Berg 已提交
5658
	sdata_info(sdata,
5659 5660
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
5661

5662
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
5663 5664 5665
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
5666

5667 5668
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    req->reason_code);
5669

5670 5671
	return 0;
}
5672

5673
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
5674 5675 5676
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

5677 5678 5679 5680 5681 5682 5683 5684 5685 5686
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
5687
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5688

5689
	sdata_lock(sdata);
5690 5691
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5692
		ieee80211_destroy_assoc_data(sdata, false, false);
5693 5694
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
5695 5696
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
5697 5698 5699 5700 5701 5702
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
5703 5704 5705
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = NULL;
	ifmgd->assoc_req_ies_len = 0;
5706
	spin_unlock_bh(&ifmgd->teardown_lock);
5707
	del_timer_sync(&ifmgd->timer);
5708
	sdata_unlock(sdata);
5709 5710
}

5711 5712
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
5713
			       s32 rssi_level,
5714 5715 5716 5717
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

5718
	trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
J
Johannes Berg 已提交
5719

5720
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
5721 5722
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
5723 5724 5725 5726 5727 5728 5729 5730 5731 5732

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);