mlme.c 166.3 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-only
2 3
/*
 * BSS client mode implementation
4
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
5 6 7 8
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9
 * Copyright 2013-2014  Intel Mobile Communications GmbH
10
 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
11
 * Copyright (C) 2018 - 2020 Intel Corporation
12 13
 */

14
#include <linux/delay.h>
15
#include <linux/fips.h>
16 17 18 19
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
20
#include <linux/moduleparam.h>
21
#include <linux/rtnetlink.h>
22
#include <linux/crc32.h>
23
#include <linux/slab.h>
24
#include <linux/export.h>
25
#include <net/mac80211.h>
26
#include <asm/unaligned.h>
J
Johannes Berg 已提交
27

28
#include "ieee80211_i.h"
29
#include "driver-ops.h"
J
Johannes Berg 已提交
30 31
#include "rate.h"
#include "led.h"
32
#include "fils_aead.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
37
#define IEEE80211_AUTH_TIMEOUT_SAE	(HZ * 2)
38 39 40
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
41
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
42 43
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
44

45 46 47 48 49 50 51 52 53
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
54 55

/*
56 57 58 59 60 61
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
62
 */
63 64 65 66
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
67

J
Johannes Berg 已提交
68 69 70 71
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
72
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
73 74 75 76 77
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
78 79 80 81 82
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
83

84 85 86 87 88 89
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
90 91 92 93 94 95 96 97 98 99
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
100 101
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
102
{
103
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
104

105 106 107
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
108 109
}

110
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
111
{
112
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
113 114
		return;

115
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
116 117
		return;

J
Johannes Berg 已提交
118
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
119
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
120 121
}

122 123
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
124 125
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

126
	if (unlikely(!ifmgd->associated))
127 128
		return;

129 130
	if (ifmgd->probe_send_count)
		ifmgd->probe_send_count = 0;
131

132
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
133 134
		return;

135
	mod_timer(&ifmgd->conn_mon_timer,
136 137 138
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

139
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
140
{
141
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
142 143
}

144 145 146 147 148 149
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
150
			     const struct ieee80211_he_operation *he_oper,
151
			     struct cfg80211_chan_def *chandef, bool tracking)
152
{
153
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
154
	struct cfg80211_chan_def vht_chandef;
155
	struct ieee80211_sta_ht_cap sta_ht_cap;
156 157
	u32 ht_cfreq, ret;

158 159 160
	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

161
	memset(chandef, 0, sizeof(struct cfg80211_chan_def));
162 163 164
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
165
	chandef->freq1_offset = channel->freq_offset;
166

167
	if (!ht_oper || !sta_ht_cap.ht_supported) {
168 169 170
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
171 172 173 174 175 176 177 178
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
179
	if (!tracking && channel->center_freq != ht_cfreq) {
180 181 182 183 184 185 186
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
187 188 189 190
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
191 192 193
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
194 195 196 197
		goto out;
	}

	/* check 40 MHz support, if we have it */
198
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
199
		ieee80211_chandef_ht_oper(ht_oper, chandef);
200 201 202
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
203 204
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
205 206 207 208 209 210 211 212
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

213
	vht_chandef = *chandef;
L
Luca Coelho 已提交
214 215 216 217 218 219 220 221 222 223 224 225
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && he_oper &&
	    (le32_to_cpu(he_oper->he_oper_params) &
	     IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
		struct ieee80211_vht_operation he_oper_vht_cap;

		/*
		 * Set only first 3 bytes (other 2 aren't used in
		 * ieee80211_chandef_vht_oper() anyway)
		 */
		memcpy(&he_oper_vht_cap, he_oper->optional, 3);
		he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);

226 227
		if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
						&he_oper_vht_cap, ht_oper,
L
Luca Coelho 已提交
228 229 230 231 232 233 234
						&vht_chandef)) {
			if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
				sdata_info(sdata,
					   "HE AP VHT information is invalid, disable HE\n");
			ret = IEEE80211_STA_DISABLE_HE;
			goto out;
		}
235 236
	} else if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_oper,
					       ht_oper, &vht_chandef)) {
237
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
238
			sdata_info(sdata,
239
				   "AP VHT information is invalid, disable VHT\n");
240 241 242 243 244
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
245
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
246 247
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
248 249 250 251 252 253 254 255 256 257
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
258
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
259 260
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
261 262 263 264 265 266 267 268 269
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

292 293 294 295
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

296 297 298 299 300 301 302 303
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
304
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
305 306
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
307 308
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
309 310
			      IEEE80211_STA_DISABLE_VHT |
			      IEEE80211_STA_DISABLE_HE;
311
			break;
312 313
		}

314
		ret |= ieee80211_chandef_downgrade(chandef);
315 316
	}

317 318
	if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
						 IEEE80211_CHAN_NO_HE))
319 320
		ret |= IEEE80211_STA_DISABLE_HE;

321
	if (chandef->width != vht_chandef.width && !tracking)
322 323 324 325 326 327 328
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

329 330
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
331
			       const struct ieee80211_ht_cap *ht_cap,
332 333
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
334
			       const struct ieee80211_he_operation *he_oper,
335
			       const u8 *bssid, u32 *changed)
336 337
{
	struct ieee80211_local *local = sdata->local;
338
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
L
Luca Coelho 已提交
339 340 341
	struct ieee80211_channel *chan = sdata->vif.bss_conf.chandef.chan;
	struct ieee80211_supported_band *sband =
		local->hw.wiphy->bands[chan->band];
342
	struct cfg80211_chan_def chandef;
343
	u16 ht_opmode;
344 345 346
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
347

348 349
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
350 351
		return 0;

352 353 354 355
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

L
Luca Coelho 已提交
356 357 358 359 360
	/* don't check HE if we associated as non-HE station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HE ||
	    !ieee80211_get_he_sta_cap(sband))
		he_oper = NULL;

361 362 363
	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

364 365 366 367 368 369 370 371 372 373
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

L
Luca Coelho 已提交
374
	/* calculate new channel (type) based on HT/VHT/HE operation IEs */
375
	flags = ieee80211_determine_chantype(sdata, sband, chan,
L
Luca Coelho 已提交
376
					     ht_oper, vht_oper, he_oper,
377
					     &chandef, true);
378 379 380 381 382 383 384 385 386 387

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
388
		flags |= ieee80211_chandef_downgrade(&chandef);
389 390
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
391
		flags |= ieee80211_chandef_downgrade(&chandef);
392 393
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
394
		flags |= ieee80211_chandef_downgrade(&chandef);
395 396 397 398 399

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
400 401 402 403 404 405
		   "AP %pM changed bandwidth, new config is %d.%03d MHz, "
		   "width %d (%d.%03d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq,
		   chandef.chan->freq_offset, chandef.width,
		   chandef.center_freq1, chandef.freq1_offset,
		   chandef.center_freq2);
406 407 408

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
409
				      IEEE80211_STA_DISABLE_HE |
410 411 412 413 414 415 416 417 418 419 420 421 422 423 424
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
425
	case NL80211_CHAN_WIDTH_40:
426
		new_sta_bw = IEEE80211_STA_RX_BW_40;
427
		break;
428 429 430 431 432 433
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
434
		break;
435 436
	default:
		return -EINVAL;
437
	}
438

439 440
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
441

442 443 444 445 446
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
447

448 449 450 451 452 453 454
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
455

456 457 458 459
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
460
	}
461

462
	return 0;
463 464
}

J
Johannes Berg 已提交
465 466
/* frame sending functions */

J
Johannes Berg 已提交
467
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
468
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

486
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
487 488 489 490 491 492 493 494 495 496 497 498 499 500
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

501 502 503 504 505 506 507 508 509 510
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
511 512 513 514 515 516
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
517
		/* fall through */
J
Johannes Berg 已提交
518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

537 538 539 540
/* This function determines vht capability flags for the association
 * and builds the IE.
 * Note - the function may set the owner of the MU-MIMO capability
 */
541 542
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
543 544
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
545
{
546
	struct ieee80211_local *local = sdata->local;
547 548 549
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
550
	u32 mask, ap_bf_sts, our_bf_sts;
551 552 553 554

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
555
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
556 557 558 559

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
560
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
561 562 563 564 565 566
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
567 568 569 570
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
571
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
572 573
	}

574 575 576 577 578 579
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597
		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
	else if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

	/*
	 * If some other vif is using the MU-MIMO capablity we cannot associate
	 * using MU-MIMO - this will lead to contradictions in the group-id
	 * mechanism.
	 * Ownership is defined since association request, in order to avoid
	 * simultaneous associations with MU-MIMO.
	 */
	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
		bool disable_mu_mimo = false;
		struct ieee80211_sub_if_data *other;

		list_for_each_entry_rcu(other, &local->interfaces, list) {
598
			if (other->vif.mu_mimo_owner) {
599 600 601 602 603 604 605
				disable_mu_mimo = true;
				break;
			}
		}
		if (disable_mu_mimo)
			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
		else
606
			sdata->vif.mu_mimo_owner = true;
607
	}
608

609 610 611 612 613 614 615 616 617 618
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

619
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
620
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
621 622 623
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

L
Luca Coelho 已提交
624 625 626 627 628 629 630 631 632
/* This function determines HE capability flags for the association
 * and builds the IE.
 */
static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
				struct sk_buff *skb,
				struct ieee80211_supported_band *sband)
{
	u8 *pos;
	const struct ieee80211_sta_he_cap *he_cap = NULL;
633
	struct ieee80211_chanctx_conf *chanctx_conf;
L
Luca Coelho 已提交
634
	u8 he_cap_size;
635 636 637 638 639 640 641 642 643 644
	bool reg_cap = false;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!WARN_ON_ONCE(!chanctx_conf))
		reg_cap = cfg80211_chandef_usable(sdata->wdev.wiphy,
						  &chanctx_conf->def,
						  IEEE80211_CHAN_NO_HE);

	rcu_read_unlock();
L
Luca Coelho 已提交
645 646

	he_cap = ieee80211_get_he_sta_cap(sband);
647
	if (!he_cap || !reg_cap)
L
Luca Coelho 已提交
648 649 650 651 652 653 654 655 656 657 658 659 660
		return;

	/*
	 * TODO: the 1 added is because this temporarily is under the EXTENSION
	 * IE. Get rid of it when it moves.
	 */
	he_cap_size =
		2 + 1 + sizeof(he_cap->he_cap_elem) +
		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
		ieee80211_he_ppe_size(he_cap->ppe_thres[0],
				      he_cap->he_cap_elem.phy_cap_info);
	pos = skb_put(skb, he_cap_size);
	ieee80211_ie_build_he_cap(pos, he_cap, pos + he_cap_size);
661 662

	ieee80211_ie_build_he_6ghz_cap(sdata, skb);
L
Luca Coelho 已提交
663 664
}

J
Johannes Berg 已提交
665 666 667 668 669 670 671
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
672
	u8 *pos, qos_info, *ie_start;
J
Johannes Berg 已提交
673
	size_t offset = 0, noffset;
674
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
675 676
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
677 678
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
679
	u32 rates = 0;
680 681 682 683 684 685 686
	struct element *ext_capa = NULL;

	/* we know it's writable, cast away the const */
	if (assoc_data->ie_len)
		ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
						      assoc_data->ie,
						      assoc_data->ie_len);
J
Johannes Berg 已提交
687

688
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
689

J
Johannes Berg 已提交
690 691 692 693 694 695
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
696
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
697 698
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
699
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
700 701 702 703 704 705 706 707

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
708 709 710 711
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
712 713 714 715 716 717
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
718 719 720 721 722
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
723 724 725 726 727 728 729 730 731
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
732
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
L
Luca Coelho 已提交
733 734 735
			2 + 1 + sizeof(struct ieee80211_he_cap_elem) + /* HE */
				sizeof(struct ieee80211_he_mcs_nss_supp) +
				IEEE80211_HE_PPE_THRES_MAX_LEN +
736
			2 + 1 + sizeof(struct ieee80211_he_6ghz_capa) +
J
Johannes Berg 已提交
737
			assoc_data->ie_len + /* extra IEs */
738
			(assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
J
Johannes Berg 已提交
739 740 741 742 743 744 745 746 747
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

748
	if (sband->band == NL80211_BAND_2GHZ) {
749 750
		capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
J
Johannes Berg 已提交
751 752 753 754 755 756
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
757
	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
J
Johannes Berg 已提交
758 759
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

760 761 762
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

763
	mgmt = skb_put_zero(skb, 24);
J
Johannes Berg 已提交
764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
788
	ie_start = pos;
J
Johannes Berg 已提交
789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
805 806 807
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
808 809 810 811 812 813 814 815 816 817 818 819
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
820 821 822 823
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
824 825 826 827
			}
		}
	}

828 829
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
830 831 832 833
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
834 835
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
836
	}
J
Johannes Berg 已提交
837

838 839 840 841 842 843 844 845 846
	/*
	 * Per spec, we shouldn't include the list of channels if we advertise
	 * support for extended channel switching, but we've always done that;
	 * (for now?) apply this restriction only on the (new) 6 GHz band.
	 */
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
	    (sband->band != NL80211_BAND_6GHZ ||
	     !ext_capa || ext_capa->datalen < 1 ||
	     !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
J
Johannes Berg 已提交
847 848 849 850 851 852 853 854 855 856 857
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

858 859
	/* Set MBSSID support for HE AP if needed */
	if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
860 861 862
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && assoc_data->ie_len &&
	    ext_capa && ext_capa->datalen >= 3)
		ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
863

J
Johannes Berg 已提交
864
	/* if present, add any custom IEs that go before HT */
865
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
866 867 868 869 870 871 872 873 874 875
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
876 877
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
878 879
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
880 881 882 883
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
884
			/* luckily this is almost always there */
885 886 887 888
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
889
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
890 891 892 893 894 895 896 897 898 899 900
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
901
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
902 903 904
		offset = noffset;
	}

J
Johannes Berg 已提交
905 906 907 908
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

909
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
910
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
911
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
912

913 914 915
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
916 917 918 919
			/*
			 * no need to list the ones split off before HT
			 * or generated here
			 */
920 921 922 923 924
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
925
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
926
		};
927 928

		/* RIC already taken above, so no need to handle here anymore */
929 930 931
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
932
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
933 934 935
		offset = noffset;
	}

L
Luca Coelho 已提交
936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962
	/* if present, add any custom IEs that go before HE */
	if (assoc_data->ie_len) {
		static const u8 before_he[] = {
			/*
			 * no need to list the ones split off before VHT
			 * or generated here
			 */
			WLAN_EID_OPMODE_NOTIF,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
			/* 11ai elements */
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
			/* TODO: add 11ah/11aj/11ak elements */
		};

		/* RIC already taken above, so no need to handle here anymore */
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_he, ARRAY_SIZE(before_he),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

963
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
964 965
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
966

967 968 969 970 971 972 973 974 975
	/*
	 * If AP doesn't support HT, mark HE as disabled.
	 * If on the 5GHz band, make sure it supports VHT.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT ||
	    (sband->band == NL80211_BAND_5GHZ &&
	     ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

L
Luca Coelho 已提交
976 977 978 979
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		ieee80211_add_he_ie(sdata, skb, sband);

	/* if present, add any custom non-vendor IEs that go after HE */
980
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
981 982 983
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
984
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
985 986 987
		offset = noffset;
	}

988 989
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
990 991
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
992 993 994 995 996
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

997
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
998 999 1000
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
1001
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
1002
		noffset = assoc_data->ie_len;
1003
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
1004 1005
	}

1006 1007 1008 1009 1010 1011
	if (assoc_data->fils_kek_len &&
	    fils_encrypt_assoc_req(skb, assoc_data) < 0) {
		dev_kfree_skb(skb);
		return;
	}

1012 1013 1014 1015 1016
	pos = skb_tail_pointer(skb);
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
	ifmgd->assoc_req_ies_len = pos - ie_start;

1017
	drv_mgd_prepare_tx(local, sdata, 0);
J
Johannes Berg 已提交
1018

J
Johannes Berg 已提交
1019
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1020
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1021 1022
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
1023 1024 1025
	ieee80211_tx_skb(sdata, skb);
}

1026 1027 1028 1029 1030 1031
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

1032 1033
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
1034 1035
		return;

1036 1037
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1038

1039 1040
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
1041 1042
}

1043 1044
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
1045
			     bool powersave)
1046 1047
{
	struct sk_buff *skb;
1048
	struct ieee80211_hdr_3addr *nullfunc;
1049
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1050

L
Luca Coelho 已提交
1051 1052 1053 1054 1055
	/* Don't send NDPs when STA is connected HE */
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		return;

1056 1057
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
		!ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
1058
	if (!skb)
1059 1060
		return;

1061
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1062
	if (powersave)
1063
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1064

1065 1066
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1067

1068
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1069 1070
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

1071
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1072 1073
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

1074
	ieee80211_tx_skb(sdata, skb);
1075 1076
}

1077 1078 1079 1080 1081 1082 1083 1084 1085 1086
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

L
Luca Coelho 已提交
1087 1088 1089 1090
	/* Don't send NDPs when connected HE */
	if (!(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
		return;

1091
	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1092
	if (!skb)
1093
		return;
1094

1095 1096
	skb_reserve(skb, local->hw.extra_tx_headroom);

1097
	nullfunc = skb_put_zero(skb, 30);
1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

1110 1111 1112 1113 1114
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
1115
	struct ieee80211_local *local = sdata->local;
1116
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1117
	int ret;
1118

1119
	if (!ieee80211_sdata_running(sdata))
1120 1121
		return;

1122
	sdata_lock(sdata);
1123 1124 1125
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

1126 1127
	if (!ifmgd->associated)
		goto out;
1128

1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
1140 1141 1142 1143
		struct ieee80211_supported_band *sband = NULL;
		struct sta_info *mgd_sta = NULL;
		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;

1144 1145 1146 1147 1148 1149 1150 1151
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193
		if (sdata->vif.bss_conf.chandef.width !=
		    sdata->csa_chandef.width) {
			/*
			 * For managed interface, we need to also update the AP
			 * station bandwidth and align the rate scale algorithm
			 * on the bandwidth change. Here we only consider the
			 * bandwidth of the new channel definition (as channel
			 * switch flow does not have the full HT/VHT/HE
			 * information), assuming that if additional changes are
			 * required they would be done as part of the processing
			 * of the next beacon from the AP.
			 */
			switch (sdata->csa_chandef.width) {
			case NL80211_CHAN_WIDTH_20_NOHT:
			case NL80211_CHAN_WIDTH_20:
			default:
				bw = IEEE80211_STA_RX_BW_20;
				break;
			case NL80211_CHAN_WIDTH_40:
				bw = IEEE80211_STA_RX_BW_40;
				break;
			case NL80211_CHAN_WIDTH_80:
				bw = IEEE80211_STA_RX_BW_80;
				break;
			case NL80211_CHAN_WIDTH_80P80:
			case NL80211_CHAN_WIDTH_160:
				bw = IEEE80211_STA_RX_BW_160;
				break;
			}

			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
			sband =
				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
		}

		if (sdata->vif.bss_conf.chandef.width >
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1194 1195 1196 1197 1198 1199 1200 1201 1202 1203
		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

1204 1205 1206 1207 1208 1209 1210
		if (sdata->vif.bss_conf.chandef.width <
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1211 1212 1213 1214 1215
		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1216
		sdata_info(sdata,
1217
			   "failed to finalize channel switch, disconnecting\n");
1218 1219 1220 1221
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1222

1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1243

1244 1245 1246 1247 1248
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1249

1250 1251 1252
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1253 1254 1255 1256 1257 1258
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1259
		return;
1260
	}
1261 1262

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1263 1264
}

1265 1266
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1267 1268
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1269 1270 1271

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1272 1273 1274 1275 1276 1277
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1278 1279 1280 1281
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1282
static void ieee80211_chswitch_timer(struct timer_list *t)
1283 1284
{
	struct ieee80211_sub_if_data *sdata =
1285
		from_timer(sdata, t, u.mgd.chswitch_timer);
1286

1287
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1288 1289
}

1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315
static void
ieee80211_sta_abort_chanswitch(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;

	if (!local->ops->abort_channel_switch)
		return;

	mutex_lock(&local->mtx);

	mutex_lock(&local->chanctx_mtx);
	ieee80211_vif_unreserve_chanctx(sdata);
	mutex_unlock(&local->chanctx_mtx);

	if (sdata->csa_block_tx)
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);

	sdata->csa_block_tx = false;
	sdata->vif.csa_active = false;

	mutex_unlock(&local->mtx);

	drv_abort_channel_switch(sdata);
}

1316
static void
J
Johannes Berg 已提交
1317
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1318 1319
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1320
				 bool beacon)
1321
{
1322
	struct ieee80211_local *local = sdata->local;
1323
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1324
	struct cfg80211_bss *cbss = ifmgd->associated;
1325
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1326
	struct ieee80211_chanctx *chanctx;
1327
	enum nl80211_band current_band;
1328
	struct ieee80211_csa_ie csa_ie;
1329
	struct ieee80211_channel_switch ch_switch;
1330
	int res;
1331

1332
	sdata_assert_lock(sdata);
1333

1334
	if (!cbss)
1335 1336
		return;

1337
	if (local->scanning)
1338 1339
		return;

1340
	current_band = cbss->channel->band;
1341
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1342
					   ifmgd->flags,
1343
					   ifmgd->associated->bssid, &csa_ie);
1344 1345 1346 1347

	if (!res) {
		ch_switch.timestamp = timestamp;
		ch_switch.device_timestamp = device_timestamp;
1348
		ch_switch.block_tx = csa_ie.mode;
1349 1350 1351 1352 1353
		ch_switch.chandef = csa_ie.chandef;
		ch_switch.count = csa_ie.count;
		ch_switch.delay = csa_ie.max_switch_time;
	}

1354
	if (res < 0) {
1355
		ieee80211_queue_work(&local->hw,
1356
				     &ifmgd->csa_connection_drop_work);
1357
		return;
1358 1359
	}

1360 1361 1362 1363 1364
	if (beacon && sdata->vif.csa_active && !ifmgd->csa_waiting_bcn) {
		if (res)
			ieee80211_sta_abort_chanswitch(sdata);
		else
			drv_channel_switch_rx_beacon(sdata, &ch_switch);
1365 1366 1367 1368 1369
		return;
	} else if (sdata->vif.csa_active || res) {
		/* disregard subsequent announcements if already processing */
		return;
	}
1370

1371
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1372 1373
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
1374 1375 1376
			   "AP %pM switches to unsupported channel "
			   "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
			   "disconnecting\n",
1377
			   ifmgd->associated->bssid,
1378
			   csa_ie.chandef.chan->center_freq,
1379
			   csa_ie.chandef.chan->freq_offset,
1380
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1381
			   csa_ie.chandef.freq1_offset,
1382
			   csa_ie.chandef.center_freq2);
1383 1384 1385 1386 1387
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1388
	if (cfg80211_chandef_identical(&csa_ie.chandef,
1389 1390
				       &sdata->vif.bss_conf.chandef) &&
	    (!csa_ie.mode || !beacon)) {
1391 1392 1393 1394 1395 1396 1397 1398 1399
		if (ifmgd->csa_ignored_same_chan)
			return;
		sdata_info(sdata,
			   "AP %pM tries to chanswitch to same channel, ignore\n",
			   ifmgd->associated->bssid);
		ifmgd->csa_ignored_same_chan = true;
		return;
	}

1400 1401 1402 1403 1404 1405 1406 1407
	/*
	 * Drop all TDLS peers - either we disconnect or move to a different
	 * channel from this point on. There's no telling what our peer will do.
	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
	 * have an incompatible wider chandef.
	 */
	ieee80211_teardown_tdls_peers(sdata);

1408
	mutex_lock(&local->mtx);
1409
	mutex_lock(&local->chanctx_mtx);
1410 1411 1412 1413 1414
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
1415
		goto drop_connection;
1416 1417 1418 1419
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1420
	if (local->use_chanctx &&
1421
	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1422 1423
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
1424
		goto drop_connection;
J
Johannes Berg 已提交
1425 1426
	}

1427 1428 1429
	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
1430
		goto drop_connection;
1431 1432
	}

1433 1434 1435
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1436
		sdata_info(sdata,
1437 1438
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1439
		goto drop_connection;
J
Johannes Berg 已提交
1440
	}
1441
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1442

1443
	sdata->vif.csa_active = true;
1444
	sdata->csa_chandef = csa_ie.chandef;
1445
	sdata->csa_block_tx = csa_ie.mode;
1446
	ifmgd->csa_ignored_same_chan = false;
J
Johannes Berg 已提交
1447

1448
	if (sdata->csa_block_tx)
1449 1450
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1451
	mutex_unlock(&local->mtx);
1452

1453 1454 1455
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1456
	if (local->ops->channel_switch) {
1457
		/* use driver's channel switch callback */
1458
		drv_channel_switch(local, sdata, &ch_switch);
1459 1460 1461 1462
		return;
	}

	/* channel switch handled in software */
1463
	if (csa_ie.count <= 1)
1464
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1465
	else
1466
		mod_timer(&ifmgd->chswitch_timer,
1467 1468
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1469 1470
	return;
 drop_connection:
1471 1472 1473 1474 1475 1476 1477 1478
	/*
	 * This is just so that the disconnect flow will know that
	 * we were trying to switch channel and failed. In case the
	 * mode is 1 (we are not allowed to Tx), we will know not to
	 * send a deauthentication frame. Those two fields will be
	 * reset when the disconnection worker runs.
	 */
	sdata->vif.csa_active = true;
1479
	sdata->csa_block_tx = csa_ie.mode;
1480

1481 1482 1483
	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
1484 1485
}

1486 1487 1488 1489 1490 1491
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1492
{
1493 1494
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1495
	int i, chan_increment;
1496
	bool have_chan_pwr = false;
1497

1498 1499
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1500
		return false;
1501

1502 1503 1504 1505 1506 1507 1508
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
1509 1510
	case NL80211_BAND_2GHZ:
	case NL80211_BAND_60GHZ:
1511 1512
		chan_increment = 1;
		break;
1513
	case NL80211_BAND_5GHZ:
1514 1515
		chan_increment = 4;
		break;
1516
	}
1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1528
				*chan_pwr = triplet->chans.max_power;
1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1540
	if (have_chan_pwr && pwr_constr_elem)
1541
		*pwr_reduction = *pwr_constr_elem;
1542 1543 1544
	else
		*pwr_reduction = 0;

1545 1546 1547
	return have_chan_pwr;
}

1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1562 1563 1564 1565
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1566 1567
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1568
{
1569 1570 1571
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1572
	int new_ap_level;
1573
	__le16 capab = mgmt->u.probe_resp.capab_info;
1574

1575 1576 1577
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1578 1579 1580
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1581 1582 1583 1584 1585 1586 1587 1588
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1589
	}
1590

1591
	if (!has_80211h_pwr && !has_cisco_pwr)
1592
		return 0;
1593

1594 1595 1596 1597 1598
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1599 1600 1601 1602 1603
		new_ap_level = pwr_level_80211h;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1604 1605 1606 1607
		sdata_dbg(sdata,
			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			  sdata->u.mgd.bssid);
1608
	} else {  /* has_cisco_pwr is always true here. */
1609 1610 1611 1612 1613
		new_ap_level = pwr_level_cisco;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1614 1615 1616
		sdata_dbg(sdata,
			  "Limiting TX power to %d dBm as advertised by %pM\n",
			  pwr_level_cisco, sdata->u.mgd.bssid);
1617
	}
1618

1619 1620 1621 1622
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1623 1624
}

1625 1626 1627 1628 1629 1630
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1631 1632 1633 1634
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1635
	if (local->scanning)
J
Johannes Berg 已提交
1636 1637
		return;

1638
	if (conf->dynamic_ps_timeout > 0 &&
1639
	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1640 1641 1642
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
1643
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1644
			ieee80211_send_nullfunc(local, sdata, true);
1645

1646 1647
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1648 1649 1650 1651
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1669 1670 1671 1672
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1673
	bool authorized = false;
1674 1675 1676 1677

	if (!mgd->powersave)
		return false;

1678 1679 1680
	if (mgd->broken_ap)
		return false;

1681 1682 1683
	if (!mgd->associated)
		return false;

1684
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1685 1686
		return false;

1687
	if (!mgd->have_beacon)
1688 1689
		return false;

1690 1691 1692
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1693
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1694 1695
	rcu_read_unlock();

J
Johannes Berg 已提交
1696
	return authorized;
1697 1698
}

1699
/* need to hold RTNL or interface lock */
J
Johannes Berg 已提交
1700
void ieee80211_recalc_ps(struct ieee80211_local *local)
1701 1702 1703
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1704
	int timeout;
1705

1706
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1707 1708 1709 1710 1711
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1712
		if (!ieee80211_sdata_running(sdata))
1713
			continue;
1714 1715 1716 1717 1718 1719 1720 1721
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1722 1723 1724 1725 1726 1727
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1728
	if (count == 1 && ieee80211_powersave_allowed(found)) {
J
Johannes Berg 已提交
1729
		u8 dtimper = found->u.mgd.dtim_period;
1730

1731
		timeout = local->dynamic_ps_forced_timeout;
J
Johannes Berg 已提交
1732 1733
		if (timeout < 0)
			timeout = 100;
1734
		local->hw.conf.dynamic_ps_timeout = timeout;
1735

J
Johannes Berg 已提交
1736 1737 1738 1739 1740 1741
		/* If the TIM IE is invalid, pretend the value is 1 */
		if (!dtimper)
			dtimper = 1;

		local->hw.conf.ps_dtim_period = dtimper;
		local->ps_sdata = found;
1742
	} else {
1743
		local->ps_sdata = NULL;
1744
	}
1745 1746 1747 1748

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1749 1750 1751 1752 1753 1754 1755 1756 1757 1758
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1771
					IEEE80211_MAX_QUEUE_MAP,
1772 1773
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1774 1775 1776 1777 1778 1779 1780 1781
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1782
	struct ieee80211_if_managed *ifmgd;
1783 1784
	unsigned long flags;
	int q;
1785 1786 1787 1788 1789

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1790 1791
	ifmgd = &sdata->u.mgd;

1792 1793 1794
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1795
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1796 1797
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1798 1799 1800 1801 1802
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1821 1822
	}

1823
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1824
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1825
		if (drv_tx_frames_pending(local)) {
1826 1827 1828
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1829
		} else {
1830
			ieee80211_send_nullfunc(local, sdata, true);
1831
			/* Flush to get the tx status of nullfunc frame */
1832
			ieee80211_flush_queues(local, sdata, false);
1833
		}
1834 1835
	}

1836 1837
	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1838 1839 1840 1841 1842
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1843 1844
}

1845
void ieee80211_dynamic_ps_timer(struct timer_list *t)
1846
{
1847
	struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
1848

1849
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1850 1851
}

1852 1853
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
1854
	struct delayed_work *delayed_work = to_delayed_work(work);
1855 1856 1857
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1858
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1859

1860 1861 1862 1863 1864 1865 1866 1867
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1868 1869
}

1870 1871 1872 1873 1874
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1875
	bool ret = false;
1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
1920 1921 1922 1923 1924 1925
			/* Usually the loop will result in using BK even if it
			 * requires admission control, but such a configuration
			 * makes no sense and we have to transmit somehow - the
			 * AC selection does the same thing.
			 * If we started out trying to downgrade from BK, then
			 * the extra condition here might be needed.
1926
			 */
1927 1928
			if (non_acm_ac >= IEEE80211_NUM_ACS)
				non_acm_ac = IEEE80211_AC_BK;
1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1963
/* MLME */
L
Luca Coelho 已提交
1964 1965 1966 1967 1968
static bool
ieee80211_sta_wmm_params(struct ieee80211_local *local,
			 struct ieee80211_sub_if_data *sdata,
			 const u8 *wmm_param, size_t wmm_param_len,
			 const struct ieee80211_mu_edca_param_set *mu_edca)
1969
{
1970
	struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1971
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1972
	size_t left;
1973
	int count, mu_edca_count, ac;
J
Johannes Berg 已提交
1974 1975
	const u8 *pos;
	u8 uapsd_queues = 0;
1976

1977
	if (!local->ops->conf_tx)
1978
		return false;
1979

J
Johannes Berg 已提交
1980
	if (local->hw.queues < IEEE80211_NUM_ACS)
1981
		return false;
1982 1983

	if (!wmm_param)
1984
		return false;
1985

1986
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1987
		return false;
K
Kalle Valo 已提交
1988 1989

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1990
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
1991

1992
	count = wmm_param[6] & 0x0f;
1993 1994 1995 1996 1997 1998 1999
	/* -1 is the initial value of ifmgd->mu_edca_last_param_set.
	 * if mu_edca was preset before and now it disappeared tell
	 * the driver about it.
	 */
	mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
	if (count == ifmgd->wmm_last_param_set &&
	    mu_edca_count == ifmgd->mu_edca_last_param_set)
2000
		return false;
2001
	ifmgd->wmm_last_param_set = count;
2002
	ifmgd->mu_edca_last_param_set = mu_edca_count;
2003 2004 2005 2006 2007 2008

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
2009
	sdata->wmm_acm = 0;
2010 2011 2012
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
2013
		bool uapsd = false;
2014 2015

		switch (aci) {
2016
		case 1: /* AC_BK */
2017
			ac = IEEE80211_AC_BK;
J
Johannes Berg 已提交
2018
			if (acm)
Y
Yoni Divinsky 已提交
2019
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
2020 2021
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
L
Luca Coelho 已提交
2022 2023 2024
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2025
			break;
2026
		case 2: /* AC_VI */
2027
			ac = IEEE80211_AC_VI;
J
Johannes Berg 已提交
2028
			if (acm)
Y
Yoni Divinsky 已提交
2029
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
2030 2031
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
L
Luca Coelho 已提交
2032 2033 2034
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2035
			break;
2036
		case 3: /* AC_VO */
2037
			ac = IEEE80211_AC_VO;
J
Johannes Berg 已提交
2038
			if (acm)
Y
Yoni Divinsky 已提交
2039
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
2040 2041
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
L
Luca Coelho 已提交
2042 2043 2044
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2045
			break;
2046
		case 0: /* AC_BE */
2047
		default:
2048
			ac = IEEE80211_AC_BE;
J
Johannes Berg 已提交
2049
			if (acm)
Y
Yoni Divinsky 已提交
2050
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
2051 2052
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
L
Luca Coelho 已提交
2053 2054 2055
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_be;
2056 2057 2058
			break;
		}

2059
		params[ac].aifs = pos[0] & 0x0f;
2060

2061
		if (params[ac].aifs < 2) {
2062 2063
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2064 2065
				   params[ac].aifs, aci);
			params[ac].aifs = 2;
2066
		}
2067 2068 2069 2070 2071
		params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
		params[ac].txop = get_unaligned_le16(pos + 2);
		params[ac].acm = acm;
		params[ac].uapsd = uapsd;
K
Kalle Valo 已提交
2072

2073
		if (params[ac].cw_min == 0 ||
2074
		    params[ac].cw_min > params[ac].cw_max) {
2075 2076 2077 2078 2079
			sdata_info(sdata,
				   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
				   params[ac].cw_min, params[ac].cw_max, aci);
			return false;
		}
2080
		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2081 2082
	}

2083 2084 2085 2086 2087 2088 2089 2090 2091 2092
	/* WMM specification requires all 4 ACIs. */
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		if (params[ac].cw_min == 0) {
			sdata_info(sdata,
				   "AP has invalid WMM params (missing AC %d), using defaults\n",
				   ac);
			return false;
		}
	}

2093
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
J
Johannes Berg 已提交
2094
		mlme_dbg(sdata,
2095 2096 2097 2098 2099 2100 2101 2102
			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
			 ac, params[ac].acm,
			 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
			 params[ac].txop, params[ac].uapsd,
			 ifmgd->tx_tspec[ac].downgraded);
		sdata->tx_conf[ac] = params[ac];
		if (!ifmgd->tx_tspec[ac].downgraded &&
		    drv_conf_tx(local, sdata, ac, &params[ac]))
J
Johannes Berg 已提交
2103
			sdata_err(sdata,
2104 2105
				  "failed to set TX queue parameters for AC %d\n",
				  ac);
2106
	}
2107 2108

	/* enable WMM or activate new settings */
2109
	sdata->vif.bss_conf.qos = true;
2110
	return true;
2111 2112
}

2113 2114 2115 2116
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

2117
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2118 2119 2120 2121 2122 2123 2124 2125 2126 2127
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
2128 2129
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
2130
{
J
Johannes Berg 已提交
2131
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2132
	struct ieee80211_supported_band *sband;
2133
	u32 changed = 0;
J
Johannes Berg 已提交
2134 2135 2136 2137
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

2138 2139 2140 2141
	sband = ieee80211_get_sband(sdata);
	if (!sband)
		return changed;

J
Johannes Berg 已提交
2142 2143 2144 2145 2146 2147 2148 2149 2150
	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2151
	if (sband->band == NL80211_BAND_5GHZ)
2152
		use_short_slot = true;
2153

2154 2155 2156
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
2157
	}
2158

2159 2160
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
2161
		changed |= BSS_CHANGED_ERP_PREAMBLE;
2162
	}
2163

J
Johannes Berg 已提交
2164 2165 2166
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
2167 2168 2169 2170 2171
	}

	return changed;
}

2172
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2173
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2174
				     u32 bss_info_changed)
2175
{
2176
	struct ieee80211_bss *bss = (void *)cbss->priv;
2177
	struct ieee80211_local *local = sdata->local;
2178
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2179

J
Johannes Berg 已提交
2180
	bss_info_changed |= BSS_CHANGED_ASSOC;
2181
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
2182
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
2183

2184
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
2185
		beacon_loss_count * bss_conf->beacon_int));
2186

2187 2188
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2189

2190 2191
	ieee80211_check_rate_mask(sdata);

2192 2193
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

2194 2195
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2196
		const struct cfg80211_bss_ies *ies;
2197

2198 2199 2200 2201 2202 2203 2204 2205
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
2206 2207
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
2208
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
2209 2210
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
2211 2212
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
2213
		}
2214
		rcu_read_unlock();
2215 2216
	}

J
Johannes Berg 已提交
2217
	/* just to be sure */
2218
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
2219

2220
	ieee80211_led_assoc(local, 1);
2221

2222
	if (sdata->u.mgd.have_beacon) {
2223 2224 2225 2226 2227 2228 2229
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
2230
		bss_conf->beacon_rate = bss->beacon_rate;
2231
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
2232
	} else {
2233
		bss_conf->beacon_rate = NULL;
2234
		bss_conf->dtim_period = 0;
2235
	}
2236

2237
	bss_conf->assoc = 1;
2238

2239
	/* Tell the driver to monitor connection quality (if supported) */
2240
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2241
	    bss_conf->cqm_rssi_thold)
2242 2243
		bss_info_changed |= BSS_CHANGED_CQM;

2244
	/* Enable ARP filtering */
2245
	if (bss_conf->arp_addr_cnt)
2246 2247
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
2248
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
2249

J
Johannes Berg 已提交
2250
	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2251
	ieee80211_recalc_ps(local);
J
Johannes Berg 已提交
2252
	mutex_unlock(&local->iflist_mtx);
2253

2254
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
2255 2256
	ieee80211_recalc_ps_vif(sdata);

2257
	netif_carrier_on(sdata->dev);
2258 2259
}

2260
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2261 2262
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
2263
{
2264
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2265
	struct ieee80211_local *local = sdata->local;
2266
	u32 changed = 0;
2267

2268
	sdata_assert_lock(sdata);
2269

2270 2271 2272
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
2273 2274 2275
	if (WARN_ON(!ifmgd->associated))
		return;

2276 2277
	ieee80211_stop_poll(sdata);

2278
	ifmgd->associated = NULL;
2279 2280
	netif_carrier_off(sdata->dev);

2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2292 2293 2294
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2295 2296 2297
	/* make sure ongoing transmission finishes */
	synchronize_net();

2298 2299 2300 2301 2302 2303
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2304
	if (tx)
2305
		ieee80211_flush_queues(local, sdata, true);
2306

2307
	/* deauthenticate/disassociate now */
2308 2309 2310 2311 2312 2313 2314 2315 2316
	if (tx || frame_buf) {
		/*
		 * In multi channel scenarios guarantee that the virtual
		 * interface is granted immediate airtime to transmit the
		 * deauthentication frame by calling mgd_prepare_tx, if the
		 * driver requested so.
		 */
		if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
		    !ifmgd->have_beacon)
2317
			drv_mgd_prepare_tx(sdata->local, sdata, 0);
2318

2319 2320 2321
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid,
					       ifmgd->bssid, stype, reason,
					       tx, frame_buf);
2322
	}
2323

2324
	/* flush out frame - make sure the deauth was actually sent */
2325
	if (tx)
2326
		ieee80211_flush_queues(local, sdata, false);
2327

2328
	/* clear bssid only after building the needed mgmt frames */
2329
	eth_zero_addr(ifmgd->bssid);
2330

2331
	/* remove AP and TDLS peers */
2332
	sta_info_flush(sdata);
2333 2334

	/* finally reset all BSS / config parameters */
2335 2336 2337
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2338 2339
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2340

J
Janusz Dziedzic 已提交
2341 2342 2343
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2344

2345
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2346 2347
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2348 2349
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2350 2351 2352 2353 2354 2355 2356

	/* reset MU-MIMO ownership and group data */
	memset(sdata->vif.bss_conf.mu_group.membership, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.membership));
	memset(sdata->vif.bss_conf.mu_group.position, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.position));
	changed |= BSS_CHANGED_MU_GROUPS;
2357
	sdata->vif.mu_mimo_owner = false;
2358

2359
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2360

2361 2362 2363
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2364
	/* Disable ARP filtering */
2365
	if (sdata->vif.bss_conf.arp_addr_cnt)
2366 2367
		changed |= BSS_CHANGED_ARP_FILTER;

2368 2369 2370
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2371 2372
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2373
	ieee80211_bss_info_change_notify(sdata, changed);
2374

2375
	/* disassociated - set to defaults now */
2376
	ieee80211_set_wmm_default(sdata, false, false);
2377

2378 2379 2380 2381
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2382

2383
	sdata->vif.bss_conf.dtim_period = 0;
2384 2385
	sdata->vif.bss_conf.beacon_rate = NULL;

2386
	ifmgd->have_beacon = false;
2387

2388
	ifmgd->flags = 0;
2389
	mutex_lock(&local->mtx);
2390
	ieee80211_vif_release_channel(sdata);
2391 2392

	sdata->vif.csa_active = false;
2393
	ifmgd->csa_waiting_bcn = false;
2394
	ifmgd->csa_ignored_same_chan = false;
2395 2396 2397 2398 2399
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2400
	mutex_unlock(&local->mtx);
2401

2402 2403 2404 2405
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2406
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2407
}
2408

2409 2410 2411 2412 2413 2414 2415 2416
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2417 2418
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2419
	 */
J
Johannes Berg 已提交
2420 2421 2422
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2423
	ieee80211_sta_reset_conn_monitor(sdata);
2424
}
2425

2426 2427 2428
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2429
	struct ieee80211_local *local = sdata->local;
2430

2431
	mutex_lock(&local->mtx);
2432 2433
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2434

2435
	__ieee80211_stop_poll(sdata);
2436 2437

	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2438
	ieee80211_recalc_ps(local);
2439
	mutex_unlock(&local->iflist_mtx);
2440

2441
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2442
		goto out;
2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2454 2455
out:
	mutex_unlock(&local->mtx);
2456 2457
}

2458 2459 2460 2461 2462
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
S
Sara Sharon 已提交
2463
	u16 tid = ieee80211_get_tid(hdr);
2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2493
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2494
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2495
{
2496 2497
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2498
	if (!ieee80211_is_data(hdr->frame_control))
2499 2500
	    return;

2501
	if (ieee80211_is_any_nullfunc(hdr->frame_control) &&
2502
	    sdata->u.mgd.probe_send_count > 0) {
2503
		if (ack)
2504
			ieee80211_sta_reset_conn_monitor(sdata);
2505 2506
		else
			sdata->u.mgd.nullfunc_failed = true;
2507
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2508
		return;
2509
	}
2510 2511 2512

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2513 2514
}

2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528
static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
					  const u8 *src, const u8 *dst,
					  const u8 *ssid, size_t ssid_len,
					  struct ieee80211_channel *channel)
{
	struct sk_buff *skb;

	skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
					ssid, ssid_len, NULL, 0,
					IEEE80211_PROBE_FLAG_DIRECTED);
	if (skb)
		ieee80211_tx_skb(sdata, skb);
}

2529 2530 2531 2532
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2533
	u8 *dst = ifmgd->associated->bssid;
2534
	u8 unicast_limit = max(1, max_probe_tries - 3);
J
Johannes Berg 已提交
2535
	struct sta_info *sta;
2536 2537 2538 2539 2540 2541 2542 2543

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2544

2545 2546 2547 2548 2549 2550 2551
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2552 2553
	ifmgd->probe_send_count++;

J
Johannes Berg 已提交
2554 2555 2556 2557 2558 2559 2560 2561
	if (dst) {
		mutex_lock(&sdata->local->sta_mtx);
		sta = sta_info_get(sdata, dst);
		if (!WARN_ON(!sta))
			ieee80211_check_fast_rx(sta);
		mutex_unlock(&sdata->local->sta_mtx);
	}

2562
	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2563
		ifmgd->nullfunc_failed = false;
2564 2565 2566 2567
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
			ifmgd->probe_send_count--;
		else
			ieee80211_send_nullfunc(sdata->local, sdata, false);
2568
	} else {
2569 2570
		int ssid_len;

2571
		rcu_read_lock();
2572
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2573 2574 2575 2576 2577
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2578 2579 2580
		ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
					      ssid + 2, ssid_len,
					      ifmgd->associated->channel);
2581
		rcu_read_unlock();
2582
	}
2583

2584
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2585
	run_again(sdata, ifmgd->probe_timeout);
2586 2587
}

J
Johannes Berg 已提交
2588 2589
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2590 2591
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2592
	bool already = false;
2593

2594
	if (!ieee80211_sdata_running(sdata))
2595 2596
		return;

2597
	sdata_lock(sdata);
2598 2599 2600 2601

	if (!ifmgd->associated)
		goto out;

2602 2603 2604 2605 2606 2607 2608
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2609
	if (beacon) {
J
Johannes Berg 已提交
2610
		mlme_dbg_ratelimited(sdata,
2611 2612
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2613

2614
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2615
	}
2616

J
Johannes Berg 已提交
2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2628
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2629 2630
		already = true;

E
Eliad Peller 已提交
2631 2632
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2633 2634
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2635 2636 2637
	if (already)
		goto out;

2638
	mutex_lock(&sdata->local->iflist_mtx);
J
Johannes Berg 已提交
2639
	ieee80211_recalc_ps(sdata->local);
2640 2641
	mutex_unlock(&sdata->local->iflist_mtx);

2642 2643
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2644
 out:
2645
	sdata_unlock(sdata);
2646 2647
}

2648 2649 2650 2651 2652
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2653
	struct cfg80211_bss *cbss;
2654 2655
	struct sk_buff *skb;
	const u8 *ssid;
2656
	int ssid_len;
2657 2658 2659 2660

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2661
	sdata_assert_lock(sdata);
2662

2663 2664 2665 2666 2667 2668 2669
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2670 2671
		return NULL;

2672
	rcu_read_lock();
2673
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2674 2675
	if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
		      "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
2676 2677 2678 2679
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2680
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2681
					(u32) -1, cbss->channel,
2682
					ssid + 2, ssid_len,
2683
					NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
2684
	rcu_read_unlock();
2685 2686 2687 2688 2689

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707
static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
					const u8 *buf, size_t len, bool tx,
					u16 reason)
{
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
		.u.mlme.reason = reason,
	};

	if (tx)
		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
	else
		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);

	drv_event_callback(sdata->local, sdata, &event);
}

2708
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2709
{
2710
	struct ieee80211_local *local = sdata->local;
2711
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2712
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2713
	bool tx;
2714

2715
	sdata_lock(sdata);
2716
	if (!ifmgd->associated) {
2717
		sdata_unlock(sdata);
2718 2719 2720
		return;
	}

2721 2722
	tx = !sdata->csa_block_tx;

2723 2724 2725 2726 2727
	/* AP is probably out of range (or not reachable for another reason) so
	 * remove the bss struct for that AP.
	 */
	cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);

2728 2729
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2730
			       tx, frame_buf);
2731
	mutex_lock(&local->mtx);
2732
	sdata->vif.csa_active = false;
2733
	ifmgd->csa_waiting_bcn = false;
2734 2735 2736 2737 2738
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2739
	mutex_unlock(&local->mtx);
2740

2741
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
2742 2743
				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);

2744
	sdata_unlock(sdata);
2745 2746
}

2747
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2748 2749 2750
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2751
			     u.mgd.beacon_connection_loss_work);
2752 2753
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

2754 2755
	if (ifmgd->associated)
		ifmgd->beacon_loss_count++;
J
Johannes Berg 已提交
2756

2757
	if (ifmgd->connection_loss) {
2758 2759
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2760
		__ieee80211_disconnect(sdata);
2761
	} else {
2762
		ieee80211_mgd_probe_ap(sdata, true);
2763 2764 2765 2766 2767 2768 2769 2770 2771
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2772
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2773 2774
}

2775 2776 2777
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2778
	struct ieee80211_hw *hw = &sdata->local->hw;
2779

J
Johannes Berg 已提交
2780 2781
	trace_api_beacon_loss(sdata);

2782
	sdata->u.mgd.connection_loss = false;
2783
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2784 2785 2786
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2787 2788 2789 2790 2791
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2792 2793
	trace_api_connection_loss(sdata);

2794
	sdata->u.mgd.connection_loss = true;
2795 2796 2797 2798 2799
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2800 2801 2802 2803 2804
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2805
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2806 2807

	if (!assoc) {
2808 2809 2810 2811 2812 2813
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2814 2815
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

2816
		eth_zero_addr(sdata->u.mgd.bssid);
J
Johannes Berg 已提交
2817
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2818
		sdata->u.mgd.flags = 0;
2819
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2820
		ieee80211_vif_release_channel(sdata);
2821
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2822 2823
	}

2824
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2825 2826 2827 2828
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

2829
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2830
					 bool assoc, bool abandon)
2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

	sdata_assert_lock(sdata);

	if (!assoc) {
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		eth_zero_addr(sdata->u.mgd.bssid);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
		sdata->u.mgd.flags = 0;
2848 2849
		sdata->vif.mu_mimo_owner = false;

2850 2851 2852
		mutex_lock(&sdata->local->mtx);
		ieee80211_vif_release_channel(sdata);
		mutex_unlock(&sdata->local->mtx);
2853 2854 2855

		if (abandon)
			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
2856 2857 2858 2859 2860 2861
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

J
Johannes Berg 已提交
2862 2863 2864
static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2865
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2866 2867 2868
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2869
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2870 2871

	pos = mgmt->u.auth.variable;
2872 2873
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, auth_data->bss->bssid);
J
Johannes Berg 已提交
2874 2875 2876
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
2877
	drv_mgd_prepare_tx(sdata->local, sdata, 0);
2878
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2879 2880
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2881
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2882 2883 2884
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2885
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2886 2887
}

2888 2889 2890
static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
				    const u8 *bssid)
{
2891
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2892
	struct sta_info *sta;
2893
	bool result = true;
2894

2895 2896 2897 2898 2899 2900
	sdata_info(sdata, "authenticated\n");
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
	ifmgd->auth_data->timeout_started = true;
	run_again(sdata, ifmgd->auth_data->timeout);

2901 2902 2903 2904 2905
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2906 2907
		result = false;
		goto out;
2908 2909 2910
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2911 2912
		result = false;
		goto out;
2913 2914
	}

2915 2916 2917
out:
	mutex_unlock(&sdata->local->sta_mtx);
	return result;
2918 2919
}

2920 2921
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2922 2923 2924 2925
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
2926 2927 2928 2929
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = AUTH_EVENT,
	};
J
Johannes Berg 已提交
2930

2931
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2932 2933

	if (len < 24 + 6)
2934
		return;
J
Johannes Berg 已提交
2935 2936

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2937
		return;
J
Johannes Berg 已提交
2938 2939 2940

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2941
	if (!ether_addr_equal(bssid, mgmt->bssid))
2942
		return;
J
Johannes Berg 已提交
2943 2944 2945 2946 2947 2948

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2949 2950 2951 2952 2953
	    (auth_alg != WLAN_AUTH_SAE &&
	     auth_transaction != ifmgd->auth_data->expected_transaction) ||
	    (auth_alg == WLAN_AUTH_SAE &&
	     (auth_transaction < ifmgd->auth_data->expected_transaction ||
	      auth_transaction > 2))) {
2954 2955 2956 2957
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2958
		return;
2959
	}
J
Johannes Berg 已提交
2960 2961

	if (status_code != WLAN_STATUS_SUCCESS) {
2962 2963 2964 2965 2966 2967
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);

		if (auth_alg == WLAN_AUTH_SAE &&
		    status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED)
			return;

J
Johannes Berg 已提交
2968 2969
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2970
		ieee80211_destroy_auth_data(sdata, false);
2971 2972 2973
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
2974
		return;
J
Johannes Berg 已提交
2975 2976 2977 2978 2979 2980
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
2981
	case WLAN_AUTH_SAE:
2982 2983 2984
	case WLAN_AUTH_FILS_SK:
	case WLAN_AUTH_FILS_SK_PFS:
	case WLAN_AUTH_FILS_PK:
J
Johannes Berg 已提交
2985 2986 2987 2988 2989
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
2990
			return;
J
Johannes Berg 已提交
2991 2992 2993 2994 2995
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
2996
		return;
J
Johannes Berg 已提交
2997 2998
	}

2999 3000
	event.u.mlme.status = MLME_SUCCESS;
	drv_event_callback(sdata->local, sdata, &event);
3001 3002 3003 3004
	if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
	    (auth_transaction == 2 &&
	     ifmgd->auth_data->expected_transaction == 2)) {
		if (!ieee80211_mark_sta_auth(sdata, bssid))
3005
			return; /* ignore frame -- wait for timeout */
3006 3007 3008 3009
	} else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
		   auth_transaction == 2) {
		sdata_info(sdata, "SAE peer confirmed\n");
		ifmgd->auth_data->peer_confirmed = true;
3010 3011
	}

3012
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
J
Johannes Berg 已提交
3013 3014
}

3015 3016 3017
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

3018
const char *ieee80211_get_reason_code_string(u16 reason_code)
3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
3071

3072 3073
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
3074
{
3075
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3076
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3077

3078
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3079

3080
	if (len < 24 + 2)
3081
		return;
3082

3083 3084 3085 3086 3087
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3088 3089 3090
	if (ifmgd->associated &&
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
		const u8 *bssid = ifmgd->associated->bssid;
3091

3092 3093 3094
		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));
3095

3096
		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3097

3098 3099 3100 3101
		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
					    reason_code);
		return;
	}
3102

3103 3104 3105
	if (ifmgd->assoc_data &&
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
		const u8 *bssid = ifmgd->assoc_data->bss->bssid;
3106

3107 3108 3109 3110 3111
		sdata_info(sdata,
			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));

3112
		ieee80211_destroy_assoc_data(sdata, false, true);
3113 3114 3115 3116

		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
		return;
	}
3117 3118 3119
}


3120 3121
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
3122
{
3123
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3124 3125
	u16 reason_code;

3126
	sdata_assert_lock(sdata);
3127

J
Johannes Berg 已提交
3128
	if (len < 24 + 2)
3129
		return;
3130

J
Johannes Berg 已提交
3131
	if (!ifmgd->associated ||
3132
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3133
		return;
3134 3135 3136

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

3137 3138 3139 3140 3141
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3142 3143 3144
	sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
		   mgmt->sa, reason_code,
		   ieee80211_get_reason_code_string(reason_code));
3145

3146 3147
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

3148
	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
3149 3150
}

3151 3152 3153 3154
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
3155
				int *min_rate, int *min_rate_index,
3156
				int shift)
3157 3158 3159 3160
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
3161
		int rate = supp_rates[i] & 0x7f;
3162 3163
		bool is_basic = !!(supp_rates[i] & 0x80);

3164
		if ((rate * 5 * (1 << shift)) > 110)
3165 3166 3167
			*have_higher_than_11mbit = true;

		/*
3168 3169
		 * Skip HT, VHT and HE BSS membership selectors since they're
		 * not rates.
3170
		 *
3171
		 * Note: Even though the membership selector and the basic
3172 3173 3174
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
3175
		if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3176 3177
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY))
3178 3179 3180
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
3181 3182 3183 3184 3185 3186 3187
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
3188 3189 3190
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
3191 3192
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
3193 3194 3195 3196 3197 3198 3199
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
3200

3201 3202 3203 3204 3205 3206 3207 3208 3209 3210 3211 3212 3213
static bool ieee80211_twt_req_supported(const struct sta_info *sta,
					const struct ieee802_11_elems *elems)
{
	if (elems->ext_capab_len < 10)
		return false;

	if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
		return false;

	return sta->sta.he_cap.he_cap_elem.mac_cap_info[0] &
		IEEE80211_HE_MAC_CAP0_TWT_RES;
}

3214 3215 3216 3217 3218 3219 3220 3221 3222 3223 3224 3225 3226
static int ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee802_11_elems *elems)
{
	bool twt = ieee80211_twt_req_supported(sta, elems);

	if (sdata->vif.bss_conf.twt_requester != twt) {
		sdata->vif.bss_conf.twt_requester = twt;
		return BSS_CHANGED_TWT;
	}
	return 0;
}

J
Johannes Berg 已提交
3227 3228
static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
3229 3230
				    struct ieee80211_mgmt *mgmt, size_t len,
				    struct ieee802_11_elems *elems)
3231
{
3232
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3233
	struct ieee80211_local *local = sdata->local;
3234
	struct ieee80211_supported_band *sband;
3235
	struct sta_info *sta;
J
Johannes Berg 已提交
3236
	u16 capab_info, aid;
J
Johannes Berg 已提交
3237
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3238 3239
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
J
Johannes Berg 已提交
3240
	u32 changed = 0;
3241
	int err;
3242
	bool ret;
3243

J
Johannes Berg 已提交
3244
	/* AssocResp and ReassocResp have identical structure */
3245 3246

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
3247
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3248

3249 3250 3251 3252 3253
	/*
	 * The 5 MSB of the AID field are reserved
	 * (802.11-2016 9.4.1.8 AID field)
	 */
	aid &= 0x7ff;
3254

3255 3256 3257
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
3258 3259
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
3260 3261 3262 3263
		aid = 0;
		ifmgd->broken_ap = true;
	}

3264
	if (!elems->supp_rates) {
J
Johannes Berg 已提交
3265
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
3266
		return false;
3267 3268
	}

3269
	sdata->vif.bss_conf.aid = aid;
3270
	ifmgd->tdls_chan_switch_prohibited =
3271 3272
		elems->ext_capab && elems->ext_capab_len >= 5 &&
		(elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
3273

3274 3275 3276 3277 3278 3279 3280
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
3281
	if ((assoc_data->wmm && !elems->wmm_param) ||
3282
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3283
	     (!elems->ht_cap_elem || !elems->ht_operation)) ||
3284
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3285
	     (!elems->vht_cap_elem || !elems->vht_operation))) {
3286 3287 3288 3289 3290 3291 3292 3293 3294 3295 3296 3297 3298
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
3299 3300 3301
				       false, &bss_elems,
				       mgmt->bssid,
				       assoc_data->bss->bssid);
3302
		if (assoc_data->wmm &&
3303 3304
		    !elems->wmm_param && bss_elems.wmm_param) {
			elems->wmm_param = bss_elems.wmm_param;
3305 3306 3307 3308 3309 3310 3311 3312
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
3313
		if (!elems->ht_cap_elem && bss_elems.ht_cap_elem &&
3314
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3315
			elems->ht_cap_elem = bss_elems.ht_cap_elem;
3316 3317 3318
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
3319
		if (!elems->ht_operation && bss_elems.ht_operation &&
3320
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3321
			elems->ht_operation = bss_elems.ht_operation;
3322 3323 3324
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
3325
		if (!elems->vht_cap_elem && bss_elems.vht_cap_elem &&
3326
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3327
			elems->vht_cap_elem = bss_elems.vht_cap_elem;
3328 3329 3330
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
3331
		if (!elems->vht_operation && bss_elems.vht_operation &&
3332
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3333
			elems->vht_operation = bss_elems.vht_operation;
3334 3335 3336 3337 3338
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

3339 3340 3341 3342 3343
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3344
	    (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
3345
		sdata_info(sdata,
3346 3347 3348
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
3349 3350 3351
	}

	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3352
	    (!elems->vht_cap_elem || !elems->vht_operation)) {
3353
		sdata_info(sdata,
3354 3355 3356
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
3357 3358
	}

3359 3360 3361 3362 3363
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
3364
	sta = sta_info_get(sdata, cbss->bssid);
3365 3366
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
3367 3368
		ret = false;
		goto out;
3369
	}
3370

3371 3372 3373 3374 3375 3376
	sband = ieee80211_get_sband(sdata);
	if (!sband) {
		mutex_unlock(&sdata->local->sta_mtx);
		ret = false;
		goto out;
	}
3377

L
Luca Coelho 已提交
3378
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3379
	    (!elems->he_cap || !elems->he_operation)) {
L
Luca Coelho 已提交
3380 3381 3382 3383 3384 3385 3386
		mutex_unlock(&sdata->local->sta_mtx);
		sdata_info(sdata,
			   "HE AP is missing HE capability/operation\n");
		ret = false;
		goto out;
	}

3387
	/* Set up internal HT/VHT capabilities */
3388
	if (elems->ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
3389
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3390
						  elems->ht_cap_elem, sta);
3391

3392
	if (elems->vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
M
Mahesh Palivela 已提交
3393
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3394
						    elems->vht_cap_elem, sta);
M
Mahesh Palivela 已提交
3395

3396 3397
	if (elems->he_operation && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
	    elems->he_cap) {
L
Luca Coelho 已提交
3398
		ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
3399 3400
						  elems->he_cap,
						  elems->he_cap_len,
L
Luca Coelho 已提交
3401 3402 3403
						  sta);

		bss_conf->he_support = sta->sta.he_cap.has_he;
3404 3405 3406 3407 3408 3409 3410 3411
		if (elems->rsnx && elems->rsnx_len &&
		    (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
		    wiphy_ext_feature_isset(local->hw.wiphy,
					    NL80211_EXT_FEATURE_PROTECTED_TWT))
			bss_conf->twt_protected = true;
		else
			bss_conf->twt_protected = false;

3412
		changed |= ieee80211_recalc_twt_req(sdata, sta, elems);
L
Luca Coelho 已提交
3413 3414
	} else {
		bss_conf->he_support = false;
3415
		bss_conf->twt_requester = false;
3416
		bss_conf->twt_protected = false;
L
Luca Coelho 已提交
3417 3418 3419
	}

	if (bss_conf->he_support) {
3420
		bss_conf->he_bss_color.color =
3421
			le32_get_bits(elems->he_operation->he_oper_params,
3422
				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3423 3424 3425 3426 3427 3428 3429
		bss_conf->he_bss_color.partial =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
		bss_conf->he_bss_color.disabled =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
		changed |= BSS_CHANGED_HE_BSS_COLOR;
L
Luca Coelho 已提交
3430 3431

		bss_conf->htc_trig_based_pkt_ext =
3432
			le32_get_bits(elems->he_operation->he_oper_params,
3433
			      IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
L
Luca Coelho 已提交
3434
		bss_conf->frame_time_rts_th =
3435
			le32_get_bits(elems->he_operation->he_oper_params,
3436
			      IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
L
Luca Coelho 已提交
3437 3438 3439 3440 3441 3442 3443 3444 3445

		bss_conf->multi_sta_back_32bit =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP;

		bss_conf->ack_enabled =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_ACK_EN;

3446 3447 3448
		bss_conf->uora_exists = !!elems->uora_element;
		if (elems->uora_element)
			bss_conf->uora_ocw_range = elems->uora_element[0];
L
Luca Coelho 已提交
3449

3450 3451
		ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
		ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
L
Luca Coelho 已提交
3452 3453 3454
		/* TODO: OPEN: what happens if BSS color disable is set? */
	}

S
Sara Sharon 已提交
3455 3456 3457 3458 3459 3460 3461 3462
	if (cbss->transmitted_bss) {
		bss_conf->nontransmitted = true;
		ether_addr_copy(bss_conf->transmitter_bssid,
				cbss->transmitted_bss->bssid);
		bss_conf->bssid_indicator = cbss->max_bssid_indicator;
		bss_conf->bssid_index = cbss->bssid_index;
	}

3463 3464 3465 3466 3467 3468
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
3469

3470 3471 3472 3473 3474
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
3475 3476
	if (elems->opmode_notif &&
	    !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
3477 3478
		u8 nss;

3479
		nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
3480 3481 3482 3483 3484
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

3485
	rate_control_rate_init(sta);
3486

3487
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
J
Johannes Berg 已提交
3488
		set_sta_flag(sta, WLAN_STA_MFP);
3489 3490 3491 3492
		sta->sta.mfp = true;
	} else {
		sta->sta.mfp = false;
	}
3493

3494
	sta->sta.wme = elems->wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3495

3496
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3497 3498 3499
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
3500 3501 3502
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
3503 3504
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
3505 3506
		ret = false;
		goto out;
3507 3508
	}

3509
	mutex_unlock(&sdata->local->sta_mtx);
3510

3511 3512 3513 3514 3515 3516 3517
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;
3518
	ifmgd->mu_edca_last_param_set = -1;
3519

3520
	if (ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
3521
		ieee80211_set_wmm_default(sdata, false, false);
3522 3523 3524
	} else if (!ieee80211_sta_wmm_params(local, sdata, elems->wmm_param,
					     elems->wmm_param_len,
					     elems->mu_edca_param_set)) {
3525 3526 3527 3528 3529 3530 3531 3532 3533 3534 3535
		/* still enable QoS since we might have HT/VHT */
		ieee80211_set_wmm_default(sdata, false, true);
		/* set the disable-WMM flag in this case to disable
		 * tracking WMM parameter changes in the beacon if
		 * the parameters weren't actually valid. Doing so
		 * avoids changing parameters very strangely when
		 * the AP is going back and forth between valid and
		 * invalid parameters.
		 */
		ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
	}
3536
	changed |= BSS_CHANGED_QOS;
3537

3538
	if (elems->max_idle_period_ie) {
3539
		bss_conf->max_idle_period =
3540
			le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
3541
		bss_conf->protected_keep_alive =
3542
			!!(elems->max_idle_period_ie->idle_options &
3543 3544 3545 3546 3547 3548 3549
			   WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
		changed |= BSS_CHANGED_KEEP_ALIVE;
	} else {
		bss_conf->max_idle_period = 0;
		bss_conf->protected_keep_alive = false;
	}

3550
	/* set assoc capability (AID was already set earlier),
J
Johannes Berg 已提交
3551 3552
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->assoc_capability = capab_info;
3553
	ieee80211_set_associated(sdata, cbss, changed);
3554

3555 3556 3557 3558 3559 3560 3561
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3562
	/*
J
Johannes Berg 已提交
3563 3564
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3565
	 */
J
Johannes Berg 已提交
3566
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3567
	ieee80211_sta_reset_beacon_monitor(sdata);
3568

3569 3570 3571 3572
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3573 3574
}

3575 3576 3577
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3578 3579 3580 3581 3582
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3583
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3584 3585
	u8 *pos;
	bool reassoc;
3586
	struct cfg80211_bss *bss;
3587 3588 3589 3590
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = ASSOC_EVENT,
	};
J
Johannes Berg 已提交
3591

3592
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3593 3594

	if (!assoc_data)
3595
		return;
3596
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3597
		return;
J
Johannes Berg 已提交
3598 3599 3600 3601 3602 3603 3604

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3605
		return;
J
Johannes Berg 已提交
3606

3607
	reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
J
Johannes Berg 已提交
3608 3609 3610 3611
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3612 3613 3614 3615
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3616

3617 3618 3619 3620
	if (assoc_data->fils_kek_len &&
	    fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
		return;

J
Johannes Berg 已提交
3621
	pos = mgmt->u.assoc_resp.variable;
3622 3623
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, assoc_data->bss->bssid);
J
Johannes Berg 已提交
3624 3625

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3626 3627
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3628
		u32 tu, ms;
3629
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3630
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3631 3632 3633
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3634
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3635
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3636
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3637 3638
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3639 3640
	}

3641
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3642 3643

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3644 3645
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
3646
		ieee80211_destroy_assoc_data(sdata, false, false);
3647 3648 3649
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3650
	} else {
3651
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len, &elems)) {
J
Johannes Berg 已提交
3652
			/* oops -- internal error -- send timeout for now */
3653
			ieee80211_destroy_assoc_data(sdata, false, false);
3654
			cfg80211_assoc_timeout(sdata->dev, bss);
3655
			return;
J
Johannes Berg 已提交
3656
		}
3657 3658
		event.u.mlme.status = MLME_SUCCESS;
		drv_event_callback(sdata->local, sdata, &event);
3659
		sdata_info(sdata, "associated\n");
3660 3661 3662 3663 3664 3665

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
3666
		ieee80211_destroy_assoc_data(sdata, true, false);
3667 3668 3669 3670 3671

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
3672
				uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
J
Johannes Berg 已提交
3673 3674
	}

3675 3676
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues,
			       ifmgd->assoc_req_ies, ifmgd->assoc_req_ies_len);
J
Johannes Berg 已提交
3677
}
J
Johannes Berg 已提交
3678

3679
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3680
				  struct ieee80211_mgmt *mgmt, size_t len,
3681
				  struct ieee80211_rx_status *rx_status)
3682 3683
{
	struct ieee80211_local *local = sdata->local;
3684
	struct ieee80211_bss *bss;
3685
	struct ieee80211_channel *channel;
3686

3687
	sdata_assert_lock(sdata);
3688

3689 3690
	channel = ieee80211_get_channel_khz(local->hw.wiphy,
					ieee80211_rx_status_to_khz(rx_status));
3691
	if (!channel)
3692 3693
		return;

3694
	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
3695 3696
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3697
		ieee80211_rx_bss_put(local, bss);
3698
	}
3699 3700 3701
}


3702
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3703
					 struct sk_buff *skb)
3704
{
J
Johannes Berg 已提交
3705
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3706
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3707
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
3708
	struct ieee80211_channel *channel;
J
Johannes Berg 已提交
3709
	size_t baselen, len = skb->len;
3710

3711 3712
	ifmgd = &sdata->u.mgd;

3713
	sdata_assert_lock(sdata);
3714

3715 3716 3717 3718 3719 3720 3721 3722 3723 3724 3725 3726 3727 3728 3729
	/*
	 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
	 * "If a 6 GHz AP receives a Probe Request frame  and responds with
	 * a Probe Response frame [..], the Address 1 field of the Probe
	 * Response frame shall be set to the broadcast address [..]"
	 * So, on 6GHz band we should also accept broadcast responses.
	 */
	channel = ieee80211_get_channel(sdata->local->hw.wiphy,
					rx_status->freq);
	if (!channel)
		return;

	if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
	    (channel->band != NL80211_BAND_6GHZ ||
	     !is_broadcast_ether_addr(mgmt->da)))
3730 3731
		return; /* ignore ProbeResp to foreign address */

3732 3733 3734 3735
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

3736
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
3737

3738
	if (ifmgd->associated &&
3739
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3740
		ieee80211_reset_ap_probe(sdata);
3741 3742
}

3743 3744 3745
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3746 3747 3748
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3749 3750 3751 3752 3753 3754 3755 3756 3757 3758
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3759 3760 3761 3762 3763
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3764 3765
	(1ULL << WLAN_EID_HT_OPERATION) |
	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3766

3767 3768 3769 3770 3771
static void ieee80211_handle_beacon_sig(struct ieee80211_sub_if_data *sdata,
					struct ieee80211_if_managed *ifmgd,
					struct ieee80211_bss_conf *bss_conf,
					struct ieee80211_local *local,
					struct ieee80211_rx_status *rx_status)
3772
{
3773
	/* Track average RSSI from the Beacon frames of the current AP */
3774

3775 3776
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3777
		ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3778
		ifmgd->last_cqm_event_signal = 0;
3779
		ifmgd->count_beacon_signal = 1;
3780
		ifmgd->last_ave_beacon_signal = 0;
3781
	} else {
3782
		ifmgd->count_beacon_signal++;
3783
	}
3784

3785 3786
	ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);

3787 3788
	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3789
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3790
		int last_sig = ifmgd->last_ave_beacon_signal;
3791 3792 3793
		struct ieee80211_event event = {
			.type = RSSI_EVENT,
		};
3794 3795 3796 3797 3798 3799 3800 3801

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3802 3803
			event.u.rssi.data = RSSI_EVENT_HIGH;
			drv_event_callback(local, sdata, &event);
3804 3805 3806 3807
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3808 3809
			event.u.rssi.data = RSSI_EVENT_LOW;
			drv_event_callback(local, sdata, &event);
3810 3811 3812
		}
	}

3813
	if (bss_conf->cqm_rssi_thold &&
3814
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3815
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3816
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3817 3818 3819
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
3820

3821 3822 3823 3824 3825 3826
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3827
				sig, GFP_KERNEL);
3828 3829 3830 3831 3832 3833
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3834
				sig, GFP_KERNEL);
3835 3836 3837
		}
	}

3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860
	if (bss_conf->cqm_rssi_low &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
		int last_event = ifmgd->last_cqm_event_signal;
		int low = bss_conf->cqm_rssi_low;
		int high = bss_conf->cqm_rssi_high;

		if (sig < low &&
		    (last_event == 0 || last_event >= low)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				sig, GFP_KERNEL);
		} else if (sig > high &&
			   (last_event == 0 || last_event <= high)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				sig, GFP_KERNEL);
		}
	}
3861 3862
}

S
Sara Sharon 已提交
3863 3864 3865 3866 3867 3868 3869 3870 3871 3872
static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
				    struct cfg80211_bss *bss)
{
	if (ether_addr_equal(tx_bssid, bss->bssid))
		return true;
	if (!bss->transmitted_bss)
		return false;
	return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
}

3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
	size_t baselen;
	struct ieee802_11_elems elems;
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
	struct sta_info *sta;
	u32 changed = 0;
	bool erp_valid;
	u8 erp_value = 0;
	u32 ncrc;
	u8 *bssid;
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_assert_lock(sdata);

	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
		return;
	}

3906 3907
	if (ieee80211_rx_status_to_khz(rx_status) !=
	    ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
3908 3909 3910 3911 3912 3913 3914
		rcu_read_unlock();
		return;
	}
	chan = chanctx_conf->def.chan;
	rcu_read_unlock();

	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
S
Sara Sharon 已提交
3915
	    ieee80211_rx_our_beacon(mgmt->bssid, ifmgd->assoc_data->bss)) {
3916
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3917 3918 3919
				       len - baselen, false, &elems,
				       mgmt->bssid,
				       ifmgd->assoc_data->bss->bssid);
3920

3921
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
S
Sara Sharon 已提交
3922 3923 3924

		if (elems.dtim_period)
			ifmgd->dtim_period = elems.dtim_period;
3925 3926 3927 3928 3929 3930 3931
		ifmgd->have_beacon = true;
		ifmgd->assoc_data->need_beacon = false;
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
S
Sara Sharon 已提交
3932
			sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
3933
		}
S
Sara Sharon 已提交
3934 3935 3936 3937 3938 3939 3940 3941 3942

		if (elems.mbssid_config_ie)
			bss_conf->profile_periodicity =
				elems.mbssid_config_ie->profile_periodicity;

		if (elems.ext_capab_len >= 11 &&
		    (elems.ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			bss_conf->ema_ap = true;

3943 3944 3945 3946 3947 3948 3949 3950
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
		ifmgd->assoc_data->timeout_started = true;
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
	}

	if (!ifmgd->associated ||
S
Sara Sharon 已提交
3951
	    !ieee80211_rx_our_beacon(mgmt->bssid,  ifmgd->associated))
3952 3953 3954 3955 3956 3957
		return;
	bssid = ifmgd->associated->bssid;

	if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
		ieee80211_handle_beacon_sig(sdata, ifmgd, bss_conf,
					    local, rx_status);
3958

3959
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3960
		mlme_dbg_ratelimited(sdata,
3961
				     "cancelling AP probe due to a received beacon\n");
3962
		ieee80211_reset_ap_probe(sdata);
3963 3964
	}

J
Johannes Berg 已提交
3965 3966 3967 3968
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
3969
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
3970

3971 3972
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3973
					  len - baselen, false, &elems,
3974 3975
					  care_about_ies, ncrc,
					  mgmt->bssid, bssid);
3976

3977
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
3978
	    ieee80211_check_tim(elems.tim, elems.tim_len, bss_conf->aid)) {
3979 3980 3981 3982 3983
		if (local->hw.conf.dynamic_ps_timeout > 0) {
			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
				ieee80211_hw_config(local,
						    IEEE80211_CONF_CHANGE_PS);
3984
			}
3985
			ieee80211_send_nullfunc(local, sdata, false);
3986 3987 3988 3989 3990 3991 3992 3993 3994 3995 3996 3997
		} else if (!local->pspolling && sdata->u.mgd.powersave) {
			local->pspolling = true;

			/*
			 * Here is assumed that the driver will be
			 * able to send ps-poll frame and receive a
			 * response even though power save mode is
			 * enabled, but some drivers might require
			 * to disable power save here. This needs
			 * to be investigated.
			 */
			ieee80211_send_pspoll(local, sdata);
3998 3999
		}
	}
J
Johannes Berg 已提交
4000

4001 4002
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
J
Janusz Dziedzic 已提交
4003
		struct ieee80211_p2p_noa_attr noa = {};
4004 4005 4006 4007 4008
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
4009
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
4010 4011 4012 4013 4014 4015 4016 4017 4018 4019 4020 4021 4022 4023 4024 4025
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
4026 4027 4028 4029 4030
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

4031 4032 4033
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

4034 4035 4036 4037 4038 4039 4040 4041
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
4042
	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4043 4044 4045 4046
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
S
Sara Sharon 已提交
4047
		sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
4048 4049
	}

4050
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
4051
		return;
4052
	ifmgd->beacon_crc = ncrc;
4053
	ifmgd->beacon_crc_valid = true;
4054

4055
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
4056

4057
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
4058
					 rx_status->device_timestamp,
4059 4060
					 &elems, true);

4061 4062
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
L
Luca Coelho 已提交
4063 4064
				     elems.wmm_param_len,
				     elems.mu_edca_param_set))
4065 4066
		changed |= BSS_CHANGED_QOS;

4067 4068
	/*
	 * If we haven't had a beacon before, tell the driver about the
4069
	 * DTIM period (and beacon timing if desired) now.
4070
	 */
4071
	if (!ifmgd->have_beacon) {
4072
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
S
Sara Sharon 已提交
4073
		bss_conf->dtim_period = elems.dtim_period ?: 1;
4074

4075 4076
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
4077 4078

		mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
4079
		ieee80211_recalc_ps(local);
4080 4081
		mutex_unlock(&local->iflist_mtx);

4082
		ieee80211_recalc_ps_vif(sdata);
4083 4084
	}

4085
	if (elems.erp_info) {
J
Johannes Berg 已提交
4086 4087 4088 4089
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
4090
	}
J
Johannes Berg 已提交
4091 4092 4093
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
4094

4095
	mutex_lock(&local->sta_mtx);
4096 4097
	sta = sta_info_get(sdata, bssid);

4098 4099
	changed |= ieee80211_recalc_twt_req(sdata, sta, &elems);

4100 4101
	if (ieee80211_config_bw(sdata, sta,
				elems.ht_cap_elem, elems.ht_operation,
L
Luca Coelho 已提交
4102 4103
				elems.vht_operation, elems.he_operation,
				bssid, &changed)) {
4104
		mutex_unlock(&local->sta_mtx);
4105 4106 4107
		sdata_info(sdata,
			   "failed to follow AP %pM bandwidth change, disconnect\n",
			   bssid);
4108 4109 4110
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
4111 4112 4113
		ieee80211_report_disconnect(sdata, deauth_buf,
					    sizeof(deauth_buf), true,
					    WLAN_REASON_DEAUTH_LEAVING);
4114
		return;
4115
	}
4116 4117 4118

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
4119
					    rx_status->band);
4120
	mutex_unlock(&local->sta_mtx);
4121

4122 4123 4124
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
4125 4126
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
4127

4128
	ieee80211_bss_info_change_notify(sdata, changed);
4129 4130
}

4131 4132
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
4133 4134 4135 4136
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
4137 4138
	struct ieee802_11_elems elems;
	int ies_len;
4139 4140 4141 4142 4143

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

4144
	sdata_lock(sdata);
4145

J
Johannes Berg 已提交
4146 4147
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
4148
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
4149 4150 4151 4152 4153
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
4154
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4155 4156
		break;
	case IEEE80211_STYPE_DEAUTH:
4157
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4158 4159
		break;
	case IEEE80211_STYPE_DISASSOC:
4160
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4161 4162 4163
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
4164
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4165 4166
		break;
	case IEEE80211_STYPE_ACTION:
4167
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
4168 4169 4170
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
4171 4172 4173 4174

			if (ies_len < 0)
				break;

4175
			/* CSA IE cannot be overridden, no need for BSSID */
4176 4177
			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
4178
				ies_len, true, &elems, mgmt->bssid, NULL);
4179 4180 4181 4182

			if (elems.parse_error)
				break;

4183
			ieee80211_sta_process_chanswitch(sdata,
4184 4185 4186
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4187 4188 4189 4190 4191 4192 4193 4194
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

4195 4196 4197 4198
			/*
			 * extended CSA IE can't be overridden, no need for
			 * BSSID
			 */
4199 4200
			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
4201
				ies_len, true, &elems, mgmt->bssid, NULL);
4202 4203 4204 4205 4206 4207 4208 4209

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
4210
			ieee80211_sta_process_chanswitch(sdata,
4211 4212 4213
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4214
		}
4215
		break;
4216
	}
4217
	sdata_unlock(sdata);
4218 4219
}

4220
static void ieee80211_sta_timer(struct timer_list *t)
4221
{
J
Johannes Berg 已提交
4222
	struct ieee80211_sub_if_data *sdata =
4223
		from_timer(sdata, t, u.mgd.timer);
4224

4225
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
4226 4227
}

4228
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
4229
					  u8 *bssid, u8 reason, bool tx)
4230
{
4231
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4232

4233
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
4234
			       tx, frame_buf);
4235

4236 4237
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    reason);
4238 4239
}

4240
static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4241 4242 4243 4244
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
4245
	u32 tx_flags = 0;
4246 4247
	u16 trans = 1;
	u16 status = 0;
4248
	u16 prepare_tx_duration = 0;
J
Johannes Berg 已提交
4249

4250
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4251 4252 4253 4254 4255 4256 4257

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
4258 4259
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
4260 4261 4262 4263 4264 4265 4266 4267 4268 4269

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

4270 4271 4272 4273 4274
	if (auth_data->algorithm == WLAN_AUTH_SAE)
		prepare_tx_duration =
			jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);

	drv_mgd_prepare_tx(local, sdata, prepare_tx_duration);
J
Johannes Berg 已提交
4275

4276 4277 4278
	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
		   auth_data->bss->bssid, auth_data->tries,
		   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
4279

4280
	auth_data->expected_transaction = 2;
4281

4282 4283 4284 4285 4286
	if (auth_data->algorithm == WLAN_AUTH_SAE) {
		trans = auth_data->sae_trans;
		status = auth_data->sae_status;
		auth_data->expected_transaction = trans;
	}
J
Johannes Berg 已提交
4287

4288 4289 4290
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
4291

4292 4293 4294 4295 4296
	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
			    auth_data->data, auth_data->data_len,
			    auth_data->bss->bssid,
			    auth_data->bss->bssid, NULL, 0, 0,
			    tx_flags);
J
Johannes Berg 已提交
4297

4298
	if (tx_flags == 0) {
4299 4300 4301 4302 4303
		if (auth_data->algorithm == WLAN_AUTH_SAE)
			auth_data->timeout = jiffies +
				IEEE80211_AUTH_TIMEOUT_SAE;
		else
			auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
4304
	} else {
4305 4306
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
4307
	}
J
Johannes Berg 已提交
4308

4309 4310 4311
	auth_data->timeout_started = true;
	run_again(sdata, auth_data->timeout);

J
Johannes Berg 已提交
4312 4313 4314 4315 4316 4317 4318 4319
	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

4320
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4321 4322 4323

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
4324 4325
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
4326 4327 4328 4329 4330 4331 4332 4333 4334 4335

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
4336 4337 4338
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
4339 4340
	ieee80211_send_assoc(sdata);

4341
	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
4342
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
4343
		assoc_data->timeout_started = true;
4344
		run_again(sdata, assoc_data->timeout);
4345
	} else {
4346 4347 4348 4349 4350
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
4351
	}
J
Johannes Berg 已提交
4352 4353 4354 4355

	return 0;
}

4356 4357 4358 4359 4360 4361 4362 4363 4364 4365 4366 4367
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

4368
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4369 4370
{
	struct ieee80211_local *local = sdata->local;
4371
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4372

4373
	sdata_lock(sdata);
4374

4375 4376 4377 4378 4379
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
4380
		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
4381
			if (status_acked) {
4382 4383 4384 4385 4386 4387 4388 4389 4390
				if (ifmgd->auth_data->algorithm ==
				    WLAN_AUTH_SAE)
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SAE;
				else
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SHORT;
4391
				run_again(sdata, ifmgd->auth_data->timeout);
4392 4393 4394
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
4395
			ifmgd->auth_data->timeout_started = true;
4396 4397 4398 4399 4400 4401
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
4402
				run_again(sdata, ifmgd->assoc_data->timeout);
4403 4404 4405
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
4406
			ifmgd->assoc_data->timeout_started = true;
4407 4408 4409
		}
	}

4410
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
4411 4412 4413 4414 4415 4416 4417
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
4418
		} else if (ieee80211_auth(sdata)) {
J
Johannes Berg 已提交
4419
			u8 bssid[ETH_ALEN];
4420 4421 4422 4423 4424
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = AUTH_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4425 4426 4427 4428 4429

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

4430
			cfg80211_auth_timeout(sdata->dev, bssid);
4431
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4432
		}
4433
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
4434
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
4435

4436
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
4437
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
4438
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
4439
		    ieee80211_do_assoc(sdata)) {
4440
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4441 4442 4443 4444 4445
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = ASSOC_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4446

4447
			ieee80211_destroy_assoc_data(sdata, false, false);
4448
			cfg80211_assoc_timeout(sdata->dev, bss);
4449
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4450
		}
4451
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
4452
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
4453

4454
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
4455
	    ifmgd->associated) {
4456
		u8 bssid[ETH_ALEN];
4457
		int max_tries;
4458

4459
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
4460

4461
		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
4462
			max_tries = max_nullfunc_tries;
4463
		else
4464
			max_tries = max_probe_tries;
4465

4466 4467 4468
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
4469 4470
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4471 4472 4473 4474
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
4475 4476
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
4477 4478 4479
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
4480
				ieee80211_sta_connection_lost(sdata, bssid,
4481 4482
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
4483 4484
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
4485
			run_again(sdata, ifmgd->probe_timeout);
4486
		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
J
Johannes Berg 已提交
4487 4488 4489
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
4490
			ieee80211_sta_connection_lost(sdata, bssid,
4491
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
4492
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4493 4494 4495 4496
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
4497 4498
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
4499 4500 4501 4502
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
4503 4504 4505
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, disconnecting.\n",
				 bssid, probe_wait_ms);
4506

4507
			ieee80211_sta_connection_lost(sdata, bssid,
4508
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
4509 4510 4511
		}
	}

4512
	sdata_unlock(sdata);
4513 4514
}

4515
static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4516 4517
{
	struct ieee80211_sub_if_data *sdata =
4518
		from_timer(sdata, t, u.mgd.bcn_mon_timer);
4519
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4520

4521
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4522 4523
		return;

4524
	sdata->u.mgd.connection_loss = false;
4525 4526
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
4527 4528
}

4529
static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4530 4531
{
	struct ieee80211_sub_if_data *sdata =
4532
		from_timer(sdata, t, u.mgd.conn_mon_timer);
J
Johannes Berg 已提交
4533 4534 4535
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

4536
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4537 4538
		return;

4539
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
4540 4541 4542 4543 4544 4545 4546 4547 4548 4549 4550
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
4551 4552
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
4553
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
4554
		__ieee80211_stop_poll(sdata);
4555

J
Johannes Berg 已提交
4556
		/* let's probe the connection once */
4557
		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
4558 4559
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
4560
	}
J
Johannes Berg 已提交
4561
}
4562

4563
#ifdef CONFIG_PM
4564 4565 4566 4567 4568 4569 4570
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

4571 4572 4573 4574 4575
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

4576
		/*
4577 4578 4579
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
4580
		 */
4581
		ieee80211_send_deauth_disassoc(sdata, bssid, bssid,
4582 4583 4584
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
4585
		if (ifmgd->assoc_data)
4586
			ieee80211_destroy_assoc_data(sdata, false, true);
4587 4588
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
4589 4590 4591 4592
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

4593 4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604 4605 4606 4607 4608 4609 4610 4611 4612 4613 4614 4615 4616 4617 4618 4619 4620
	/* This is a bit of a hack - we should find a better and more generic
	 * solution to this. Normally when suspending, cfg80211 will in fact
	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
	 * auth (not so important) or assoc (this is the problem) process.
	 *
	 * As a consequence, it can happen that we are in the process of both
	 * associating and suspending, and receive an association response
	 * after cfg80211 has checked if it needs to disconnect, but before
	 * we actually set the flag to drop incoming frames. This will then
	 * cause the workqueue flush to process the association response in
	 * the suspend, resulting in a successful association just before it
	 * tries to remove the interface from the driver, which now though
	 * has a channel context assigned ... this results in issues.
	 *
	 * To work around this (for now) simply deauth here again if we're
	 * now connected.
	 */
	if (ifmgd->associated && !sdata->local->wowlan) {
		u8 bssid[ETH_ALEN];
		struct cfg80211_deauth_request req = {
			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
			.bssid = bssid,
		};

		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
		ieee80211_mgd_deauth(sdata, &req);
	}

4621 4622 4623
	sdata_unlock(sdata);
}

4624 4625 4626 4627
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4628
	sdata_lock(sdata);
4629
	if (!ifmgd->associated) {
4630
		sdata_unlock(sdata);
4631 4632 4633 4634 4635 4636 4637 4638 4639 4640
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4641
		sdata_unlock(sdata);
4642 4643
		return;
	}
4644
	sdata_unlock(sdata);
4645 4646 4647
}
#endif

J
Johannes Berg 已提交
4648 4649
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4650
{
4651
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4652

4653
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4654
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4655
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4656 4657
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4658 4659
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4660
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4661 4662
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4663 4664 4665 4666
	timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
	timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
	timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
	timer_setup(&ifmgd->chswitch_timer, ieee80211_chswitch_timer, 0);
4667 4668
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4669

4670
	ifmgd->flags = 0;
4671
	ifmgd->powersave = sdata->wdev.ps;
4672 4673
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4674
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4675

4676
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4677 4678 4679
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4680 4681 4682 4683 4684

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4685 4686
}

4687 4688
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4689
{
4690
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4691

4692 4693
	/* Restart STA timers */
	rcu_read_lock();
4694 4695 4696 4697
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4698 4699
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4700

J
Johannes Berg 已提交
4701 4702 4703 4704 4705 4706 4707 4708 4709 4710 4711 4712
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4713
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4714 4715 4716 4717 4718 4719 4720 4721 4722 4723 4724 4725
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4726
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4727 4728 4729 4730 4731 4732 4733 4734 4735 4736 4737 4738 4739 4740 4741 4742 4743 4744
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

L
Luca Coelho 已提交
4745 4746 4747 4748 4749 4750
static bool
ieee80211_verify_sta_he_mcs_support(struct ieee80211_supported_band *sband,
				    const struct ieee80211_he_operation *he_op)
{
	const struct ieee80211_sta_he_cap *sta_he_cap =
		ieee80211_get_he_sta_cap(sband);
4751
	u16 ap_min_req_set;
L
Luca Coelho 已提交
4752 4753 4754 4755 4756
	int i;

	if (!sta_he_cap || !he_op)
		return false;

4757 4758
	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);

L
Luca Coelho 已提交
4759 4760 4761 4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779 4780 4781 4782 4783 4784 4785 4786 4787 4788 4789 4790 4791 4792 4793 4794 4795 4796 4797 4798 4799 4800 4801 4802 4803 4804 4805 4806
	/* Need to go over for 80MHz, 160MHz and for 80+80 */
	for (i = 0; i < 3; i++) {
		const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
			&sta_he_cap->he_mcs_nss_supp;
		u16 sta_mcs_map_rx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
		u16 sta_mcs_map_tx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
		u8 nss;
		bool verified = true;

		/*
		 * For each band there is a maximum of 8 spatial streams
		 * possible. Each of the sta_mcs_map_* is a 16-bit struct built
		 * of 2 bits per NSS (1-8), with the values defined in enum
		 * ieee80211_he_mcs_support. Need to make sure STA TX and RX
		 * capabilities aren't less than the AP's minimum requirements
		 * for this HE BSS per SS.
		 * It is enough to find one such band that meets the reqs.
		 */
		for (nss = 8; nss > 0; nss--) {
			u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
			u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
			u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;

			if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
				continue;

			/*
			 * Make sure the HE AP doesn't require MCSs that aren't
			 * supported by the client
			 */
			if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
				verified = false;
				break;
			}
		}

		if (verified)
			return true;
	}

	/* If here, STA doesn't meet AP's HE min requirements */
	return false;
}

4807 4808
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4809 4810 4811
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4812
	const struct ieee80211_ht_cap *ht_cap = NULL;
4813
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4814
	const struct ieee80211_vht_operation *vht_oper = NULL;
L
Luca Coelho 已提交
4815
	const struct ieee80211_he_operation *he_oper = NULL;
4816
	struct ieee80211_supported_band *sband;
4817
	struct cfg80211_chan_def chandef;
J
Johannes Berg 已提交
4818
	int ret;
4819 4820
	u32 i;
	bool have_80mhz;
4821

4822 4823
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4824 4825 4826 4827
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4828 4829 4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840
	/* disable HT/VHT/HE if we don't support them */
	if (!sband->ht_cap.ht_supported) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

	if (!sband->vht_cap.vht_supported)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	if (!ieee80211_get_he_sta_cap(sband))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

4841 4842
	rcu_read_lock();

4843
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
4844
		const u8 *ht_oper_ie, *ht_cap_ie;
4845

4846
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4847 4848
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4849

4850 4851 4852 4853 4854
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4855 4856 4857
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4858 4859
	}

4860
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
4861
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4862

4863 4864
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4865 4866 4867 4868
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4869
			sdata_info(sdata,
4870
				   "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4871 4872
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4873
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
4874
		}
4875 4876 4877 4878 4879 4880

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4881 4882
	}

4883
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE)) {
L
Luca Coelho 已提交
4884 4885 4886 4887 4888 4889 4890 4891 4892 4893 4894 4895
		const struct cfg80211_bss_ies *ies;
		const u8 *he_oper_ie;

		ies = rcu_dereference(cbss->ies);
		he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
						  ies->data, ies->len);
		if (he_oper_ie &&
		    he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3]))
			he_oper = (void *)(he_oper_ie + 3);
		else
			he_oper = NULL;

4896
		if (!ieee80211_verify_sta_he_mcs_support(sband, he_oper))
L
Luca Coelho 已提交
4897 4898 4899
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

4900 4901 4902 4903 4904 4905 4906 4907 4908 4909 4910 4911 4912 4913
	/* Allow VHT if at least one channel on the sband supports 80 MHz */
	have_80mhz = false;
	for (i = 0; i < sband->n_channels; i++) {
		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
						IEEE80211_CHAN_NO_80MHZ))
			continue;

		have_80mhz = true;
		break;
	}

	if (!have_80mhz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4914 4915
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
L
Luca Coelho 已提交
4916
						     ht_oper, vht_oper, he_oper,
4917
						     &chandef, false);
4918

J
Johannes Berg 已提交
4919 4920
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4921

4922 4923
	rcu_read_unlock();

4924 4925 4926
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4927
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4928 4929 4930 4931 4932 4933 4934
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4935 4936 4937 4938

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4939
		goto out;
4940

4941
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4942
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4943 4944 4945
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4946 4947
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4948
	return ret;
4949 4950
}

S
Sara Sharon 已提交
4951 4952 4953 4954 4955 4956 4957 4958 4959 4960 4961 4962 4963 4964 4965 4966 4967 4968 4969 4970 4971 4972 4973 4974 4975 4976 4977 4978 4979 4980 4981 4982 4983 4984
static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
			       u8 *dtim_count, u8 *dtim_period)
{
	const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
	const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
					 ies->len);
	const struct ieee80211_tim_ie *tim = NULL;
	const struct ieee80211_bssid_index *idx;
	bool valid = tim_ie && tim_ie[1] >= 2;

	if (valid)
		tim = (void *)(tim_ie + 2);

	if (dtim_count)
		*dtim_count = valid ? tim->dtim_count : 0;

	if (dtim_period)
		*dtim_period = valid ? tim->dtim_period : 0;

	/* Check if value is overridden by non-transmitted profile */
	if (!idx_ie || idx_ie[1] < 3)
		return valid;

	idx = (void *)(idx_ie + 2);

	if (dtim_count)
		*dtim_count = idx->dtim_count;

	if (dtim_period)
		*dtim_period = idx->dtim_period;

	return true;
}

4985
static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
4986 4987
				     struct cfg80211_bss *cbss, bool assoc,
				     bool override)
4988 4989 4990 4991 4992
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
4993
	struct ieee80211_supported_band *sband;
4994
	bool have_sta = false;
4995 4996
	int err;

4997 4998
	sband = local->hw.wiphy->bands[cbss->channel->band];

4999 5000 5001
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

5002 5003 5004 5005
	/* If a reconfig is happening, bail out */
	if (local->in_reconfig)
		return -EBUSY;

5006 5007 5008 5009 5010 5011 5012 5013 5014 5015 5016
	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
5017

5018 5019 5020 5021 5022 5023 5024 5025 5026 5027 5028 5029 5030
	/*
	 * Set up the information for the new channel before setting the
	 * new channel. We can't - completely race-free - change the basic
	 * rates bitmap and the channel (sband) that it refers to, but if
	 * we set it up before we at least avoid calling into the driver's
	 * bss_info_changed() method with invalid information (since we do
	 * call that from changing the channel - only for IDLE and perhaps
	 * some others, but ...).
	 *
	 * So to avoid that, just set up all the new information before the
	 * channel, but tell the driver to apply it only afterwards, since
	 * it might need the new channel for that.
	 */
J
Johannes Berg 已提交
5031
	if (new_sta) {
5032 5033 5034
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
J
Johannes Berg 已提交
5035
		const struct cfg80211_bss_ies *ies;
5036
		int shift = ieee80211_vif_get_shift(&sdata->vif);
5037 5038 5039 5040 5041

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
5042
				    &min_rate, &min_rate_index,
5043
				    shift);
5044 5045 5046 5047 5048 5049 5050 5051

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
5052 5053
		 * Allow this workaround only in case the AP provided at least
		 * one rate.
5054
		 */
5055 5056 5057 5058 5059 5060 5061
		if (min_rate_index < 0) {
			sdata_info(sdata,
				   "No legacy rates in association response\n");

			sta_info_free(local, new_sta);
			return -EINVAL;
		} else if (!basic_rates) {
J
Johannes Berg 已提交
5062 5063
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
5064 5065 5066
			basic_rates = BIT(min_rate_index);
		}

5067 5068 5069 5070 5071 5072
		if (rates)
			new_sta->sta.supp_rates[cbss->channel->band] = rates;
		else
			sdata_info(sdata,
				   "No rates found, keeping mandatory only\n");

5073 5074 5075
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
5076
		if (cbss->channel->band == NL80211_BAND_2GHZ &&
5077 5078 5079 5080 5081 5082 5083
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

5084 5085
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
5086
		rcu_read_lock();
5087 5088 5089 5090 5091
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
S
Sara Sharon 已提交
5092 5093 5094 5095

			ieee80211_get_dtim(ies,
					   &sdata->vif.bss_conf.sync_dtim_count,
					   NULL);
5096 5097
		} else if (!ieee80211_hw_check(&sdata->local->hw,
					       TIMING_BEACON_ONLY)) {
5098 5099 5100 5101 5102 5103 5104 5105 5106 5107 5108
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
5109
		rcu_read_unlock();
5110
	}
5111

5112 5113 5114 5115 5116 5117 5118 5119 5120 5121 5122 5123 5124 5125
	if (new_sta || override) {
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

	if (new_sta) {
		/*
		 * tell driver about BSSID, basic rates and timing
		 * this was set up above, before setting the channel
		 */
5126
		ieee80211_bss_info_change_notify(sdata,
5127 5128
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
5129 5130

		if (assoc)
J
Johannes Berg 已提交
5131
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
5132

J
Johannes Berg 已提交
5133 5134
		err = sta_info_insert(new_sta);
		new_sta = NULL;
5135
		if (err) {
J
Johannes Berg 已提交
5136 5137 5138
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
5139 5140 5141
			return err;
		}
	} else
5142
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
5143

5144 5145 5146 5147
	/* Cancel scan to ensure that nothing interferes with connection */
	if (local->scanning)
		ieee80211_scan_cancel(local);

5148 5149 5150
	return 0;
}

5151 5152 5153
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
5154
{
J
Johannes Berg 已提交
5155 5156 5157
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
5158
	u16 auth_alg;
J
Johannes Berg 已提交
5159
	int err;
5160
	bool cont_auth;
J
Johannes Berg 已提交
5161 5162

	/* prepare auth data structure */
J
Johannes Berg 已提交
5163

5164 5165 5166 5167 5168
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
5169
		if (fips_enabled)
5170
			return -EOPNOTSUPP;
5171 5172 5173 5174 5175 5176 5177 5178
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
5179 5180 5181
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
5182 5183 5184 5185 5186 5187 5188 5189 5190
	case NL80211_AUTHTYPE_FILS_SK:
		auth_alg = WLAN_AUTH_FILS_SK;
		break;
	case NL80211_AUTHTYPE_FILS_SK_PFS:
		auth_alg = WLAN_AUTH_FILS_SK_PFS;
		break;
	case NL80211_AUTHTYPE_FILS_PK:
		auth_alg = WLAN_AUTH_FILS_PK;
		break;
5191 5192
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
5193
	}
5194

5195
	if (ifmgd->assoc_data)
5196 5197
		return -EBUSY;

5198
	auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
5199
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
5200
	if (!auth_data)
J
Johannes Berg 已提交
5201
		return -ENOMEM;
5202

J
Johannes Berg 已提交
5203
	auth_data->bss = req->bss;
5204

5205
	if (req->auth_data_len >= 4) {
5206 5207 5208 5209 5210 5211
		if (req->auth_type == NL80211_AUTHTYPE_SAE) {
			__le16 *pos = (__le16 *) req->auth_data;

			auth_data->sae_trans = le16_to_cpu(pos[0]);
			auth_data->sae_status = le16_to_cpu(pos[1]);
		}
5212 5213 5214
		memcpy(auth_data->data, req->auth_data + 4,
		       req->auth_data_len - 4);
		auth_data->data_len += req->auth_data_len - 4;
5215 5216
	}

5217 5218 5219 5220 5221 5222 5223
	/* Check if continuing authentication or trying to authenticate with the
	 * same BSS that we were in the process of authenticating with and avoid
	 * removal and re-addition of the STA entry in
	 * ieee80211_prep_connection().
	 */
	cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss;

5224
	if (req->ie && req->ie_len) {
5225 5226 5227
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
5228
	}
5229

J
Johannes Berg 已提交
5230
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
5231 5232 5233
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
5234 5235
	}

J
Johannes Berg 已提交
5236
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
5237

J
Johannes Berg 已提交
5238
	/* try to authenticate/probe */
5239

5240 5241 5242 5243 5244 5245 5246
	if (ifmgd->auth_data) {
		if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
			auth_data->peer_confirmed =
				ifmgd->auth_data->peer_confirmed;
		}
		ieee80211_destroy_auth_data(sdata, cont_auth);
	}
5247

J
Johannes Berg 已提交
5248 5249
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
5250

5251 5252 5253 5254 5255 5256 5257 5258 5259
	/* If this is continuation of an ongoing SAE authentication exchange
	 * (i.e., request to send SAE Confirm) and the peer has already
	 * confirmed, mark authentication completed since we are about to send
	 * out SAE Confirm.
	 */
	if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
	    auth_data->peer_confirmed && auth_data->sae_trans == 2)
		ieee80211_mark_sta_auth(sdata, req->bss->bssid);

5260 5261 5262
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5263 5264 5265
		sdata_info(sdata,
			   "disconnect from AP %pM for new auth to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5266 5267 5268 5269
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5270 5271 5272
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5273
	}
J
Johannes Berg 已提交
5274

J
Johannes Berg 已提交
5275
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
5276

5277
	err = ieee80211_prep_connection(sdata, req->bss, cont_auth, false);
5278
	if (err)
J
Johannes Berg 已提交
5279
		goto err_clear;
J
Johannes Berg 已提交
5280

5281
	err = ieee80211_auth(sdata);
J
Johannes Berg 已提交
5282 5283 5284 5285 5286 5287
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
5288
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
5289
	return 0;
J
Johannes Berg 已提交
5290 5291

 err_clear:
5292
	eth_zero_addr(ifmgd->bssid);
5293
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5294
	ifmgd->auth_data = NULL;
5295 5296 5297
	mutex_lock(&sdata->local->mtx);
	ieee80211_vif_release_channel(sdata);
	mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
5298 5299
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
5300 5301
}

5302 5303
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
5304
{
J
Johannes Berg 已提交
5305
	struct ieee80211_local *local = sdata->local;
5306
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5307
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
5308
	struct ieee80211_mgd_assoc_data *assoc_data;
5309
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
5310
	struct ieee80211_supported_band *sband;
5311
	const u8 *ssidie, *ht_ie, *vht_ie;
5312
	int i, err;
5313
	bool override = false;
5314

J
Johannes Berg 已提交
5315 5316 5317 5318
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

5319 5320
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
5321
	if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
5322 5323 5324 5325 5326 5327 5328 5329
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

5330 5331 5332
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5333 5334 5335
		sdata_info(sdata,
			   "disconnect from AP %pM for new assoc to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5336 5337 5338 5339
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5340 5341 5342
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5343
	}
J
Johannes Berg 已提交
5344 5345 5346 5347

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
5348
	}
5349

J
Johannes Berg 已提交
5350 5351 5352 5353
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
5354

J
Johannes Berg 已提交
5355 5356 5357 5358
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
5359
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
5360
		ieee80211_destroy_auth_data(sdata, match);
5361 5362
	}

J
Johannes Berg 已提交
5363
	/* prepare assoc data */
5364

5365 5366
	ifmgd->beacon_crc_valid = false;

5367 5368 5369
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);

J
Johannes Berg 已提交
5370 5371 5372 5373 5374 5375 5376
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
5377
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
5378 5379
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
5380
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
5381
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5382
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
L
Luca Coelho 已提交
5383
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5384
			netdev_info(sdata->dev,
5385
				    "disabling HT/VHT/HE due to WEP/TKIP use\n");
5386 5387
		}
	}
5388

J
Johannes Berg 已提交
5389 5390
	sband = local->hw.wiphy->bands[req->bss->channel->band];

5391 5392 5393
	/* also disable HT/VHT/HE if the AP doesn't use WMM */
	if (!bss->wmm_used) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5394
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5395 5396 5397
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
		netdev_info(sdata->dev,
			    "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
5398 5399
	}

B
Ben Greear 已提交
5400 5401 5402 5403
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

5404 5405 5406 5407
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

5408
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
5409 5410 5411
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
5412

5413 5414 5415 5416 5417 5418 5419 5420 5421 5422 5423 5424 5425 5426 5427
	if (req->fils_kek) {
		/* should already be checked in cfg80211 - so warn */
		if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
			err = -EINVAL;
			goto err_free;
		}
		memcpy(assoc_data->fils_kek, req->fils_kek,
		       req->fils_kek_len);
		assoc_data->fils_kek_len = req->fils_kek_len;
	}

	if (req->fils_nonces)
		memcpy(assoc_data->fils_nonces, req->fils_nonces,
		       2 * FILS_NONCE_LEN);

J
Johannes Berg 已提交
5428
	assoc_data->bss = req->bss;
5429

J
Johannes Berg 已提交
5430 5431
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
5432
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
5433
		else
5434
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
5435
	} else
5436
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
5437

J
Johannes Berg 已提交
5438 5439 5440
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
5441

5442
	rcu_read_lock();
5443 5444 5445 5446 5447
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
	else
5448
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5449 5450 5451 5452 5453 5454
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
	else
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5455
	rcu_read_unlock();
5456

5457
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
5458
		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
5459 5460 5461
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
5462
	if (bss->wmm_used && bss->uapsd_supported &&
5463
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
5464
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
5465 5466
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
5467
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
5468 5469 5470
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

5471
	if (req->prev_bssid)
J
Johannes Berg 已提交
5472
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
5473 5474 5475 5476 5477 5478 5479 5480 5481

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

5482 5483 5484 5485 5486
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

5487 5488 5489 5490 5491
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

5492 5493
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
5494 5495
	sdata->control_port_over_nl80211 =
					req->crypto.control_port_over_nl80211;
5496
	sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
5497 5498
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
5499

J
Johannes Berg 已提交
5500 5501 5502
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
5503
	ifmgd->dtim_period = 0;
5504
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
5505

5506 5507 5508 5509 5510 5511 5512 5513 5514 5515 5516 5517 5518 5519 5520 5521 5522 5523 5524 5525 5526 5527 5528 5529
	/* override HT/VHT configuration only if the AP and we support it */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
		struct ieee80211_sta_ht_cap sta_ht_cap;

		if (req->flags & ASSOC_REQ_DISABLE_HT)
			override = true;

		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

		/* check for 40 MHz disable override */
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
		    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
		    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
			override = true;

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
		    req->flags & ASSOC_REQ_DISABLE_VHT)
			override = true;
	}

	if (req->flags & ASSOC_REQ_DISABLE_HT) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5530
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5531 5532 5533 5534 5535 5536
	}

	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	err = ieee80211_prep_connection(sdata, req->bss, true, override);
5537 5538
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
5539

5540 5541
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
5542

5543
	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
5544 5545 5546 5547 5548 5549 5550 5551
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
5552
		assoc_data->timeout_started = true;
5553 5554
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
S
Sara Sharon 已提交
5555
		const u8 *ie;
5556 5557
		u8 dtim_count = 0;

S
Sara Sharon 已提交
5558 5559 5560
		ieee80211_get_dtim(beacon_ies, &dtim_count,
				   &ifmgd->dtim_period);

5561
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
5562
		assoc_data->timeout = jiffies;
5563
		assoc_data->timeout_started = true;
5564

5565
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5566 5567 5568 5569 5570
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
S
Sara Sharon 已提交
5571 5572 5573 5574 5575 5576 5577 5578 5579 5580 5581

		ie = cfg80211_find_ext_ie(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
					  beacon_ies->data, beacon_ies->len);
		if (ie && ie[1] >= 3)
			sdata->vif.bss_conf.profile_periodicity = ie[4];

		ie = cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY,
				      beacon_ies->data, beacon_ies->len);
		if (ie && ie[1] >= 11 &&
		    (ie[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			sdata->vif.bss_conf.ema_ap = true;
5582 5583
	} else {
		assoc_data->timeout = jiffies;
5584
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
5585
	}
5586 5587
	rcu_read_unlock();

5588
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
5589

P
Paul Stewart 已提交
5590 5591 5592 5593 5594 5595 5596 5597 5598 5599
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
5600 5601
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
5602 5603
	}

5604
	return 0;
J
Johannes Berg 已提交
5605
 err_clear:
5606
	eth_zero_addr(ifmgd->bssid);
5607
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5608 5609 5610 5611
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
5612 5613
}

5614
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
5615
			 struct cfg80211_deauth_request *req)
5616
{
5617
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5618
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5619
	bool tx = !req->local_state_change;
5620

5621 5622 5623 5624 5625 5626
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
5627

5628
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5629
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5630
					       IEEE80211_STYPE_DEAUTH,
5631
					       req->reason_code, tx,
5632
					       frame_buf);
5633
		ieee80211_destroy_auth_data(sdata, false);
5634 5635 5636
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5637

5638
		return 0;
5639 5640
	}

5641 5642 5643 5644 5645 5646 5647
	if (ifmgd->assoc_data &&
	    ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting association with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5648
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5649
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5650 5651 5652
					       IEEE80211_STYPE_DEAUTH,
					       req->reason_code, tx,
					       frame_buf);
5653
		ieee80211_destroy_assoc_data(sdata, false, true);
5654 5655 5656 5657 5658 5659
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
		return 0;
	}

5660 5661
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
5662 5663 5664 5665 5666
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5667 5668
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
5669 5670 5671
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5672 5673
		return 0;
	}
5674

5675
	return -ENOTCONN;
5676
}
5677

5678
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
5679
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
5680
{
5681
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5682
	u8 bssid[ETH_ALEN];
5683
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
5684

J
Johannes Berg 已提交
5685 5686 5687 5688 5689 5690
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
5691
	if (ifmgd->associated != req->bss)
5692 5693
		return -ENOLINK;

J
Johannes Berg 已提交
5694
	sdata_info(sdata,
5695 5696
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
5697

5698
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
5699 5700 5701
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
5702

5703 5704
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    req->reason_code);
5705

5706 5707
	return 0;
}
5708

5709
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
5710 5711 5712
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

5713 5714 5715 5716 5717 5718 5719 5720 5721 5722
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
5723
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5724

5725
	sdata_lock(sdata);
5726 5727
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5728
		ieee80211_destroy_assoc_data(sdata, false, false);
5729 5730
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
5731 5732
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
5733 5734 5735 5736 5737 5738
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
5739 5740 5741
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = NULL;
	ifmgd->assoc_req_ies_len = 0;
5742
	spin_unlock_bh(&ifmgd->teardown_lock);
5743
	del_timer_sync(&ifmgd->timer);
5744
	sdata_unlock(sdata);
5745 5746
}

5747 5748
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
5749
			       s32 rssi_level,
5750 5751 5752 5753
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

5754
	trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
J
Johannes Berg 已提交
5755

5756
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
5757 5758
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
5759 5760 5761 5762 5763 5764 5765 5766 5767 5768

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);