mlme.c 143.6 KB
Newer Older
1 2
/*
 * BSS client mode implementation
3
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4 5 6 7
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8
 * Copyright 2013-2014  Intel Mobile Communications GmbH
9
 * Copyright (C) 2015 Intel Deutschland GmbH
10 11 12 13 14 15
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

16
#include <linux/delay.h>
17 18 19 20
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
21
#include <linux/moduleparam.h>
22
#include <linux/rtnetlink.h>
23
#include <linux/crc32.h>
24
#include <linux/slab.h>
25
#include <linux/export.h>
26
#include <net/mac80211.h>
27
#include <asm/unaligned.h>
J
Johannes Berg 已提交
28

29
#include "ieee80211_i.h"
30
#include "driver-ops.h"
J
Johannes Berg 已提交
31 32
#include "rate.h"
#include "led.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36 37 38 39
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
40
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
41 42
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
43

44 45 46 47 48 49 50 51 52
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
53 54

/*
55 56 57 58 59 60
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
61
 */
62 63 64 65
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
66

J
Johannes Berg 已提交
67 68 69 70
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
71
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
72 73 74 75 76
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
77 78 79 80 81
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
82

83 84 85 86 87 88
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
89 90 91 92 93 94 95 96 97 98
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
99 100
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
101
{
102
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
103

104 105 106
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
107 108
}

109
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
110
{
111
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
112 113
		return;

114
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
115 116
		return;

J
Johannes Berg 已提交
117
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
118
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
119 120
}

121 122
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
123 124
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

125 126 127
	if (unlikely(!sdata->u.mgd.associated))
		return;

128 129
	ifmgd->probe_send_count = 0;

130
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
131 132 133 134 135 136
		return;

	mod_timer(&sdata->u.mgd.conn_mon_timer,
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

137
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
138
{
139
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
140 141
}

142 143 144 145
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
146
			     const struct ieee80211_ht_cap *ht_cap,
147 148
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
149
			     struct cfg80211_chan_def *chandef, bool tracking)
150
{
151
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
152
	struct cfg80211_chan_def vht_chandef;
153
	struct ieee80211_sta_ht_cap sta_ht_cap;
154 155
	u32 ht_cfreq, ret;

156 157 158
	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

159 160 161 162 163
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
	chandef->center_freq2 = 0;

164
	if (!ht_cap || !ht_oper || !sta_ht_cap.ht_supported) {
165 166 167 168 169 170
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

171 172
	if (!(ht_cap->cap_info &
	      cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
173
		ret = IEEE80211_STA_DISABLE_40MHZ;
174
		vht_chandef = *chandef;
175 176 177
		goto out;
	}

178 179 180
	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
181
	if (!tracking && channel->center_freq != ht_cfreq) {
182 183 184 185 186 187 188
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
189 190 191 192
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
193 194 195 196 197
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	/* check 40 MHz support, if we have it */
198
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
199 200 201 202 203 204 205 206 207 208 209 210 211
		switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
		case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 += 10;
			break;
		case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 -= 10;
			break;
		}
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
212 213
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	vht_chandef.chan = channel;
	vht_chandef.center_freq1 =
		ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
					       channel->band);
	vht_chandef.center_freq2 = 0;

	switch (vht_oper->chan_width) {
	case IEEE80211_VHT_CHANWIDTH_USE_HT:
		vht_chandef.width = chandef->width;
231
		vht_chandef.center_freq1 = chandef->center_freq1;
232 233 234 235 236 237 238 239 240
		break;
	case IEEE80211_VHT_CHANWIDTH_80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80;
		break;
	case IEEE80211_VHT_CHANWIDTH_160MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_160;
		break;
	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
241 242 243 244
		vht_chandef.center_freq2 =
			ieee80211_channel_to_frequency(
				vht_oper->center_freq_seg2_idx,
				channel->band);
245 246
		break;
	default:
247
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
248 249 250
			sdata_info(sdata,
				   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
				   vht_oper->chan_width);
251 252 253 254 255
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
256
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
257 258
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
259 260 261 262 263 264 265 266 267 268
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
269
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
270 271
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
272 273 274 275 276 277 278 279 280
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

303 304 305 306
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

307 308 309 310 311 312 313 314
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
315
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
316 317
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
318 319 320
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
			      IEEE80211_STA_DISABLE_VHT;
321
			break;
322 323
		}

324
		ret |= ieee80211_chandef_downgrade(chandef);
325 326
	}

327
	if (chandef->width != vht_chandef.width && !tracking)
328 329 330 331 332 333 334
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

335 336
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
337
			       const struct ieee80211_ht_cap *ht_cap,
338 339 340
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
			       const u8 *bssid, u32 *changed)
341 342
{
	struct ieee80211_local *local = sdata->local;
343
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
344
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
345
	struct ieee80211_channel *chan;
346
	struct cfg80211_chan_def chandef;
347
	u16 ht_opmode;
348 349 350
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
351

352 353
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
354 355
		return 0;

356 357 358 359 360 361 362
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

363 364 365 366 367 368 369 370 371 372
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

373
	chan = sdata->vif.bss_conf.chandef.chan;
J
Johannes Berg 已提交
374
	sband = local->hw.wiphy->bands[chan->band];
375

376
	/* calculate new channel (type) based on HT/VHT operation IEs */
377 378 379
	flags = ieee80211_determine_chantype(sdata, sband, chan,
					     ht_cap, ht_oper, vht_oper,
					     &chandef, true);
380 381 382 383 384 385 386 387 388 389

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
390
		flags |= ieee80211_chandef_downgrade(&chandef);
391 392
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
393
		flags |= ieee80211_chandef_downgrade(&chandef);
394 395
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
396
		flags |= ieee80211_chandef_downgrade(&chandef);
397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
		   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
		   chandef.center_freq1, chandef.center_freq2);

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
423
	case NL80211_CHAN_WIDTH_40:
424
		new_sta_bw = IEEE80211_STA_RX_BW_40;
425
		break;
426 427 428 429 430 431
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
432
		break;
433 434
	default:
		return -EINVAL;
435
	}
436

437 438
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
439

440 441 442 443 444
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
445

446 447 448 449 450 451 452
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
453

454 455 456 457
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
458
	}
459

460
	return 0;
461 462
}

J
Johannes Berg 已提交
463 464
/* frame sending functions */

J
Johannes Berg 已提交
465
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
466
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

484
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
485 486 487 488 489 490 491 492 493 494 495 496 497 498
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

499 500 501 502 503 504 505 506 507 508
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

534 535 536 537
/* This function determines vht capability flags for the association
 * and builds the IE.
 * Note - the function may set the owner of the MU-MIMO capability
 */
538 539
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
540 541
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
542
{
543
	struct ieee80211_local *local = sdata->local;
544 545 546
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
547
	u32 mask, ap_bf_sts, our_bf_sts;
548 549 550 551

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
552
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
553 554 555 556

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
557
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
558 559 560 561 562 563
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
564 565 566 567
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
568
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
569 570
	}

571 572 573 574 575 576
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604
		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
	else if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

	/*
	 * If some other vif is using the MU-MIMO capablity we cannot associate
	 * using MU-MIMO - this will lead to contradictions in the group-id
	 * mechanism.
	 * Ownership is defined since association request, in order to avoid
	 * simultaneous associations with MU-MIMO.
	 */
	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
		bool disable_mu_mimo = false;
		struct ieee80211_sub_if_data *other;

		list_for_each_entry_rcu(other, &local->interfaces, list) {
			if (other->flags & IEEE80211_SDATA_MU_MIMO_OWNER) {
				disable_mu_mimo = true;
				break;
			}
		}
		if (disable_mu_mimo)
			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
		else
			sdata->flags |= IEEE80211_SDATA_MU_MIMO_OWNER;
	}
605

606 607 608 609 610 611 612 613 614 615
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

616
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
617
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
618 619 620
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

J
Johannes Berg 已提交
621 622 623 624 625 626 627 628 629
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
	u8 *pos, qos_info;
	size_t offset = 0, noffset;
630
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
631 632
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
633 634
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
635
	u32 rate_flags, rates = 0;
J
Johannes Berg 已提交
636

637
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
638

J
Johannes Berg 已提交
639 640 641 642 643 644
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
645
	chan = chanctx_conf->def.chan;
646
	rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
J
Johannes Berg 已提交
647 648
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
649
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
650 651 652 653 654 655 656 657

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
658 659 660 661
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
662 663 664 665 666 667
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
668 669 670 671 672 673 674 675
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			if ((rate_flags & sband->bitrates[i].flags)
			    != rate_flags)
				continue;
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
676 677 678 679 680 681 682 683 684
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
685
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
J
Johannes Berg 已提交
686 687 688 689 690 691 692 693 694 695 696
			assoc_data->ie_len + /* extra IEs */
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

	if (sband->band == IEEE80211_BAND_2GHZ) {
697 698
		capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
J
Johannes Berg 已提交
699 700 701 702 703 704
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
705
	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
J
Johannes Berg 已提交
706 707
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

708 709 710
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

J
Johannes Berg 已提交
711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752
	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(mgmt, 0, 24);
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
753 754 755
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
756 757 758 759 760 761 762 763 764 765 766 767
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
768 769 770 771
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
772 773 774 775
			}
		}
	}

776 777
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
778 779 780 781
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
782 783
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
784
	}
J
Johannes Berg 已提交
785

786
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
J
Johannes Berg 已提交
787 788 789 790 791 792 793 794 795 796 797 798
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

	/* if present, add any custom IEs that go before HT */
799
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
800 801 802 803 804 805 806 807 808 809
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
810 811
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
812 813
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
			/* 60GHz doesn't happen right now */
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
J
Johannes Berg 已提交
834 835 836 837 838
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

J
Johannes Berg 已提交
839 840 841 842
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

843
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
844
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
845
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
846

847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
		};
867 868

		/* RIC already taken above, so no need to handle here anymore */
869 870 871 872 873 874 875 876
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

877
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
878 879
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
880

J
Johannes Berg 已提交
881
	/* if present, add any custom non-vendor IEs that go after HT */
882
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
883 884 885 886 887 888 889 890
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

891 892
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
893 894
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
895 896 897 898 899
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

900
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
901 902 903
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
904
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
905 906 907 908 909
		noffset = assoc_data->ie_len;
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
	}

J
Johannes Berg 已提交
910 911
	drv_mgd_prepare_tx(local, sdata);

J
Johannes Berg 已提交
912
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
913
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
914 915
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
916 917 918
	ieee80211_tx_skb(sdata, skb);
}

919 920 921 922 923 924
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

925 926
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
927 928
		return;

929 930
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
931

932 933
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
934 935
}

936 937
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
938
			     bool powersave)
939 940
{
	struct sk_buff *skb;
941
	struct ieee80211_hdr_3addr *nullfunc;
942
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
943

944 945
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
	if (!skb)
946 947
		return;

948
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
949
	if (powersave)
950
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
951

952 953
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
954

955
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
956 957
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

958
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
959 960
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

961
	ieee80211_tx_skb(sdata, skb);
962 963
}

964 965 966 967 968 969 970 971 972 973 974
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
975
	if (!skb)
976
		return;
977

978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993
	skb_reserve(skb, local->hw.extra_tx_headroom);

	nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
	memset(nullfunc, 0, 30);
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

994 995 996 997 998
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
999
	struct ieee80211_local *local = sdata->local;
1000
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1001
	int ret;
1002

1003
	if (!ieee80211_sdata_running(sdata))
1004 1005
		return;

1006
	sdata_lock(sdata);
1007 1008 1009
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

1010 1011
	if (!ifmgd->associated)
		goto out;
1012

1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1047
		sdata_info(sdata,
1048
			   "failed to finalize channel switch, disconnecting\n");
1049 1050 1051 1052
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1053

1054
	/* XXX: shouldn't really modify cfg80211-owned data! */
1055
	ifmgd->associated->channel = sdata->csa_chandef.chan;
1056

1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1077

1078 1079 1080 1081 1082
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1083

1084 1085 1086
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1087 1088 1089 1090 1091 1092
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1093
		return;
1094
	}
1095 1096

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1097 1098
}

1099 1100
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1101 1102
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1103 1104 1105

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1106 1107 1108 1109 1110 1111
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1112 1113 1114 1115
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1116 1117 1118 1119
static void ieee80211_chswitch_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
1120

1121
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1122 1123
}

1124
static void
J
Johannes Berg 已提交
1125
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1126 1127
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1128
				 bool beacon)
1129
{
1130
	struct ieee80211_local *local = sdata->local;
1131
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1132
	struct cfg80211_bss *cbss = ifmgd->associated;
1133
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1134
	struct ieee80211_chanctx *chanctx;
1135
	enum ieee80211_band current_band;
1136
	struct ieee80211_csa_ie csa_ie;
1137
	struct ieee80211_channel_switch ch_switch;
1138
	int res;
1139

1140
	sdata_assert_lock(sdata);
1141

1142
	if (!cbss)
1143 1144
		return;

1145
	if (local->scanning)
1146 1147
		return;

1148
	/* disregard subsequent announcements if we are already processing */
1149
	if (sdata->vif.csa_active)
1150 1151
		return;

1152
	current_band = cbss->channel->band;
1153
	memset(&csa_ie, 0, sizeof(csa_ie));
1154
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1155
					   ifmgd->flags,
1156
					   ifmgd->associated->bssid, &csa_ie);
1157
	if (res	< 0)
1158
		ieee80211_queue_work(&local->hw,
1159
				     &ifmgd->csa_connection_drop_work);
1160
	if (res)
1161
		return;
1162

1163
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1164 1165 1166
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1167
			   ifmgd->associated->bssid,
1168 1169 1170
			   csa_ie.chandef.chan->center_freq,
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
			   csa_ie.chandef.center_freq2);
1171 1172 1173 1174 1175
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186
	if (cfg80211_chandef_identical(&csa_ie.chandef,
				       &sdata->vif.bss_conf.chandef)) {
		if (ifmgd->csa_ignored_same_chan)
			return;
		sdata_info(sdata,
			   "AP %pM tries to chanswitch to same channel, ignore\n",
			   ifmgd->associated->bssid);
		ifmgd->csa_ignored_same_chan = true;
		return;
	}

1187 1188 1189 1190 1191 1192 1193 1194
	/*
	 * Drop all TDLS peers - either we disconnect or move to a different
	 * channel from this point on. There's no telling what our peer will do.
	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
	 * have an incompatible wider chandef.
	 */
	ieee80211_teardown_tdls_peers(sdata);

1195
	mutex_lock(&local->mtx);
1196
	mutex_lock(&local->chanctx_mtx);
1197 1198 1199 1200 1201
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
1202
		goto drop_connection;
1203 1204 1205 1206
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1207
	if (local->use_chanctx &&
1208
	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1209 1210
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
1211
		goto drop_connection;
J
Johannes Berg 已提交
1212 1213
	}

1214 1215 1216 1217 1218 1219 1220 1221 1222
	ch_switch.timestamp = timestamp;
	ch_switch.device_timestamp = device_timestamp;
	ch_switch.block_tx = csa_ie.mode;
	ch_switch.chandef = csa_ie.chandef;
	ch_switch.count = csa_ie.count;

	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
1223
		goto drop_connection;
1224 1225
	}

1226 1227 1228
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1229
		sdata_info(sdata,
1230 1231
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1232
		goto drop_connection;
J
Johannes Berg 已提交
1233
	}
1234
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1235

1236
	sdata->vif.csa_active = true;
1237
	sdata->csa_chandef = csa_ie.chandef;
1238
	sdata->csa_block_tx = csa_ie.mode;
1239
	ifmgd->csa_ignored_same_chan = false;
J
Johannes Berg 已提交
1240

1241
	if (sdata->csa_block_tx)
1242 1243
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1244
	mutex_unlock(&local->mtx);
1245

1246 1247 1248
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1249
	if (local->ops->channel_switch) {
1250
		/* use driver's channel switch callback */
1251
		drv_channel_switch(local, sdata, &ch_switch);
1252 1253 1254 1255
		return;
	}

	/* channel switch handled in software */
1256
	if (csa_ie.count <= 1)
1257
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1258
	else
1259
		mod_timer(&ifmgd->chswitch_timer,
1260 1261
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1262 1263 1264 1265 1266
	return;
 drop_connection:
	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
1267 1268
}

1269 1270 1271 1272 1273 1274
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1275
{
1276 1277
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1278
	int i, chan_increment;
1279
	bool have_chan_pwr = false;
1280

1281 1282
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1283
		return false;
1284

1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
	case IEEE80211_BAND_2GHZ:
	case IEEE80211_BAND_60GHZ:
		chan_increment = 1;
		break;
	case IEEE80211_BAND_5GHZ:
		chan_increment = 4;
		break;
1299
	}
1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1311
				*chan_pwr = triplet->chans.max_power;
1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1323
	if (have_chan_pwr && pwr_constr_elem)
1324
		*pwr_reduction = *pwr_constr_elem;
1325 1326 1327
	else
		*pwr_reduction = 0;

1328 1329 1330
	return have_chan_pwr;
}

1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1345 1346 1347 1348
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1349 1350
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1351
{
1352 1353 1354
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1355
	int new_ap_level;
1356
	__le16 capab = mgmt->u.probe_resp.capab_info;
1357

1358 1359 1360
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1361 1362 1363
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1364 1365 1366 1367 1368 1369 1370 1371
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1372
	}
1373

1374
	if (!has_80211h_pwr && !has_cisco_pwr)
1375
		return 0;
1376

1377 1378 1379 1380 1381
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1382 1383 1384 1385
		sdata_dbg(sdata,
			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			  sdata->u.mgd.bssid);
1386 1387
		new_ap_level = pwr_level_80211h;
	} else {  /* has_cisco_pwr is always true here. */
1388 1389 1390
		sdata_dbg(sdata,
			  "Limiting TX power to %d dBm as advertised by %pM\n",
			  pwr_level_cisco, sdata->u.mgd.bssid);
1391 1392
		new_ap_level = pwr_level_cisco;
	}
1393

1394 1395
	if (sdata->ap_power_level == new_ap_level)
		return 0;
1396

1397 1398 1399 1400
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1401 1402
}

1403 1404 1405 1406 1407 1408
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1409 1410 1411 1412
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1413
	if (local->scanning)
J
Johannes Berg 已提交
1414 1415
		return;

1416
	if (conf->dynamic_ps_timeout > 0 &&
1417
	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1418 1419 1420
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
1421
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1422
			ieee80211_send_nullfunc(local, sdata, true);
1423

1424 1425
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1426 1427 1428 1429
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1447 1448 1449 1450
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1451
	bool authorized = false;
1452 1453 1454 1455

	if (!mgd->powersave)
		return false;

1456 1457 1458
	if (mgd->broken_ap)
		return false;

1459 1460 1461
	if (!mgd->associated)
		return false;

1462
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1463 1464
		return false;

1465
	if (!mgd->have_beacon)
1466 1467
		return false;

1468 1469 1470
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1471
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1472 1473
	rcu_read_unlock();

J
Johannes Berg 已提交
1474
	return authorized;
1475 1476
}

1477
/* need to hold RTNL or interface lock */
J
Johannes Berg 已提交
1478
void ieee80211_recalc_ps(struct ieee80211_local *local)
1479 1480 1481
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1482
	int timeout;
1483

1484
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1485 1486 1487 1488 1489
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1490
		if (!ieee80211_sdata_running(sdata))
1491
			continue;
1492 1493 1494 1495 1496 1497 1498 1499
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1500 1501 1502 1503 1504 1505
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1506
	if (count == 1 && ieee80211_powersave_allowed(found)) {
J
Johannes Berg 已提交
1507
		u8 dtimper = found->u.mgd.dtim_period;
1508 1509 1510 1511 1512
		s32 beaconint_us;

		beaconint_us = ieee80211_tu_to_usec(
					found->vif.bss_conf.beacon_int);

1513
		timeout = local->dynamic_ps_forced_timeout;
J
Johannes Berg 已提交
1514 1515
		if (timeout < 0)
			timeout = 100;
1516
		local->hw.conf.dynamic_ps_timeout = timeout;
1517

J
Johannes Berg 已提交
1518 1519 1520 1521 1522 1523
		/* If the TIM IE is invalid, pretend the value is 1 */
		if (!dtimper)
			dtimper = 1;

		local->hw.conf.ps_dtim_period = dtimper;
		local->ps_sdata = found;
1524
	} else {
1525
		local->ps_sdata = NULL;
1526
	}
1527 1528 1529 1530

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1531 1532 1533 1534 1535 1536 1537 1538 1539 1540
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1553
					IEEE80211_MAX_QUEUE_MAP,
1554 1555
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1556 1557 1558 1559 1560 1561 1562 1563
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1564
	struct ieee80211_if_managed *ifmgd;
1565 1566
	unsigned long flags;
	int q;
1567 1568 1569 1570 1571

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1572 1573
	ifmgd = &sdata->u.mgd;

1574 1575 1576
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1577
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1578 1579
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1580 1581 1582 1583 1584
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1603 1604
	}

1605
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1606
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1607
		if (drv_tx_frames_pending(local)) {
1608 1609 1610
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1611
		} else {
1612
			ieee80211_send_nullfunc(local, sdata, true);
1613
			/* Flush to get the tx status of nullfunc frame */
1614
			ieee80211_flush_queues(local, sdata, false);
1615
		}
1616 1617
	}

1618 1619
	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1620 1621 1622 1623 1624
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1625 1626 1627 1628 1629 1630
}

void ieee80211_dynamic_ps_timer(unsigned long data)
{
	struct ieee80211_local *local = (void *) data;

1631
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1632 1633
}

1634 1635 1636 1637 1638 1639 1640
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
	struct delayed_work *delayed_work =
		container_of(work, struct delayed_work, work);
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1641
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1642

1643 1644 1645 1646 1647 1648 1649 1650
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1651 1652
}

1653 1654 1655 1656 1657
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1658
	bool ret = false;
1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
			/* The loop will result in using BK even if it requires
			 * admission control, such configuration makes no sense
			 * and we have to transmit somehow - the AC selection
			 * does the same thing.
			 */
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1742
/* MLME */
1743
static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1744
				     struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
1745
				     const u8 *wmm_param, size_t wmm_param_len)
1746 1747
{
	struct ieee80211_tx_queue_params params;
1748
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1749 1750
	size_t left;
	int count;
J
Johannes Berg 已提交
1751 1752
	const u8 *pos;
	u8 uapsd_queues = 0;
1753

1754
	if (!local->ops->conf_tx)
1755
		return false;
1756

J
Johannes Berg 已提交
1757
	if (local->hw.queues < IEEE80211_NUM_ACS)
1758
		return false;
1759 1760

	if (!wmm_param)
1761
		return false;
1762

1763
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1764
		return false;
K
Kalle Valo 已提交
1765 1766

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1767
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
1768

1769
	count = wmm_param[6] & 0x0f;
1770
	if (count == ifmgd->wmm_last_param_set)
1771
		return false;
1772
	ifmgd->wmm_last_param_set = count;
1773 1774 1775 1776 1777 1778

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
1779
	sdata->wmm_acm = 0;
1780 1781 1782
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
1783
		bool uapsd = false;
1784 1785 1786
		int queue;

		switch (aci) {
1787
		case 1: /* AC_BK */
J
Johannes Berg 已提交
1788
			queue = 3;
J
Johannes Berg 已提交
1789
			if (acm)
Y
Yoni Divinsky 已提交
1790
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
1791 1792
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
1793
			break;
1794
		case 2: /* AC_VI */
J
Johannes Berg 已提交
1795
			queue = 1;
J
Johannes Berg 已提交
1796
			if (acm)
Y
Yoni Divinsky 已提交
1797
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
1798 1799
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
1800
			break;
1801
		case 3: /* AC_VO */
J
Johannes Berg 已提交
1802
			queue = 0;
J
Johannes Berg 已提交
1803
			if (acm)
Y
Yoni Divinsky 已提交
1804
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
1805 1806
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
1807
			break;
1808
		case 0: /* AC_BE */
1809
		default:
J
Johannes Berg 已提交
1810
			queue = 2;
J
Johannes Berg 已提交
1811
			if (acm)
Y
Yoni Divinsky 已提交
1812
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
1813 1814
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
1815 1816 1817 1818 1819 1820
			break;
		}

		params.aifs = pos[0] & 0x0f;
		params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params.cw_min = ecw2cw(pos[1] & 0x0f);
1821
		params.txop = get_unaligned_le16(pos + 2);
1822
		params.acm = acm;
K
Kalle Valo 已提交
1823 1824
		params.uapsd = uapsd;

J
Johannes Berg 已提交
1825
		mlme_dbg(sdata,
1826
			 "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
J
Johannes Berg 已提交
1827 1828
			 queue, aci, acm,
			 params.aifs, params.cw_min, params.cw_max,
1829 1830
			 params.txop, params.uapsd,
			 ifmgd->tx_tspec[queue].downgraded);
1831
		sdata->tx_conf[queue] = params;
1832 1833
		if (!ifmgd->tx_tspec[queue].downgraded &&
		    drv_conf_tx(local, sdata, queue, &params))
J
Johannes Berg 已提交
1834 1835 1836
			sdata_err(sdata,
				  "failed to set TX queue parameters for queue %d\n",
				  queue);
1837
	}
1838 1839

	/* enable WMM or activate new settings */
1840
	sdata->vif.bss_conf.qos = true;
1841
	return true;
1842 1843
}

1844 1845 1846 1847
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

1848
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1849 1850 1851 1852 1853 1854 1855 1856 1857 1858
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
1859 1860
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
1861
{
J
Johannes Berg 已提交
1862
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1863
	u32 changed = 0;
J
Johannes Berg 已提交
1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
J
Johannes Berg 已提交
1877
	if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1878
		use_short_slot = true;
1879

1880 1881 1882
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
1883
	}
1884

1885 1886
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
1887
		changed |= BSS_CHANGED_ERP_PREAMBLE;
1888
	}
1889

J
Johannes Berg 已提交
1890 1891 1892
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
1893 1894 1895 1896 1897
	}

	return changed;
}

1898
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1899
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
1900
				     u32 bss_info_changed)
1901
{
1902
	struct ieee80211_bss *bss = (void *)cbss->priv;
1903
	struct ieee80211_local *local = sdata->local;
1904
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1905

J
Johannes Berg 已提交
1906
	bss_info_changed |= BSS_CHANGED_ASSOC;
1907
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1908
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1909

1910
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1911
		beacon_loss_count * bss_conf->beacon_int));
1912

1913 1914
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1915

1916 1917
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

1918
	if (sdata->vif.p2p) {
1919
		const struct cfg80211_bss_ies *ies;
1920

1921 1922 1923 1924 1925 1926 1927 1928
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
1929 1930
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
1931
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
1932 1933
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
1934 1935
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
1936
		}
1937
		rcu_read_unlock();
1938 1939
	}

J
Johannes Berg 已提交
1940
	/* just to be sure */
1941
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
1942

1943
	ieee80211_led_assoc(local, 1);
1944

1945
	if (sdata->u.mgd.have_beacon) {
1946 1947 1948 1949 1950 1951 1952
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1953
		bss_conf->beacon_rate = bss->beacon_rate;
1954
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1955
	} else {
1956
		bss_conf->beacon_rate = NULL;
1957
		bss_conf->dtim_period = 0;
1958
	}
1959

1960
	bss_conf->assoc = 1;
1961

1962
	/* Tell the driver to monitor connection quality (if supported) */
1963
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1964
	    bss_conf->cqm_rssi_thold)
1965 1966
		bss_info_changed |= BSS_CHANGED_CQM;

1967
	/* Enable ARP filtering */
1968
	if (bss_conf->arp_addr_cnt)
1969 1970
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
1971
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1972

J
Johannes Berg 已提交
1973
	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
1974
	ieee80211_recalc_ps(local);
J
Johannes Berg 已提交
1975
	mutex_unlock(&local->iflist_mtx);
1976

1977
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
1978 1979
	ieee80211_recalc_ps_vif(sdata);

1980
	netif_carrier_on(sdata->dev);
1981 1982
}

1983
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1984 1985
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
1986
{
1987
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1988
	struct ieee80211_local *local = sdata->local;
1989
	u32 changed = 0;
1990

1991
	sdata_assert_lock(sdata);
1992

1993 1994 1995
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
1996 1997 1998
	if (WARN_ON(!ifmgd->associated))
		return;

1999 2000
	ieee80211_stop_poll(sdata);

2001
	ifmgd->associated = NULL;
2002 2003
	netif_carrier_off(sdata->dev);

2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2015 2016 2017
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2018 2019 2020
	/* make sure ongoing transmission finishes */
	synchronize_net();

2021 2022 2023 2024 2025 2026
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2027
	if (tx)
2028
		ieee80211_flush_queues(local, sdata, true);
2029

2030 2031
	/* deauthenticate/disassociate now */
	if (tx || frame_buf)
2032 2033
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
					       reason, tx, frame_buf);
2034

2035
	/* flush out frame - make sure the deauth was actually sent */
2036
	if (tx)
2037
		ieee80211_flush_queues(local, sdata, false);
2038

2039
	/* clear bssid only after building the needed mgmt frames */
2040
	eth_zero_addr(ifmgd->bssid);
2041

2042
	/* remove AP and TDLS peers */
2043
	sta_info_flush(sdata);
2044 2045

	/* finally reset all BSS / config parameters */
2046 2047 2048
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2049 2050
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2051

J
Janusz Dziedzic 已提交
2052 2053 2054
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2055

2056
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2057 2058
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2059 2060
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2061
	sdata->flags &= ~IEEE80211_SDATA_MU_MIMO_OWNER;
2062

2063
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2064

2065 2066 2067
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2068
	/* Disable ARP filtering */
2069
	if (sdata->vif.bss_conf.arp_addr_cnt)
2070 2071
		changed |= BSS_CHANGED_ARP_FILTER;

2072 2073 2074
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2075 2076
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2077
	ieee80211_bss_info_change_notify(sdata, changed);
2078

2079 2080 2081
	/* disassociated - set to defaults now */
	ieee80211_set_wmm_default(sdata, false);

2082 2083 2084 2085
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2086

2087
	sdata->vif.bss_conf.dtim_period = 0;
2088 2089
	sdata->vif.bss_conf.beacon_rate = NULL;

2090
	ifmgd->have_beacon = false;
2091

2092
	ifmgd->flags = 0;
2093
	mutex_lock(&local->mtx);
2094
	ieee80211_vif_release_channel(sdata);
2095 2096

	sdata->vif.csa_active = false;
2097
	ifmgd->csa_waiting_bcn = false;
2098
	ifmgd->csa_ignored_same_chan = false;
2099 2100 2101 2102 2103
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2104
	mutex_unlock(&local->mtx);
2105

2106 2107 2108 2109
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2110
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2111
}
2112

2113 2114 2115 2116 2117 2118 2119 2120
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2121 2122
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2123
	 */
J
Johannes Berg 已提交
2124 2125 2126
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2127
	ieee80211_sta_reset_conn_monitor(sdata);
2128
}
2129

2130 2131 2132
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2133
	struct ieee80211_local *local = sdata->local;
2134

2135
	mutex_lock(&local->mtx);
2136 2137
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2138

2139
	__ieee80211_stop_poll(sdata);
2140 2141

	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2142
	ieee80211_recalc_ps(local);
2143
	mutex_unlock(&local->iflist_mtx);
2144

2145
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2146
		goto out;
2147 2148 2149 2150 2151 2152 2153 2154 2155 2156 2157

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2158 2159
out:
	mutex_unlock(&local->mtx);
2160 2161
}

2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u16 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2197
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2198
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2199
{
2200 2201
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2202
	if (!ieee80211_is_data(hdr->frame_control))
2203 2204 2205 2206
	    return;

	if (ieee80211_is_nullfunc(hdr->frame_control) &&
	    sdata->u.mgd.probe_send_count > 0) {
2207
		if (ack)
2208
			ieee80211_sta_reset_conn_monitor(sdata);
2209 2210
		else
			sdata->u.mgd.nullfunc_failed = true;
2211
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2212
		return;
2213
	}
2214 2215 2216

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2217 2218
}

2219 2220 2221 2222
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2223
	u8 *dst = ifmgd->associated->bssid;
2224
	u8 unicast_limit = max(1, max_probe_tries - 3);
2225 2226 2227 2228 2229 2230 2231 2232

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2233

2234 2235 2236 2237 2238 2239 2240
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2241 2242
	ifmgd->probe_send_count++;

2243
	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2244
		ifmgd->nullfunc_failed = false;
2245
		ieee80211_send_nullfunc(sdata->local, sdata, false);
2246
	} else {
2247 2248
		int ssid_len;

2249
		rcu_read_lock();
2250
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2251 2252 2253 2254 2255
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2256
		ieee80211_send_probe_req(sdata, sdata->vif.addr, dst,
2257
					 ssid + 2, ssid_len, NULL,
2258
					 0, (u32) -1, true, 0,
J
Johannes Berg 已提交
2259
					 ifmgd->associated->channel, false);
2260
		rcu_read_unlock();
2261
	}
2262

2263
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2264
	run_again(sdata, ifmgd->probe_timeout);
2265 2266
}

J
Johannes Berg 已提交
2267 2268
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2269 2270
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2271
	bool already = false;
2272

2273
	if (!ieee80211_sdata_running(sdata))
2274 2275
		return;

2276
	sdata_lock(sdata);
2277 2278 2279 2280

	if (!ifmgd->associated)
		goto out;

2281 2282 2283 2284 2285 2286 2287
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2288
	if (beacon) {
J
Johannes Berg 已提交
2289
		mlme_dbg_ratelimited(sdata,
2290 2291
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2292

2293
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2294
	}
2295

J
Johannes Berg 已提交
2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2307
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2308 2309
		already = true;

E
Eliad Peller 已提交
2310 2311
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2312 2313
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2314 2315 2316
	if (already)
		goto out;

2317
	mutex_lock(&sdata->local->iflist_mtx);
J
Johannes Berg 已提交
2318
	ieee80211_recalc_ps(sdata->local);
2319 2320
	mutex_unlock(&sdata->local->iflist_mtx);

2321 2322
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2323
 out:
2324
	sdata_unlock(sdata);
2325 2326
}

2327 2328 2329 2330 2331
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2332
	struct cfg80211_bss *cbss;
2333 2334
	struct sk_buff *skb;
	const u8 *ssid;
2335
	int ssid_len;
2336 2337 2338 2339

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2340
	sdata_assert_lock(sdata);
2341

2342 2343 2344 2345 2346 2347 2348
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2349 2350
		return NULL;

2351
	rcu_read_lock();
2352
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2353 2354 2355 2356 2357
	if (WARN_ON_ONCE(ssid == NULL))
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2358
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2359
					(u32) -1, cbss->channel,
2360
					ssid + 2, ssid_len,
2361
					NULL, 0, true);
2362
	rcu_read_unlock();
2363 2364 2365 2366 2367

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385
static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
					const u8 *buf, size_t len, bool tx,
					u16 reason)
{
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
		.u.mlme.reason = reason,
	};

	if (tx)
		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
	else
		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);

	drv_event_callback(sdata->local, sdata, &event);
}

2386
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2387
{
2388
	struct ieee80211_local *local = sdata->local;
2389
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2390
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2391

2392
	sdata_lock(sdata);
2393
	if (!ifmgd->associated) {
2394
		sdata_unlock(sdata);
2395 2396 2397
		return;
	}

2398 2399
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2400
			       true, frame_buf);
2401
	mutex_lock(&local->mtx);
2402
	sdata->vif.csa_active = false;
2403
	ifmgd->csa_waiting_bcn = false;
2404 2405 2406 2407 2408
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2409
	mutex_unlock(&local->mtx);
2410

2411 2412 2413
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);

2414
	sdata_unlock(sdata);
2415 2416
}

2417
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2418 2419 2420
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2421
			     u.mgd.beacon_connection_loss_work);
2422 2423 2424 2425
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct sta_info *sta;

	if (ifmgd->associated) {
2426
		rcu_read_lock();
2427 2428 2429
		sta = sta_info_get(sdata, ifmgd->bssid);
		if (sta)
			sta->beacon_loss_count++;
2430
		rcu_read_unlock();
2431
	}
J
Johannes Berg 已提交
2432

2433
	if (ifmgd->connection_loss) {
2434 2435
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2436
		__ieee80211_disconnect(sdata);
2437
	} else {
2438
		ieee80211_mgd_probe_ap(sdata, true);
2439 2440 2441 2442 2443 2444 2445 2446 2447
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2448
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2449 2450
}

2451 2452 2453
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2454
	struct ieee80211_hw *hw = &sdata->local->hw;
2455

J
Johannes Berg 已提交
2456 2457
	trace_api_beacon_loss(sdata);

2458
	sdata->u.mgd.connection_loss = false;
2459
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2460 2461 2462
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2463 2464 2465 2466 2467
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2468 2469
	trace_api_connection_loss(sdata);

2470
	sdata->u.mgd.connection_loss = true;
2471 2472 2473 2474 2475
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2476 2477 2478 2479 2480
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2481
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2482 2483

	if (!assoc) {
2484 2485 2486 2487 2488 2489
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2490 2491
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

2492
		eth_zero_addr(sdata->u.mgd.bssid);
J
Johannes Berg 已提交
2493
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2494
		sdata->u.mgd.flags = 0;
2495
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2496
		ieee80211_vif_release_channel(sdata);
2497
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2498 2499
	}

2500
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2501 2502 2503 2504
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
					 bool assoc)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

	sdata_assert_lock(sdata);

	if (!assoc) {
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		eth_zero_addr(sdata->u.mgd.bssid);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
		sdata->u.mgd.flags = 0;
2524
		sdata->flags &= ~IEEE80211_SDATA_MU_MIMO_OWNER;
2525 2526 2527 2528 2529 2530 2531 2532 2533
		mutex_lock(&sdata->local->mtx);
		ieee80211_vif_release_channel(sdata);
		mutex_unlock(&sdata->local->mtx);
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

J
Johannes Berg 已提交
2534 2535 2536
static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2537
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2538 2539 2540
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2541
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2542 2543

	pos = mgmt->u.auth.variable;
2544
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2545 2546 2547
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
J
Johannes Berg 已提交
2548
	drv_mgd_prepare_tx(sdata->local, sdata);
2549
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2550 2551
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2552
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2553 2554 2555
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2556
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2557 2558
}

2559 2560
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2561 2562 2563 2564 2565
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
	struct sta_info *sta;
2566 2567 2568 2569
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = AUTH_EVENT,
	};
J
Johannes Berg 已提交
2570

2571
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2572 2573

	if (len < 24 + 6)
2574
		return;
J
Johannes Berg 已提交
2575 2576

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2577
		return;
J
Johannes Berg 已提交
2578 2579 2580

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2581
	if (!ether_addr_equal(bssid, mgmt->bssid))
2582
		return;
J
Johannes Berg 已提交
2583 2584 2585 2586 2587 2588

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2589 2590 2591 2592 2593
	    auth_transaction != ifmgd->auth_data->expected_transaction) {
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2594
		return;
2595
	}
J
Johannes Berg 已提交
2596 2597

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
2598 2599
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2600
		ieee80211_destroy_auth_data(sdata, false);
2601
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2602 2603 2604
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
2605
		return;
J
Johannes Berg 已提交
2606 2607 2608 2609 2610 2611
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
2612
	case WLAN_AUTH_SAE:
J
Johannes Berg 已提交
2613 2614 2615 2616 2617
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
2618
			return;
J
Johannes Berg 已提交
2619 2620 2621 2622 2623
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
2624
		return;
J
Johannes Berg 已提交
2625 2626
	}

2627 2628
	event.u.mlme.status = MLME_SUCCESS;
	drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
2629
	sdata_info(sdata, "authenticated\n");
J
Johannes Berg 已提交
2630 2631
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2632
	ifmgd->auth_data->timeout_started = true;
2633
	run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
2634

2635 2636 2637 2638 2639 2640
	if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
	    ifmgd->auth_data->expected_transaction != 2) {
		/*
		 * Report auth frame to user space for processing since another
		 * round of Authentication frames is still needed.
		 */
2641
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2642
		return;
2643 2644
	}

J
Johannes Berg 已提交
2645 2646 2647 2648 2649 2650 2651 2652
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
		goto out_err;
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
J
Johannes Berg 已提交
2653
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
J
Johannes Berg 已提交
2654 2655 2656 2657
		goto out_err;
	}
	mutex_unlock(&sdata->local->sta_mtx);

2658
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2659
	return;
J
Johannes Berg 已提交
2660 2661 2662 2663 2664
 out_err:
	mutex_unlock(&sdata->local->sta_mtx);
	/* ignore frame -- wait for timeout */
}

2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719 2720
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

static const char *ieee80211_get_reason_code_string(u16 reason_code)
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
2721

2722 2723
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
2724
{
2725
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2726
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2727

2728
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2729

2730
	if (len < 24 + 2)
2731
		return;
2732

2733 2734 2735
	if (ifmgd->associated &&
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
		const u8 *bssid = ifmgd->associated->bssid;
2736

2737 2738 2739
		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));
2740

2741
		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2742

2743 2744 2745 2746
		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
					    reason_code);
		return;
	}
2747

2748 2749 2750
	if (ifmgd->assoc_data &&
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
		const u8 *bssid = ifmgd->assoc_data->bss->bssid;
2751

2752 2753 2754 2755 2756 2757 2758 2759 2760 2761
		sdata_info(sdata,
			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));

		ieee80211_destroy_assoc_data(sdata, false);

		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
		return;
	}
2762 2763 2764
}


2765 2766
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
2767
{
2768
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2769 2770
	u16 reason_code;

2771
	sdata_assert_lock(sdata);
2772

J
Johannes Berg 已提交
2773
	if (len < 24 + 2)
2774
		return;
2775

J
Johannes Berg 已提交
2776
	if (!ifmgd->associated ||
2777
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2778
		return;
2779 2780 2781

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

J
Johannes Berg 已提交
2782 2783
	sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
		   mgmt->sa, reason_code);
2784

2785 2786
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

2787
	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
2788 2789
}

2790 2791 2792 2793
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
2794 2795
				int *min_rate, int *min_rate_index,
				int shift, u32 rate_flags)
2796 2797 2798 2799
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
2800
		int rate = supp_rates[i] & 0x7f;
2801 2802
		bool is_basic = !!(supp_rates[i] & 0x80);

2803
		if ((rate * 5 * (1 << shift)) > 110)
2804 2805 2806 2807 2808 2809 2810 2811 2812 2813 2814 2815 2816 2817 2818
			*have_higher_than_11mbit = true;

		/*
		 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
		 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
		 *
		 * Note: Even through the membership selector and the basic
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
		if (!!(supp_rates[i] & 0x80) &&
		    (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
2819 2820 2821 2822 2823 2824 2825 2826 2827
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];
			if ((rate_flags & br->flags) != rate_flags)
				continue;

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
2828 2829 2830
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
2831 2832
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
2833 2834 2835 2836 2837 2838 2839
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
2840

J
Johannes Berg 已提交
2841 2842
static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2843
				    struct ieee80211_mgmt *mgmt, size_t len)
2844
{
2845
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2846
	struct ieee80211_local *local = sdata->local;
2847
	struct ieee80211_supported_band *sband;
2848
	struct sta_info *sta;
J
Johannes Berg 已提交
2849 2850
	u8 *pos;
	u16 capab_info, aid;
2851
	struct ieee802_11_elems elems;
J
Johannes Berg 已提交
2852
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2853 2854
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
J
Johannes Berg 已提交
2855
	u32 changed = 0;
2856
	int err;
2857
	bool ret;
2858

J
Johannes Berg 已提交
2859
	/* AssocResp and ReassocResp have identical structure */
2860 2861

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
2862
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2863

2864
	if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
J
Johannes Berg 已提交
2865 2866
		sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
			   aid);
2867 2868
	aid &= ~(BIT(15) | BIT(14));

2869 2870 2871
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
2872 2873
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
2874 2875 2876 2877
		aid = 0;
		ifmgd->broken_ap = true;
	}

J
Johannes Berg 已提交
2878
	pos = mgmt->u.assoc_resp.variable;
2879
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2880

2881
	if (!elems.supp_rates) {
J
Johannes Berg 已提交
2882
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
2883
		return false;
2884 2885
	}

2886
	ifmgd->aid = aid;
2887 2888 2889
	ifmgd->tdls_chan_switch_prohibited =
		elems.ext_capab && elems.ext_capab_len >= 5 &&
		(elems.ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
2890

2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
	if ((assoc_data->wmm && !elems.wmm_param) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	     (!elems.ht_cap_elem || !elems.ht_operation)) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	     (!elems.vht_cap_elem || !elems.vht_operation))) {
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
				       false, &bss_elems);
		if (assoc_data->wmm &&
		    !elems.wmm_param && bss_elems.wmm_param) {
			elems.wmm_param = bss_elems.wmm_param;
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
		if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_cap_elem = bss_elems.ht_cap_elem;
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
		if (!elems.ht_operation && bss_elems.ht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_operation = bss_elems.ht_operation;
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
		if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_cap_elem = bss_elems.vht_cap_elem;
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
		if (!elems.vht_operation && bss_elems.vht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_operation = bss_elems.vht_operation;
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

2954 2955 2956 2957 2958 2959 2960
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
		sdata_info(sdata,
2961 2962 2963
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
2964 2965 2966 2967 2968
	}

	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    (!elems.vht_cap_elem || !elems.vht_operation)) {
		sdata_info(sdata,
2969 2970 2971
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
2972 2973
	}

2974 2975 2976 2977 2978
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
2979
	sta = sta_info_get(sdata, cbss->bssid);
2980 2981
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
2982 2983
		ret = false;
		goto out;
2984
	}
2985

J
Johannes Berg 已提交
2986
	sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2987

2988
	/* Set up internal HT/VHT capabilities */
2989
	if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
2990
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2991
						  elems.ht_cap_elem, sta);
2992

M
Mahesh Palivela 已提交
2993 2994
	if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2995
						    elems.vht_cap_elem, sta);
M
Mahesh Palivela 已提交
2996

2997 2998 2999 3000 3001 3002
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
3003

3004 3005 3006 3007 3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
	if (elems.opmode_notif &&
	    !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
		u8 nss;

		nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

3019
	rate_control_rate_init(sta);
3020

3021
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
J
Johannes Berg 已提交
3022
		set_sta_flag(sta, WLAN_STA_MFP);
3023 3024 3025 3026
		sta->sta.mfp = true;
	} else {
		sta->sta.mfp = false;
	}
3027

3028
	sta->sta.wme = elems.wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3029

3030
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3031 3032 3033
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
3034 3035 3036
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
3037 3038
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
3039 3040
		ret = false;
		goto out;
3041 3042
	}

3043
	mutex_unlock(&sdata->local->sta_mtx);
3044

3045 3046 3047 3048 3049 3050 3051 3052
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;

3053
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) && elems.wmm_param)
3054
		ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
J
Johannes Berg 已提交
3055
					 elems.wmm_param_len);
3056
	else
3057 3058
		ieee80211_set_wmm_default(sdata, false);
	changed |= BSS_CHANGED_QOS;
3059

J
Johannes Berg 已提交
3060 3061 3062 3063
	/* set AID and assoc capability,
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->aid = aid;
	bss_conf->assoc_capability = capab_info;
3064
	ieee80211_set_associated(sdata, cbss, changed);
3065

3066 3067 3068 3069 3070 3071 3072
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3073
	/*
J
Johannes Berg 已提交
3074 3075
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3076
	 */
J
Johannes Berg 已提交
3077
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3078
	ieee80211_sta_reset_beacon_monitor(sdata);
3079

3080 3081 3082 3083
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3084 3085
}

3086 3087 3088
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3089 3090 3091 3092 3093
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3094
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3095 3096
	u8 *pos;
	bool reassoc;
3097
	struct cfg80211_bss *bss;
3098 3099 3100 3101
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = ASSOC_EVENT,
	};
J
Johannes Berg 已提交
3102

3103
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3104 3105

	if (!assoc_data)
3106
		return;
3107
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3108
		return;
J
Johannes Berg 已提交
3109 3110 3111 3112 3113 3114 3115

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3116
		return;
J
Johannes Berg 已提交
3117 3118 3119 3120 3121 3122

	reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3123 3124 3125 3126
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3127 3128

	pos = mgmt->u.assoc_resp.variable;
3129
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
3130 3131

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3132 3133
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3134
		u32 tu, ms;
3135
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3136
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3137 3138 3139
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3140
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3141
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3142
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3143 3144
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3145 3146
	}

3147
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3148 3149

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3150 3151
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
J
Johannes Berg 已提交
3152
		ieee80211_destroy_assoc_data(sdata, false);
3153 3154 3155
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3156
	} else {
3157
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
J
Johannes Berg 已提交
3158
			/* oops -- internal error -- send timeout for now */
3159
			ieee80211_destroy_assoc_data(sdata, false);
3160
			cfg80211_assoc_timeout(sdata->dev, bss);
3161
			return;
J
Johannes Berg 已提交
3162
		}
3163 3164
		event.u.mlme.status = MLME_SUCCESS;
		drv_event_callback(sdata->local, sdata, &event);
3165
		sdata_info(sdata, "associated\n");
3166 3167 3168 3169 3170 3171 3172

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
		ieee80211_destroy_assoc_data(sdata, true);
3173 3174 3175 3176 3177 3178

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
				uapsd_queues |= BIT(ac);
J
Johannes Berg 已提交
3179 3180
	}

3181
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues);
J
Johannes Berg 已提交
3182
}
J
Johannes Berg 已提交
3183

3184
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3185
				  struct ieee80211_mgmt *mgmt, size_t len,
3186
				  struct ieee80211_rx_status *rx_status,
3187
				  struct ieee802_11_elems *elems)
3188 3189
{
	struct ieee80211_local *local = sdata->local;
3190
	struct ieee80211_bss *bss;
3191
	struct ieee80211_channel *channel;
3192

3193
	sdata_assert_lock(sdata);
3194

3195 3196
	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
	if (!channel)
3197 3198 3199
		return;

	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
3200
					channel);
3201 3202
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3203
		ieee80211_rx_bss_put(local, bss);
3204
	}
3205 3206 3207
}


3208
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3209
					 struct sk_buff *skb)
3210
{
J
Johannes Berg 已提交
3211
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3212
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3213 3214
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
	size_t baselen, len = skb->len;
3215 3216
	struct ieee802_11_elems elems;

3217 3218
	ifmgd = &sdata->u.mgd;

3219
	sdata_assert_lock(sdata);
3220

3221
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
3222 3223
		return; /* ignore ProbeResp to foreign address */

3224 3225 3226 3227 3228
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
3229
			       false, &elems);
3230

3231
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3232

3233
	if (ifmgd->associated &&
3234
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3235
		ieee80211_reset_ap_probe(sdata);
3236 3237
}

3238 3239 3240
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3241 3242 3243
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3244 3245 3246 3247 3248 3249 3250 3251 3252 3253
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3254 3255 3256 3257 3258
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3259 3260
	(1ULL << WLAN_EID_HT_OPERATION) |
	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3261

3262 3263 3264
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
3265
{
3266
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3267
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3268 3269
	size_t baselen;
	struct ieee802_11_elems elems;
3270
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
3271 3272
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
3273
	struct sta_info *sta;
3274
	u32 changed = 0;
3275
	bool erp_valid;
J
Johannes Berg 已提交
3276
	u8 erp_value = 0;
3277
	u32 ncrc;
3278
	u8 *bssid;
3279
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
3280

3281
	sdata_assert_lock(sdata);
3282

3283 3284 3285
	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
3286
		return;
3287

J
Johannes Berg 已提交
3288 3289 3290 3291
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
3292
		return;
J
Johannes Berg 已提交
3293 3294
	}

3295
	if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
J
Johannes Berg 已提交
3296
		rcu_read_unlock();
3297
		return;
J
Johannes Berg 已提交
3298
	}
3299
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
3300
	rcu_read_unlock();
3301

3302
	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
3303
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
J
Johannes Berg 已提交
3304
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3305
				       len - baselen, false, &elems);
3306

3307
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3308 3309 3310 3311
		if (elems.tim && !elems.parse_error) {
			const struct ieee80211_tim_ie *tim_ie = elems.tim;
			ifmgd->dtim_period = tim_ie->dtim_period;
		}
3312
		ifmgd->have_beacon = true;
3313
		ifmgd->assoc_data->need_beacon = false;
3314
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
3315 3316 3317 3318 3319 3320 3321 3322 3323 3324
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
			if (elems.tim)
				sdata->vif.bss_conf.sync_dtim_count =
					elems.tim->dtim_count;
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
3325 3326
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
3327
		ifmgd->assoc_data->timeout_started = true;
3328 3329
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3330
	}
3331

J
Johannes Berg 已提交
3332
	if (!ifmgd->associated ||
3333
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3334
		return;
J
Johannes Berg 已提交
3335
	bssid = ifmgd->associated->bssid;
3336

3337 3338 3339
	/* Track average RSSI from the Beacon frames of the current AP */
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3340
		ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3341
		ifmgd->last_cqm_event_signal = 0;
3342
		ifmgd->count_beacon_signal = 1;
3343
		ifmgd->last_ave_beacon_signal = 0;
3344
	} else {
3345
		ifmgd->count_beacon_signal++;
3346
	}
3347

3348 3349
	ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);

3350 3351
	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3352
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3353
		int last_sig = ifmgd->last_ave_beacon_signal;
3354 3355 3356
		struct ieee80211_event event = {
			.type = RSSI_EVENT,
		};
3357 3358 3359 3360 3361 3362 3363 3364

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3365 3366
			event.u.rssi.data = RSSI_EVENT_HIGH;
			drv_event_callback(local, sdata, &event);
3367 3368 3369 3370
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3371 3372
			event.u.rssi.data = RSSI_EVENT_LOW;
			drv_event_callback(local, sdata, &event);
3373 3374 3375
		}
	}

3376
	if (bss_conf->cqm_rssi_thold &&
3377
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3378
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3379
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3380 3381 3382
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
3383

3384 3385 3386 3387 3388 3389 3390 3391 3392 3393 3394 3395 3396 3397 3398 3399 3400
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				GFP_KERNEL);
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				GFP_KERNEL);
		}
	}

3401
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3402
		mlme_dbg_ratelimited(sdata,
3403
				     "cancelling AP probe due to a received beacon\n");
3404
		ieee80211_reset_ap_probe(sdata);
3405 3406
	}

J
Johannes Berg 已提交
3407 3408 3409 3410
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
3411
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
3412

3413 3414
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3415
					  len - baselen, false, &elems,
3416 3417
					  care_about_ies, ncrc);

3418 3419 3420 3421 3422 3423 3424
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
	    ieee80211_check_tim(elems.tim, elems.tim_len, ifmgd->aid)) {
		if (local->hw.conf.dynamic_ps_timeout > 0) {
			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
				ieee80211_hw_config(local,
						    IEEE80211_CONF_CHANGE_PS);
3425
			}
3426
			ieee80211_send_nullfunc(local, sdata, false);
3427 3428 3429 3430 3431 3432 3433 3434 3435 3436 3437 3438
		} else if (!local->pspolling && sdata->u.mgd.powersave) {
			local->pspolling = true;

			/*
			 * Here is assumed that the driver will be
			 * able to send ps-poll frame and receive a
			 * response even though power save mode is
			 * enabled, but some drivers might require
			 * to disable power save here. This needs
			 * to be investigated.
			 */
			ieee80211_send_pspoll(local, sdata);
3439 3440
		}
	}
J
Johannes Berg 已提交
3441

3442
	if (sdata->vif.p2p) {
J
Janusz Dziedzic 已提交
3443
		struct ieee80211_p2p_noa_attr noa = {};
3444 3445 3446 3447 3448
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3449
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
3450 3451 3452 3453 3454 3455 3456 3457 3458 3459 3460 3461 3462 3463 3464 3465
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3466 3467 3468 3469 3470
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

3471 3472 3473
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

3474 3475 3476 3477 3478 3479 3480 3481
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
3482
	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
3483 3484 3485 3486 3487 3488 3489 3490 3491 3492 3493
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
		if (elems.tim)
			sdata->vif.bss_conf.sync_dtim_count =
				elems.tim->dtim_count;
		else
			sdata->vif.bss_conf.sync_dtim_count = 0;
	}

3494
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3495
		return;
3496
	ifmgd->beacon_crc = ncrc;
3497
	ifmgd->beacon_crc_valid = true;
3498

3499
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3500

3501
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
3502
					 rx_status->device_timestamp,
3503 3504
					 &elems, true);

3505 3506
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3507 3508 3509
				     elems.wmm_param_len))
		changed |= BSS_CHANGED_QOS;

3510 3511
	/*
	 * If we haven't had a beacon before, tell the driver about the
3512
	 * DTIM period (and beacon timing if desired) now.
3513
	 */
3514
	if (!ifmgd->have_beacon) {
3515 3516 3517 3518 3519
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
		if (elems.tim)
			bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
		else
			bss_conf->dtim_period = 1;
3520

3521 3522
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
3523 3524

		mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
3525
		ieee80211_recalc_ps(local);
3526 3527
		mutex_unlock(&local->iflist_mtx);

3528
		ieee80211_recalc_ps_vif(sdata);
3529 3530
	}

3531
	if (elems.erp_info) {
J
Johannes Berg 已提交
3532 3533 3534 3535
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
3536
	}
J
Johannes Berg 已提交
3537 3538 3539
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
3540

3541
	mutex_lock(&local->sta_mtx);
3542 3543
	sta = sta_info_get(sdata, bssid);

3544 3545
	if (ieee80211_config_bw(sdata, sta,
				elems.ht_cap_elem, elems.ht_operation,
3546 3547 3548 3549 3550
				elems.vht_operation, bssid, &changed)) {
		mutex_unlock(&local->sta_mtx);
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
3551 3552 3553
		ieee80211_report_disconnect(sdata, deauth_buf,
					    sizeof(deauth_buf), true,
					    WLAN_REASON_DEAUTH_LEAVING);
3554
		return;
3555
	}
3556 3557 3558 3559

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
					    rx_status->band, true);
3560
	mutex_unlock(&local->sta_mtx);
3561

3562 3563 3564
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
3565 3566
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
3567

3568
	ieee80211_bss_info_change_notify(sdata, changed);
3569 3570
}

3571 3572
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
3573 3574 3575 3576
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
3577 3578
	struct ieee802_11_elems elems;
	int ies_len;
3579 3580 3581 3582 3583

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

3584
	sdata_lock(sdata);
3585

J
Johannes Berg 已提交
3586 3587
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
3588
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
3589 3590 3591 3592 3593
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
3594
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3595 3596
		break;
	case IEEE80211_STYPE_DEAUTH:
3597
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3598 3599
		break;
	case IEEE80211_STYPE_DISASSOC:
3600
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3601 3602 3603
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
3604
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3605 3606
		break;
	case IEEE80211_STYPE_ACTION:
3607
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3608 3609 3610
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
3611 3612 3613 3614 3615 3616

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
3617
				ies_len, true, &elems);
3618 3619 3620 3621

			if (elems.parse_error)
				break;

3622
			ieee80211_sta_process_chanswitch(sdata,
3623 3624 3625
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3626 3627 3628 3629 3630 3631 3632 3633 3634 3635
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
3636
				ies_len, true, &elems);
3637 3638 3639 3640 3641 3642 3643 3644

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
3645
			ieee80211_sta_process_chanswitch(sdata,
3646 3647 3648
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3649
		}
3650
		break;
3651
	}
3652
	sdata_unlock(sdata);
3653 3654
}

J
Johannes Berg 已提交
3655
static void ieee80211_sta_timer(unsigned long data)
3656
{
J
Johannes Berg 已提交
3657 3658
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
3659

3660
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3661 3662
}

3663
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3664
					  u8 *bssid, u8 reason, bool tx)
3665
{
3666
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3667

3668
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3669
			       tx, frame_buf);
3670

3671 3672
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    reason);
3673 3674
}

3675
static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
3676 3677 3678 3679
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3680
	u32 tx_flags = 0;
3681 3682
	u16 trans = 1;
	u16 status = 0;
J
Johannes Berg 已提交
3683

3684
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3685 3686 3687 3688 3689 3690 3691

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
3692 3693
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
3694 3695 3696 3697 3698 3699 3700 3701 3702 3703

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3704 3705
	drv_mgd_prepare_tx(local, sdata);

3706 3707 3708
	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
		   auth_data->bss->bssid, auth_data->tries,
		   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
3709

3710
	auth_data->expected_transaction = 2;
3711

3712 3713 3714 3715 3716
	if (auth_data->algorithm == WLAN_AUTH_SAE) {
		trans = auth_data->sae_trans;
		status = auth_data->sae_status;
		auth_data->expected_transaction = trans;
	}
J
Johannes Berg 已提交
3717

3718 3719 3720
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
3721

3722 3723 3724 3725 3726
	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
			    auth_data->data, auth_data->data_len,
			    auth_data->bss->bssid,
			    auth_data->bss->bssid, NULL, 0, 0,
			    tx_flags);
J
Johannes Berg 已提交
3727

3728
	if (tx_flags == 0) {
3729
		auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3730
		auth_data->timeout_started = true;
3731
		run_again(sdata, auth_data->timeout);
3732
	} else {
3733 3734 3735 3736
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
		auth_data->timeout_started = true;
		run_again(sdata, auth_data->timeout);
3737
	}
J
Johannes Berg 已提交
3738 3739 3740 3741 3742 3743 3744 3745 3746

	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

3747
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3748 3749 3750

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
3751 3752
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
3753 3754 3755 3756 3757 3758 3759 3760 3761 3762

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3763 3764 3765
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
3766 3767
	ieee80211_send_assoc(sdata);

3768
	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
3769
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3770
		assoc_data->timeout_started = true;
3771
		run_again(sdata, assoc_data->timeout);
3772
	} else {
3773 3774 3775 3776 3777
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
3778
	}
J
Johannes Berg 已提交
3779 3780 3781 3782

	return 0;
}

3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

3795
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
3796 3797
{
	struct ieee80211_local *local = sdata->local;
3798
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3799

3800
	sdata_lock(sdata);
3801

3802 3803 3804 3805 3806
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
3807
		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
3808 3809 3810
			if (status_acked) {
				ifmgd->auth_data->timeout =
					jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3811
				run_again(sdata, ifmgd->auth_data->timeout);
3812 3813 3814
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
3815
			ifmgd->auth_data->timeout_started = true;
3816 3817 3818 3819 3820 3821
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3822
				run_again(sdata, ifmgd->assoc_data->timeout);
3823 3824 3825
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
3826
			ifmgd->assoc_data->timeout_started = true;
3827 3828 3829
		}
	}

3830
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
3831 3832 3833 3834 3835 3836 3837
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
3838
		} else if (ieee80211_auth(sdata)) {
J
Johannes Berg 已提交
3839
			u8 bssid[ETH_ALEN];
3840 3841 3842 3843 3844
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = AUTH_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
3845 3846 3847 3848 3849

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

3850
			cfg80211_auth_timeout(sdata->dev, bssid);
3851
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3852
		}
3853
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3854
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
3855

3856
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
3857
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
3858
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
3859
		    ieee80211_do_assoc(sdata)) {
3860
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
3861 3862 3863 3864 3865
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = ASSOC_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
3866 3867

			ieee80211_destroy_assoc_data(sdata, false);
3868
			cfg80211_assoc_timeout(sdata->dev, bss);
3869
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3870
		}
3871
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3872
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
3873

3874
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
3875
	    ifmgd->associated) {
3876
		u8 bssid[ETH_ALEN];
3877
		int max_tries;
3878

3879
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3880

3881
		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3882
			max_tries = max_nullfunc_tries;
3883
		else
3884
			max_tries = max_probe_tries;
3885

3886 3887 3888
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
3889 3890
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3891 3892 3893 3894
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
3895 3896
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
3897 3898 3899
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
3900
				ieee80211_sta_connection_lost(sdata, bssid,
3901 3902
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
3903 3904
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
3905
			run_again(sdata, ifmgd->probe_timeout);
3906
		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
J
Johannes Berg 已提交
3907 3908 3909
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
3910
			ieee80211_sta_connection_lost(sdata, bssid,
3911
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3912
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3913 3914 3915 3916
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
3917 3918
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
3919 3920 3921 3922
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
3923 3924 3925 3926
			wiphy_debug(local->hw.wiphy,
				    "%s: No probe response from AP %pM"
				    " after %dms, disconnecting.\n",
				    sdata->name,
3927
				    bssid, probe_wait_ms);
3928

3929
			ieee80211_sta_connection_lost(sdata, bssid,
3930
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
3931 3932 3933
		}
	}

3934
	sdata_unlock(sdata);
3935 3936
}

J
Johannes Berg 已提交
3937 3938 3939 3940
static void ieee80211_sta_bcn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
3941
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3942

3943
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3944 3945
		return;

3946
	sdata->u.mgd.connection_loss = false;
3947 3948
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
3949 3950 3951 3952 3953 3954 3955 3956 3957
}

static void ieee80211_sta_conn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

3958
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3959 3960
		return;

3961
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
3962 3963 3964 3965 3966 3967 3968 3969 3970 3971 3972
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
3973 3974
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
3975
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3976
		__ieee80211_stop_poll(sdata);
3977

J
Johannes Berg 已提交
3978
		/* let's probe the connection once */
3979
		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
3980 3981
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
J
Johannes Berg 已提交
3982
		/* and do all the other regular work too */
J
Johannes Berg 已提交
3983
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3984
	}
J
Johannes Berg 已提交
3985
}
3986

3987
#ifdef CONFIG_PM
3988 3989 3990 3991 3992 3993 3994
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

3995 3996 3997 3998 3999
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

4000
		/*
4001 4002 4003
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
4004
		 */
4005
		ieee80211_send_deauth_disassoc(sdata, bssid,
4006 4007 4008
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
4009 4010 4011 4012
		if (ifmgd->assoc_data)
			ieee80211_destroy_assoc_data(sdata, false);
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
4013 4014 4015 4016
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

4017 4018 4019 4020 4021 4022 4023 4024 4025 4026 4027 4028 4029 4030 4031 4032 4033 4034 4035 4036 4037 4038 4039 4040 4041 4042 4043 4044
	/* This is a bit of a hack - we should find a better and more generic
	 * solution to this. Normally when suspending, cfg80211 will in fact
	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
	 * auth (not so important) or assoc (this is the problem) process.
	 *
	 * As a consequence, it can happen that we are in the process of both
	 * associating and suspending, and receive an association response
	 * after cfg80211 has checked if it needs to disconnect, but before
	 * we actually set the flag to drop incoming frames. This will then
	 * cause the workqueue flush to process the association response in
	 * the suspend, resulting in a successful association just before it
	 * tries to remove the interface from the driver, which now though
	 * has a channel context assigned ... this results in issues.
	 *
	 * To work around this (for now) simply deauth here again if we're
	 * now connected.
	 */
	if (ifmgd->associated && !sdata->local->wowlan) {
		u8 bssid[ETH_ALEN];
		struct cfg80211_deauth_request req = {
			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
			.bssid = bssid,
		};

		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
		ieee80211_mgd_deauth(sdata, &req);
	}

4045 4046 4047
	sdata_unlock(sdata);
}

4048 4049 4050 4051
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4052
	sdata_lock(sdata);
4053
	if (!ifmgd->associated) {
4054
		sdata_unlock(sdata);
4055 4056 4057 4058 4059 4060 4061 4062 4063 4064
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4065
		sdata_unlock(sdata);
4066 4067
		return;
	}
4068
	sdata_unlock(sdata);
4069 4070 4071
}
#endif

J
Johannes Berg 已提交
4072 4073
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4074
{
4075
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4076

4077
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4078
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4079
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4080 4081
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4082 4083
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4084
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4085 4086
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4087
	setup_timer(&ifmgd->timer, ieee80211_sta_timer,
S
Sujith 已提交
4088
		    (unsigned long) sdata);
J
Johannes Berg 已提交
4089 4090 4091 4092
	setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
		    (unsigned long) sdata);
	setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
		    (unsigned long) sdata);
4093
	setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
J
Johannes Berg 已提交
4094
		    (unsigned long) sdata);
4095 4096
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4097

4098
	ifmgd->flags = 0;
4099
	ifmgd->powersave = sdata->wdev.ps;
4100 4101
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4102
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4103

4104
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4105 4106 4107
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4108 4109 4110 4111 4112

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4113 4114
}

4115 4116
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4117
{
4118
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4119

4120 4121
	/* Restart STA timers */
	rcu_read_lock();
4122 4123 4124 4125
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4126 4127
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4128

J
Johannes Berg 已提交
4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4141
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4142 4143 4144 4145 4146 4147 4148 4149 4150 4151 4152 4153
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4154
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4155 4156 4157 4158 4159 4160 4161 4162 4163 4164 4165 4166 4167 4168 4169 4170 4171 4172
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

4173 4174
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4175 4176 4177
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4178
	const struct ieee80211_ht_cap *ht_cap = NULL;
4179
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4180
	const struct ieee80211_vht_operation *vht_oper = NULL;
4181
	struct ieee80211_supported_band *sband;
4182
	struct cfg80211_chan_def chandef;
J
Johannes Berg 已提交
4183
	int ret;
4184 4185
	u32 i;
	bool have_80mhz;
4186

4187 4188
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4189 4190 4191 4192
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4193 4194
	rcu_read_lock();

J
Johannes Berg 已提交
4195 4196
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    sband->ht_cap.ht_supported) {
4197
		const u8 *ht_oper_ie, *ht_cap_ie;
4198

4199
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4200 4201
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4202

4203 4204 4205 4206 4207
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4208 4209 4210
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4211 4212
	}

J
Johannes Berg 已提交
4213 4214
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    sband->vht_cap.vht_supported) {
4215
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4216

4217 4218
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4219 4220 4221 4222
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4223
			sdata_info(sdata,
J
Johannes Berg 已提交
4224
				   "AP advertised VHT without HT, disabling both\n");
4225 4226
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4227
		}
4228 4229 4230 4231 4232 4233

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4234 4235
	}

4236 4237 4238 4239 4240 4241 4242 4243 4244 4245 4246 4247 4248 4249
	/* Allow VHT if at least one channel on the sband supports 80 MHz */
	have_80mhz = false;
	for (i = 0; i < sband->n_channels; i++) {
		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
						IEEE80211_CHAN_NO_80MHZ))
			continue;

		have_80mhz = true;
		break;
	}

	if (!have_80mhz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4250 4251
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
4252
						     ht_cap, ht_oper, vht_oper,
4253
						     &chandef, false);
4254

J
Johannes Berg 已提交
4255 4256
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4257

4258 4259
	rcu_read_unlock();

4260 4261 4262
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4263
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4264 4265 4266 4267 4268 4269 4270
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4271 4272 4273 4274

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4275
		goto out;
4276

4277
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4278
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4279 4280 4281
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4282 4283
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4284
	return ret;
4285 4286 4287
}

static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
4288 4289
				     struct cfg80211_bss *cbss, bool assoc,
				     bool override)
4290 4291 4292 4293 4294
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
4295
	struct ieee80211_supported_band *sband;
4296
	bool have_sta = false;
4297 4298
	int err;

4299 4300
	sband = local->hw.wiphy->bands[cbss->channel->band];

4301 4302 4303 4304 4305 4306 4307 4308 4309 4310 4311 4312 4313 4314
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
4315

4316
	if (new_sta || override) {
4317 4318 4319 4320 4321 4322 4323 4324
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

J
Johannes Berg 已提交
4325
	if (new_sta) {
4326 4327 4328
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
4329
		struct ieee80211_chanctx_conf *chanctx_conf;
J
Johannes Berg 已提交
4330
		const struct cfg80211_bss_ies *ies;
4331
		int shift = ieee80211_vif_get_shift(&sdata->vif);
4332
		u32 rate_flags;
4333

4334 4335 4336 4337
		rcu_read_lock();
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
		if (WARN_ON(!chanctx_conf)) {
			rcu_read_unlock();
E
Eytan Lifshitz 已提交
4338
			sta_info_free(local, new_sta);
4339 4340 4341 4342
			return -EINVAL;
		}
		rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
		rcu_read_unlock();
4343 4344 4345 4346 4347

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
4348 4349
				    &min_rate, &min_rate_index,
				    shift, rate_flags);
4350 4351 4352 4353 4354 4355 4356 4357 4358 4359

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
		 */
		if (!basic_rates && min_rate_index >= 0) {
J
Johannes Berg 已提交
4360 4361
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
4362 4363 4364
			basic_rates = BIT(min_rate_index);
		}

J
Johannes Berg 已提交
4365
		new_sta->sta.supp_rates[cbss->channel->band] = rates;
4366 4367 4368
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
J
Johannes Berg 已提交
4369
		if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
4370 4371 4372 4373 4374 4375 4376
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

4377 4378
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
4379
		rcu_read_lock();
4380 4381 4382 4383 4384 4385 4386 4387 4388 4389 4390 4391 4392
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			const u8 *tim_ie;

			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						  ies->data, ies->len);
			if (tim_ie && tim_ie[1] >= 2)
				sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
4393 4394
		} else if (!ieee80211_hw_check(&sdata->local->hw,
					       TIMING_BEACON_ONLY)) {
4395 4396 4397 4398 4399 4400 4401 4402 4403 4404 4405
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
4406
		rcu_read_unlock();
4407 4408

		/* tell driver about BSSID, basic rates and timing */
4409
		ieee80211_bss_info_change_notify(sdata,
4410 4411
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
4412 4413

		if (assoc)
J
Johannes Berg 已提交
4414
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
4415

J
Johannes Berg 已提交
4416 4417
		err = sta_info_insert(new_sta);
		new_sta = NULL;
4418
		if (err) {
J
Johannes Berg 已提交
4419 4420 4421
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
4422 4423 4424
			return err;
		}
	} else
4425
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4426

4427 4428 4429 4430
	/* Cancel scan to ensure that nothing interferes with connection */
	if (local->scanning)
		ieee80211_scan_cancel(local);

4431 4432 4433
	return 0;
}

4434 4435 4436
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
4437
{
J
Johannes Berg 已提交
4438 4439 4440
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
4441
	u16 auth_alg;
J
Johannes Berg 已提交
4442 4443 4444
	int err;

	/* prepare auth data structure */
J
Johannes Berg 已提交
4445

4446 4447 4448 4449 4450
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
J
Johannes Berg 已提交
4451
		if (IS_ERR(local->wep_tx_tfm))
4452
			return -EOPNOTSUPP;
4453 4454 4455 4456 4457 4458 4459 4460
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
4461 4462 4463
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
4464 4465
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4466
	}
4467

4468 4469
	auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
4470
	if (!auth_data)
J
Johannes Berg 已提交
4471
		return -ENOMEM;
4472

J
Johannes Berg 已提交
4473
	auth_data->bss = req->bss;
4474

4475 4476 4477 4478 4479 4480 4481 4482 4483
	if (req->sae_data_len >= 4) {
		__le16 *pos = (__le16 *) req->sae_data;
		auth_data->sae_trans = le16_to_cpu(pos[0]);
		auth_data->sae_status = le16_to_cpu(pos[1]);
		memcpy(auth_data->data, req->sae_data + 4,
		       req->sae_data_len - 4);
		auth_data->data_len += req->sae_data_len - 4;
	}

4484
	if (req->ie && req->ie_len) {
4485 4486 4487
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
4488
	}
4489

J
Johannes Berg 已提交
4490
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
4491 4492 4493
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
4494 4495
	}

J
Johannes Berg 已提交
4496
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
4497

J
Johannes Berg 已提交
4498
	/* try to authenticate/probe */
4499

J
Johannes Berg 已提交
4500 4501 4502 4503
	if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
	    ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
4504 4505
	}

J
Johannes Berg 已提交
4506 4507
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
4508

J
Johannes Berg 已提交
4509 4510
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
4511

4512 4513 4514 4515 4516 4517 4518
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4519 4520 4521
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
4522
	}
J
Johannes Berg 已提交
4523

J
Johannes Berg 已提交
4524
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4525

4526
	err = ieee80211_prep_connection(sdata, req->bss, false, false);
4527
	if (err)
J
Johannes Berg 已提交
4528
		goto err_clear;
J
Johannes Berg 已提交
4529

4530
	err = ieee80211_auth(sdata);
J
Johannes Berg 已提交
4531 4532 4533 4534 4535 4536
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
4537
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4538
	return 0;
J
Johannes Berg 已提交
4539 4540

 err_clear:
4541
	eth_zero_addr(ifmgd->bssid);
4542
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4543
	ifmgd->auth_data = NULL;
4544 4545 4546
	mutex_lock(&sdata->local->mtx);
	ieee80211_vif_release_channel(sdata);
	mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
4547 4548 4549
 err_free:
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
4550 4551
}

4552 4553 4554 4555 4556 4557 4558 4559 4560 4561 4562 4563 4564 4565 4566 4567 4568 4569 4570 4571 4572 4573 4574 4575 4576 4577 4578 4579 4580 4581 4582 4583 4584 4585 4586 4587 4588 4589
static bool ieee80211_usable_wmm_params(struct ieee80211_sub_if_data *sdata,
					const u8 *wmm_param, int len)
{
	const u8 *pos;
	size_t left;

	if (len < 8)
		return false;

	if (wmm_param[5] != 1 /* version */)
		return false;

	pos = wmm_param + 8;
	left = len - 8;

	for (; left >= 4; left -= 4, pos += 4) {
		u8 aifsn = pos[0] & 0x0f;
		u8 ecwmin = pos[1] & 0x0f;
		u8 ecwmax = (pos[1] & 0xf0) >> 4;
		int aci = (pos[0] >> 5) & 0x03;

		if (aifsn < 2) {
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), disabling WMM\n",
				   aifsn, aci);
			return false;
		}
		if (ecwmin > ecwmax) {
			sdata_info(sdata,
				   "AP has invalid WMM params (ECWmin/max=%d/%d for ACI %d), disabling WMM\n",
				   ecwmin, ecwmax, aci);
			return false;
		}
	}

	return true;
}

4590 4591
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
4592
{
J
Johannes Berg 已提交
4593
	struct ieee80211_local *local = sdata->local;
4594
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4595
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
4596
	struct ieee80211_mgd_assoc_data *assoc_data;
4597
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
4598
	struct ieee80211_supported_band *sband;
4599
	const u8 *ssidie, *ht_ie, *vht_ie;
4600
	int i, err;
4601
	bool override = false;
4602

J
Johannes Berg 已提交
4603 4604 4605 4606
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

4607 4608 4609 4610 4611 4612 4613 4614 4615 4616 4617
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
	if (!ssidie) {
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

4618 4619 4620 4621 4622 4623 4624
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4625 4626 4627
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
4628
	}
J
Johannes Berg 已提交
4629 4630 4631 4632

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
4633
	}
4634

J
Johannes Berg 已提交
4635 4636 4637 4638
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
4639

J
Johannes Berg 已提交
4640 4641 4642 4643
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
4644
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
4645
		ieee80211_destroy_auth_data(sdata, match);
4646 4647
	}

J
Johannes Berg 已提交
4648
	/* prepare assoc data */
4649

4650 4651
	ifmgd->beacon_crc_valid = false;

4652 4653 4654 4655 4656 4657 4658 4659 4660 4661 4662 4663 4664 4665 4666 4667 4668 4669 4670 4671 4672 4673 4674 4675 4676 4677 4678 4679 4680 4681 4682 4683 4684 4685 4686 4687
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);
	if (assoc_data->wmm) {
		/* try to check validity of WMM params IE */
		const struct cfg80211_bss_ies *ies;
		const u8 *wp, *start, *end;

		rcu_read_lock();
		ies = rcu_dereference(req->bss->ies);
		start = ies->data;
		end = start + ies->len;

		while (true) {
			wp = cfg80211_find_vendor_ie(
				WLAN_OUI_MICROSOFT,
				WLAN_OUI_TYPE_MICROSOFT_WMM,
				start, end - start);
			if (!wp)
				break;
			start = wp + wp[1] + 2;
			/* if this IE is too short, try the next */
			if (wp[1] <= 4)
				continue;
			/* if this IE is WMM params, we found what we wanted */
			if (wp[6] == 1)
				break;
		}

		if (!wp || !ieee80211_usable_wmm_params(sdata, wp + 2,
							wp[1] - 2)) {
			assoc_data->wmm = false;
			ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
		}
		rcu_read_unlock();
	}

J
Johannes Berg 已提交
4688 4689 4690 4691 4692 4693 4694
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
4695
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4696 4697
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4698
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4699
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4700
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4701
			netdev_info(sdata->dev,
4702
				    "disabling HT/VHT due to WEP/TKIP use\n");
4703 4704
		}
	}
4705

J
Johannes Berg 已提交
4706 4707 4708
	/* Also disable HT if we don't support it or the AP doesn't use WMM */
	sband = local->hw.wiphy->bands[req->bss->channel->band];
	if (!sband->ht_cap.ht_supported ||
4709 4710
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4711
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4712 4713
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4714 4715
			netdev_info(sdata->dev,
				    "disabling HT as WMM/QoS is not supported by the AP\n");
4716
	}
J
Johannes Berg 已提交
4717

4718 4719
	/* disable VHT if we don't support it or the AP doesn't use WMM */
	if (!sband->vht_cap.vht_supported ||
4720 4721
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4722
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4723 4724
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4725 4726
			netdev_info(sdata->dev,
				    "disabling VHT as WMM/QoS is not supported by the AP\n");
4727 4728
	}

B
Ben Greear 已提交
4729 4730 4731 4732
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

4733 4734 4735 4736
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

4737
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
4738 4739 4740
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
4741

J
Johannes Berg 已提交
4742
	assoc_data->bss = req->bss;
4743

J
Johannes Berg 已提交
4744 4745
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
4746
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
4747
		else
4748
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
4749
	} else
4750
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
4751

J
Johannes Berg 已提交
4752 4753 4754
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
4755

4756
	rcu_read_lock();
4757 4758 4759 4760 4761
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
	else
4762
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4763 4764 4765 4766 4767 4768
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
	else
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4769
	rcu_read_unlock();
4770

4771
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
4772
		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
4773 4774 4775
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
4776
	if (bss->wmm_used && bss->uapsd_supported &&
4777
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
4778
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
4779 4780
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
4781
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
4782 4783 4784
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

4785
	if (req->prev_bssid)
J
Johannes Berg 已提交
4786
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4787 4788 4789 4790 4791 4792 4793 4794 4795

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

4796 4797 4798 4799 4800
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

4801 4802 4803 4804 4805
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

4806 4807
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4808 4809
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
4810

J
Johannes Berg 已提交
4811 4812 4813
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
4814
	ifmgd->dtim_period = 0;
4815
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
4816

4817 4818 4819 4820 4821 4822 4823 4824 4825 4826 4827 4828 4829 4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840 4841 4842 4843 4844 4845 4846
	/* override HT/VHT configuration only if the AP and we support it */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
		struct ieee80211_sta_ht_cap sta_ht_cap;

		if (req->flags & ASSOC_REQ_DISABLE_HT)
			override = true;

		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

		/* check for 40 MHz disable override */
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
		    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
		    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
			override = true;

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
		    req->flags & ASSOC_REQ_DISABLE_VHT)
			override = true;
	}

	if (req->flags & ASSOC_REQ_DISABLE_HT) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
	}

	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	err = ieee80211_prep_connection(sdata, req->bss, true, override);
4847 4848
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
4849

4850 4851
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
4852

4853
	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
4854 4855 4856 4857 4858 4859 4860 4861
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4862
		assoc_data->timeout_started = true;
4863 4864 4865 4866 4867
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
		const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						    beacon_ies->data,
						    beacon_ies->len);
4868 4869
		u8 dtim_count = 0;

4870 4871 4872 4873
		if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
			const struct ieee80211_tim_ie *tim;
			tim = (void *)(tim_ie + 2);
			ifmgd->dtim_period = tim->dtim_period;
4874
			dtim_count = tim->dtim_count;
4875
		}
4876
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
4877
		assoc_data->timeout = jiffies;
4878
		assoc_data->timeout_started = true;
4879

4880
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4881 4882 4883 4884 4885
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
4886 4887
	} else {
		assoc_data->timeout = jiffies;
4888
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
4889
	}
4890 4891
	rcu_read_unlock();

4892
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
4893

P
Paul Stewart 已提交
4894 4895 4896 4897 4898 4899 4900 4901 4902 4903
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
4904 4905
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
4906 4907
	}

4908
	return 0;
J
Johannes Berg 已提交
4909
 err_clear:
4910
	eth_zero_addr(ifmgd->bssid);
4911
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4912 4913 4914 4915
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
4916 4917
}

4918
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4919
			 struct cfg80211_deauth_request *req)
4920
{
4921
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4922
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4923
	bool tx = !req->local_state_change;
4924

4925 4926 4927 4928 4929 4930
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
4931

4932
		drv_mgd_prepare_tx(sdata->local, sdata);
4933 4934
		ieee80211_send_deauth_disassoc(sdata, req->bssid,
					       IEEE80211_STYPE_DEAUTH,
4935
					       req->reason_code, tx,
4936
					       frame_buf);
4937
		ieee80211_destroy_auth_data(sdata, false);
4938 4939 4940
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
4941

4942
		return 0;
4943 4944
	}

4945 4946
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4947 4948 4949 4950 4951
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

4952 4953
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
4954 4955 4956
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
4957 4958
		return 0;
	}
4959

4960
	return -ENOTCONN;
4961
}
4962

4963
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4964
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
4965
{
4966
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4967
	u8 bssid[ETH_ALEN];
4968
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
4969

J
Johannes Berg 已提交
4970 4971 4972 4973 4974 4975
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
4976
	if (ifmgd->associated != req->bss)
4977 4978
		return -ENOLINK;

J
Johannes Berg 已提交
4979
	sdata_info(sdata,
4980 4981
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
4982

4983
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
4984 4985 4986
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
4987

4988 4989
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    req->reason_code);
4990

4991 4992
	return 0;
}
4993

4994
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4995 4996 4997
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4998 4999 5000 5001 5002 5003 5004 5005 5006 5007
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
5008
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5009

5010
	sdata_lock(sdata);
5011 5012
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5013
		ieee80211_destroy_assoc_data(sdata, false);
5014 5015
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
5016 5017
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
5018 5019 5020 5021 5022 5023 5024
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
	spin_unlock_bh(&ifmgd->teardown_lock);
5025
	del_timer_sync(&ifmgd->timer);
5026
	sdata_unlock(sdata);
5027 5028
}

5029 5030 5031 5032 5033 5034
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

J
Johannes Berg 已提交
5035 5036
	trace_api_cqm_rssi_notify(sdata, rssi_event);

5037 5038 5039
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
5040 5041 5042 5043 5044 5045 5046 5047 5048 5049

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);