mlme.c 167.9 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-only
2 3
/*
 * BSS client mode implementation
4
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
5 6 7 8
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9
 * Copyright 2013-2014  Intel Mobile Communications GmbH
10
 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
11
 * Copyright (C) 2018 - 2020 Intel Corporation
12 13
 */

14
#include <linux/delay.h>
15
#include <linux/fips.h>
16 17 18 19
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
20
#include <linux/moduleparam.h>
21
#include <linux/rtnetlink.h>
22
#include <linux/crc32.h>
23
#include <linux/slab.h>
24
#include <linux/export.h>
25
#include <net/mac80211.h>
26
#include <asm/unaligned.h>
J
Johannes Berg 已提交
27

28
#include "ieee80211_i.h"
29
#include "driver-ops.h"
J
Johannes Berg 已提交
30 31
#include "rate.h"
#include "led.h"
32
#include "fils_aead.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
37
#define IEEE80211_AUTH_TIMEOUT_SAE	(HZ * 2)
38 39 40
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
41
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
42 43
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
44

45 46 47 48 49 50 51 52 53
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
54 55

/*
56 57 58 59 60 61
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
62
 */
63 64 65 66
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
67

J
Johannes Berg 已提交
68 69 70 71
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
72
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
73 74 75 76 77
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
78 79 80 81 82
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
83

84 85 86 87 88 89
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
90 91 92 93 94 95 96 97 98 99
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
100 101
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
102
{
103
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
104

105 106 107
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
108 109
}

110
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
111
{
112
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
113 114
		return;

115
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
116 117
		return;

J
Johannes Berg 已提交
118
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
119
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
120 121
}

122 123
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
124 125
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

126
	if (unlikely(!ifmgd->associated))
127 128
		return;

129 130
	if (ifmgd->probe_send_count)
		ifmgd->probe_send_count = 0;
131

132
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
133 134
		return;

135
	mod_timer(&ifmgd->conn_mon_timer,
136 137 138
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

139
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
140
{
141
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
142 143
}

144 145 146 147
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
148
			     u32 vht_cap_info,
149 150
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
151
			     const struct ieee80211_he_operation *he_oper,
152
			     struct cfg80211_chan_def *chandef, bool tracking)
153
{
154
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
155
	struct cfg80211_chan_def vht_chandef;
156
	struct ieee80211_sta_ht_cap sta_ht_cap;
157 158
	u32 ht_cfreq, ret;

159
	memset(chandef, 0, sizeof(struct cfg80211_chan_def));
160 161 162
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
163
	chandef->freq1_offset = channel->freq_offset;
164

165 166 167 168 169 170 171 172 173 174 175 176
	if (channel->band == NL80211_BAND_6GHZ) {
		if (!ieee80211_chandef_he_6ghz_oper(sdata, he_oper, chandef))
			ret = IEEE80211_STA_DISABLE_HT |
			      IEEE80211_STA_DISABLE_VHT |
			      IEEE80211_STA_DISABLE_HE;
		vht_chandef = *chandef;
		goto out;
	}

	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

177
	if (!ht_oper || !sta_ht_cap.ht_supported) {
178 179 180
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
181 182 183 184 185 186 187 188
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
189
	if (!tracking && channel->center_freq != ht_cfreq) {
190 191 192 193 194 195 196
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
197 198 199 200
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
201 202 203
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
204 205 206 207
		goto out;
	}

	/* check 40 MHz support, if we have it */
208
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
209
		ieee80211_chandef_ht_oper(ht_oper, chandef);
210 211 212
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
213 214
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
215 216 217 218 219 220 221 222
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

223
	vht_chandef = *chandef;
L
Luca Coelho 已提交
224 225 226 227 228 229 230 231 232 233 234 235
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && he_oper &&
	    (le32_to_cpu(he_oper->he_oper_params) &
	     IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
		struct ieee80211_vht_operation he_oper_vht_cap;

		/*
		 * Set only first 3 bytes (other 2 aren't used in
		 * ieee80211_chandef_vht_oper() anyway)
		 */
		memcpy(&he_oper_vht_cap, he_oper->optional, 3);
		he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);

236
		if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
237
						&he_oper_vht_cap, ht_oper,
L
Luca Coelho 已提交
238 239 240 241 242 243 244
						&vht_chandef)) {
			if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
				sdata_info(sdata,
					   "HE AP VHT information is invalid, disable HE\n");
			ret = IEEE80211_STA_DISABLE_HE;
			goto out;
		}
245 246 247 248
	} else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
					       vht_cap_info,
					       vht_oper, ht_oper,
					       &vht_chandef)) {
249
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
250
			sdata_info(sdata,
251
				   "AP VHT information is invalid, disable VHT\n");
252 253 254 255 256
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
257
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
258 259
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
260 261 262 263 264 265 266 267 268 269
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
270
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
271 272
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
273 274 275 276 277 278 279 280 281
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

304 305 306 307
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

308 309 310 311 312 313 314 315
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
316
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
317 318
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
319 320
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
321 322
			      IEEE80211_STA_DISABLE_VHT |
			      IEEE80211_STA_DISABLE_HE;
323
			break;
324 325
		}

326
		ret |= ieee80211_chandef_downgrade(chandef);
327 328
	}

329 330
	if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
						 IEEE80211_CHAN_NO_HE))
331 332
		ret |= IEEE80211_STA_DISABLE_HE;

333
	if (chandef->width != vht_chandef.width && !tracking)
334 335 336 337 338 339 340
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

341 342
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
343
			       const struct ieee80211_ht_cap *ht_cap,
344
			       const struct ieee80211_vht_cap *vht_cap,
345 346
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
347
			       const struct ieee80211_he_operation *he_oper,
348
			       const u8 *bssid, u32 *changed)
349 350
{
	struct ieee80211_local *local = sdata->local;
351
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
L
Luca Coelho 已提交
352 353 354
	struct ieee80211_channel *chan = sdata->vif.bss_conf.chandef.chan;
	struct ieee80211_supported_band *sband =
		local->hw.wiphy->bands[chan->band];
355
	struct cfg80211_chan_def chandef;
356
	u16 ht_opmode;
357 358
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
359
	u32 vht_cap_info = 0;
360
	int ret;
361

362 363
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
364 365
		return 0;

366 367 368 369
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

L
Luca Coelho 已提交
370 371 372 373 374
	/* don't check HE if we associated as non-HE station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HE ||
	    !ieee80211_get_he_sta_cap(sband))
		he_oper = NULL;

375 376 377
	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

378 379 380 381 382 383 384 385 386 387
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

388 389 390
	if (vht_cap)
		vht_cap_info = le32_to_cpu(vht_cap->vht_cap_info);

L
Luca Coelho 已提交
391
	/* calculate new channel (type) based on HT/VHT/HE operation IEs */
392
	flags = ieee80211_determine_chantype(sdata, sband, chan, vht_cap_info,
L
Luca Coelho 已提交
393
					     ht_oper, vht_oper, he_oper,
394
					     &chandef, true);
395 396 397 398 399 400 401 402 403 404

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
405
		flags |= ieee80211_chandef_downgrade(&chandef);
406 407
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
408
		flags |= ieee80211_chandef_downgrade(&chandef);
409 410
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
411
		flags |= ieee80211_chandef_downgrade(&chandef);
412 413 414 415 416

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
417 418 419 420 421 422
		   "AP %pM changed bandwidth, new config is %d.%03d MHz, "
		   "width %d (%d.%03d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq,
		   chandef.chan->freq_offset, chandef.width,
		   chandef.center_freq1, chandef.freq1_offset,
		   chandef.center_freq2);
423 424 425

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
426
				      IEEE80211_STA_DISABLE_HE |
427 428 429 430 431 432 433 434 435 436 437 438 439 440 441
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
442
	case NL80211_CHAN_WIDTH_40:
443
		new_sta_bw = IEEE80211_STA_RX_BW_40;
444
		break;
445 446 447 448 449 450
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
451
		break;
452 453
	default:
		return -EINVAL;
454
	}
455

456 457
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
458

459 460 461 462 463
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
464

465 466 467 468 469 470 471
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
472

473 474 475 476
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
477
	}
478

479
	return 0;
480 481
}

J
Johannes Berg 已提交
482 483
/* frame sending functions */

J
Johannes Berg 已提交
484
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
485
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

503
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
504 505 506 507 508 509 510 511 512 513 514 515 516 517
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

518 519 520 521 522 523 524 525 526 527
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
528 529 530 531 532 533
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
534
		/* fall through */
J
Johannes Berg 已提交
535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

554 555 556 557
/* This function determines vht capability flags for the association
 * and builds the IE.
 * Note - the function may set the owner of the MU-MIMO capability
 */
558 559
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
560 561
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
562
{
563
	struct ieee80211_local *local = sdata->local;
564 565 566
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
567
	u32 mask, ap_bf_sts, our_bf_sts;
568 569 570 571

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
572
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
573 574 575 576

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
577
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
578 579 580 581 582 583
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
584 585 586 587
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
588
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
589 590
	}

591 592 593 594 595 596
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614
		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
	else if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

	/*
	 * If some other vif is using the MU-MIMO capablity we cannot associate
	 * using MU-MIMO - this will lead to contradictions in the group-id
	 * mechanism.
	 * Ownership is defined since association request, in order to avoid
	 * simultaneous associations with MU-MIMO.
	 */
	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
		bool disable_mu_mimo = false;
		struct ieee80211_sub_if_data *other;

		list_for_each_entry_rcu(other, &local->interfaces, list) {
615
			if (other->vif.mu_mimo_owner) {
616 617 618 619 620 621 622
				disable_mu_mimo = true;
				break;
			}
		}
		if (disable_mu_mimo)
			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
		else
623
			sdata->vif.mu_mimo_owner = true;
624
	}
625

626 627 628 629 630 631 632 633 634 635
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

636
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
637
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
638 639 640
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

L
Luca Coelho 已提交
641 642 643 644 645 646 647 648 649
/* This function determines HE capability flags for the association
 * and builds the IE.
 */
static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
				struct sk_buff *skb,
				struct ieee80211_supported_band *sband)
{
	u8 *pos;
	const struct ieee80211_sta_he_cap *he_cap = NULL;
650
	struct ieee80211_chanctx_conf *chanctx_conf;
L
Luca Coelho 已提交
651
	u8 he_cap_size;
652 653 654 655 656 657 658 659 660 661
	bool reg_cap = false;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!WARN_ON_ONCE(!chanctx_conf))
		reg_cap = cfg80211_chandef_usable(sdata->wdev.wiphy,
						  &chanctx_conf->def,
						  IEEE80211_CHAN_NO_HE);

	rcu_read_unlock();
L
Luca Coelho 已提交
662 663

	he_cap = ieee80211_get_he_sta_cap(sband);
664
	if (!he_cap || !reg_cap)
L
Luca Coelho 已提交
665 666 667 668 669 670 671 672 673 674 675 676 677
		return;

	/*
	 * TODO: the 1 added is because this temporarily is under the EXTENSION
	 * IE. Get rid of it when it moves.
	 */
	he_cap_size =
		2 + 1 + sizeof(he_cap->he_cap_elem) +
		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
		ieee80211_he_ppe_size(he_cap->ppe_thres[0],
				      he_cap->he_cap_elem.phy_cap_info);
	pos = skb_put(skb, he_cap_size);
	ieee80211_ie_build_he_cap(pos, he_cap, pos + he_cap_size);
678 679

	ieee80211_ie_build_he_6ghz_cap(sdata, skb);
L
Luca Coelho 已提交
680 681
}

J
Johannes Berg 已提交
682 683 684 685 686 687 688
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
689
	u8 *pos, qos_info, *ie_start;
J
Johannes Berg 已提交
690
	size_t offset = 0, noffset;
691
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
692 693
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
694 695
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
696
	u32 rates = 0;
697 698 699 700 701 702 703
	struct element *ext_capa = NULL;

	/* we know it's writable, cast away the const */
	if (assoc_data->ie_len)
		ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
						      assoc_data->ie,
						      assoc_data->ie_len);
J
Johannes Berg 已提交
704

705
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
706

J
Johannes Berg 已提交
707 708 709 710 711 712
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
713
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
714 715
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
716
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
717 718 719 720 721 722 723 724

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
725 726 727 728
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
729 730 731 732 733 734
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
735 736 737 738 739
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
740 741 742 743 744 745 746 747 748
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
749
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
L
Luca Coelho 已提交
750 751 752
			2 + 1 + sizeof(struct ieee80211_he_cap_elem) + /* HE */
				sizeof(struct ieee80211_he_mcs_nss_supp) +
				IEEE80211_HE_PPE_THRES_MAX_LEN +
753
			2 + 1 + sizeof(struct ieee80211_he_6ghz_capa) +
J
Johannes Berg 已提交
754
			assoc_data->ie_len + /* extra IEs */
755
			(assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
J
Johannes Berg 已提交
756 757 758 759 760 761 762 763 764
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

765
	if (sband->band == NL80211_BAND_2GHZ) {
766 767
		capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
J
Johannes Berg 已提交
768 769 770 771 772 773
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
774
	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
J
Johannes Berg 已提交
775 776
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

777 778 779
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

780
	mgmt = skb_put_zero(skb, 24);
J
Johannes Berg 已提交
781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
805
	ie_start = pos;
J
Johannes Berg 已提交
806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
822 823 824
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
825 826 827 828 829 830 831 832 833 834 835 836
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
837 838 839 840
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
841 842 843 844
			}
		}
	}

845 846
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
847 848 849 850
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
851 852
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
853
	}
J
Johannes Berg 已提交
854

855 856 857 858 859 860 861 862 863
	/*
	 * Per spec, we shouldn't include the list of channels if we advertise
	 * support for extended channel switching, but we've always done that;
	 * (for now?) apply this restriction only on the (new) 6 GHz band.
	 */
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
	    (sband->band != NL80211_BAND_6GHZ ||
	     !ext_capa || ext_capa->datalen < 1 ||
	     !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
J
Johannes Berg 已提交
864 865 866 867 868 869 870 871 872 873 874
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

875 876
	/* Set MBSSID support for HE AP if needed */
	if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
877 878 879
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && assoc_data->ie_len &&
	    ext_capa && ext_capa->datalen >= 3)
		ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
880

J
Johannes Berg 已提交
881
	/* if present, add any custom IEs that go before HT */
882
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
883 884 885 886 887 888 889 890 891 892
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
893 894
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
895 896
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
897 898 899 900
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
901
			/* luckily this is almost always there */
902 903 904 905
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
906
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
907 908 909 910 911 912 913 914 915 916 917
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
918
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
919 920 921
		offset = noffset;
	}

J
Johannes Berg 已提交
922 923 924 925
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

926 927
	if (sband->band != NL80211_BAND_6GHZ &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
928
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
929
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
930

931 932 933
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
934 935 936 937
			/*
			 * no need to list the ones split off before HT
			 * or generated here
			 */
938 939 940 941 942
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
943
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
944
		};
945 946

		/* RIC already taken above, so no need to handle here anymore */
947 948 949
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
950
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
951 952 953
		offset = noffset;
	}

L
Luca Coelho 已提交
954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980
	/* if present, add any custom IEs that go before HE */
	if (assoc_data->ie_len) {
		static const u8 before_he[] = {
			/*
			 * no need to list the ones split off before VHT
			 * or generated here
			 */
			WLAN_EID_OPMODE_NOTIF,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
			/* 11ai elements */
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
			/* TODO: add 11ah/11aj/11ak elements */
		};

		/* RIC already taken above, so no need to handle here anymore */
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_he, ARRAY_SIZE(before_he),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

981 982
	if (sband->band != NL80211_BAND_6GHZ &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
983 984
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
985

986 987 988 989 990 991 992 993 994
	/*
	 * If AP doesn't support HT, mark HE as disabled.
	 * If on the 5GHz band, make sure it supports VHT.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT ||
	    (sband->band == NL80211_BAND_5GHZ &&
	     ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

L
Luca Coelho 已提交
995 996 997 998
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		ieee80211_add_he_ie(sdata, skb, sband);

	/* if present, add any custom non-vendor IEs that go after HE */
999
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
1000 1001 1002
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
1003
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
1004 1005 1006
		offset = noffset;
	}

1007 1008
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
1009 1010
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
1011 1012 1013 1014 1015
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

1016
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
1017 1018 1019
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
1020
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
1021
		noffset = assoc_data->ie_len;
1022
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
1023 1024
	}

1025 1026 1027 1028 1029 1030
	if (assoc_data->fils_kek_len &&
	    fils_encrypt_assoc_req(skb, assoc_data) < 0) {
		dev_kfree_skb(skb);
		return;
	}

1031 1032 1033 1034 1035
	pos = skb_tail_pointer(skb);
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
	ifmgd->assoc_req_ies_len = pos - ie_start;

1036
	drv_mgd_prepare_tx(local, sdata, 0);
J
Johannes Berg 已提交
1037

J
Johannes Berg 已提交
1038
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1039
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1040 1041
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
1042 1043 1044
	ieee80211_tx_skb(sdata, skb);
}

1045 1046 1047 1048 1049 1050
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

1051 1052
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
1053 1054
		return;

1055 1056
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1057

1058 1059
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
1060 1061
}

1062 1063
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
1064
			     bool powersave)
1065 1066
{
	struct sk_buff *skb;
1067
	struct ieee80211_hdr_3addr *nullfunc;
1068
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1069

L
Luca Coelho 已提交
1070 1071 1072 1073 1074
	/* Don't send NDPs when STA is connected HE */
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		return;

1075 1076
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
		!ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
1077
	if (!skb)
1078 1079
		return;

1080
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1081
	if (powersave)
1082
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1083

1084 1085
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1086

1087
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1088 1089
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

1090
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1091 1092
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

1093
	ieee80211_tx_skb(sdata, skb);
1094 1095
}

1096 1097 1098 1099 1100 1101 1102 1103 1104 1105
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

L
Luca Coelho 已提交
1106 1107 1108 1109
	/* Don't send NDPs when connected HE */
	if (!(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
		return;

1110
	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1111
	if (!skb)
1112
		return;
1113

1114 1115
	skb_reserve(skb, local->hw.extra_tx_headroom);

1116
	nullfunc = skb_put_zero(skb, 30);
1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

1129 1130 1131 1132 1133
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
1134
	struct ieee80211_local *local = sdata->local;
1135
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1136
	int ret;
1137

1138
	if (!ieee80211_sdata_running(sdata))
1139 1140
		return;

1141
	sdata_lock(sdata);
1142 1143 1144
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

1145 1146
	if (!ifmgd->associated)
		goto out;
1147

1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
1159 1160 1161 1162
		struct ieee80211_supported_band *sband = NULL;
		struct sta_info *mgd_sta = NULL;
		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;

1163 1164 1165 1166 1167 1168 1169 1170
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212
		if (sdata->vif.bss_conf.chandef.width !=
		    sdata->csa_chandef.width) {
			/*
			 * For managed interface, we need to also update the AP
			 * station bandwidth and align the rate scale algorithm
			 * on the bandwidth change. Here we only consider the
			 * bandwidth of the new channel definition (as channel
			 * switch flow does not have the full HT/VHT/HE
			 * information), assuming that if additional changes are
			 * required they would be done as part of the processing
			 * of the next beacon from the AP.
			 */
			switch (sdata->csa_chandef.width) {
			case NL80211_CHAN_WIDTH_20_NOHT:
			case NL80211_CHAN_WIDTH_20:
			default:
				bw = IEEE80211_STA_RX_BW_20;
				break;
			case NL80211_CHAN_WIDTH_40:
				bw = IEEE80211_STA_RX_BW_40;
				break;
			case NL80211_CHAN_WIDTH_80:
				bw = IEEE80211_STA_RX_BW_80;
				break;
			case NL80211_CHAN_WIDTH_80P80:
			case NL80211_CHAN_WIDTH_160:
				bw = IEEE80211_STA_RX_BW_160;
				break;
			}

			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
			sband =
				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
		}

		if (sdata->vif.bss_conf.chandef.width >
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1213 1214 1215 1216 1217 1218 1219 1220 1221 1222
		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

1223 1224 1225 1226 1227 1228 1229
		if (sdata->vif.bss_conf.chandef.width <
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1230 1231 1232 1233 1234
		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1235
		sdata_info(sdata,
1236
			   "failed to finalize channel switch, disconnecting\n");
1237 1238 1239 1240
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1241

1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1262

1263 1264 1265 1266 1267
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1268

1269 1270 1271
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1272 1273 1274 1275 1276 1277
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1278
		return;
1279
	}
1280 1281

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1282 1283
}

1284 1285
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1286 1287
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1288 1289 1290

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1291 1292 1293 1294 1295 1296
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1297 1298 1299 1300
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1301
static void ieee80211_chswitch_timer(struct timer_list *t)
1302 1303
{
	struct ieee80211_sub_if_data *sdata =
1304
		from_timer(sdata, t, u.mgd.chswitch_timer);
1305

1306
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1307 1308
}

1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334
static void
ieee80211_sta_abort_chanswitch(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;

	if (!local->ops->abort_channel_switch)
		return;

	mutex_lock(&local->mtx);

	mutex_lock(&local->chanctx_mtx);
	ieee80211_vif_unreserve_chanctx(sdata);
	mutex_unlock(&local->chanctx_mtx);

	if (sdata->csa_block_tx)
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);

	sdata->csa_block_tx = false;
	sdata->vif.csa_active = false;

	mutex_unlock(&local->mtx);

	drv_abort_channel_switch(sdata);
}

1335
static void
J
Johannes Berg 已提交
1336
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1337 1338
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1339
				 bool beacon)
1340
{
1341
	struct ieee80211_local *local = sdata->local;
1342
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1343
	struct cfg80211_bss *cbss = ifmgd->associated;
1344
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1345
	struct ieee80211_chanctx *chanctx;
1346
	enum nl80211_band current_band;
1347
	struct ieee80211_csa_ie csa_ie;
1348
	struct ieee80211_channel_switch ch_switch;
1349
	struct ieee80211_bss *bss;
1350
	int res;
1351

1352
	sdata_assert_lock(sdata);
1353

1354
	if (!cbss)
1355 1356
		return;

1357
	if (local->scanning)
1358 1359
		return;

1360
	current_band = cbss->channel->band;
1361
	bss = (void *)cbss->priv;
1362
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1363
					   bss->vht_cap_info,
1364
					   ifmgd->flags,
1365
					   ifmgd->associated->bssid, &csa_ie);
1366 1367 1368 1369

	if (!res) {
		ch_switch.timestamp = timestamp;
		ch_switch.device_timestamp = device_timestamp;
1370
		ch_switch.block_tx = csa_ie.mode;
1371 1372 1373 1374 1375
		ch_switch.chandef = csa_ie.chandef;
		ch_switch.count = csa_ie.count;
		ch_switch.delay = csa_ie.max_switch_time;
	}

1376
	if (res < 0) {
1377
		ieee80211_queue_work(&local->hw,
1378
				     &ifmgd->csa_connection_drop_work);
1379
		return;
1380 1381
	}

1382 1383 1384 1385 1386
	if (beacon && sdata->vif.csa_active && !ifmgd->csa_waiting_bcn) {
		if (res)
			ieee80211_sta_abort_chanswitch(sdata);
		else
			drv_channel_switch_rx_beacon(sdata, &ch_switch);
1387 1388 1389 1390 1391
		return;
	} else if (sdata->vif.csa_active || res) {
		/* disregard subsequent announcements if already processing */
		return;
	}
1392

1393
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1394 1395
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
1396 1397 1398
			   "AP %pM switches to unsupported channel "
			   "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
			   "disconnecting\n",
1399
			   ifmgd->associated->bssid,
1400
			   csa_ie.chandef.chan->center_freq,
1401
			   csa_ie.chandef.chan->freq_offset,
1402
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1403
			   csa_ie.chandef.freq1_offset,
1404
			   csa_ie.chandef.center_freq2);
1405 1406 1407 1408 1409
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1410
	if (cfg80211_chandef_identical(&csa_ie.chandef,
1411 1412
				       &sdata->vif.bss_conf.chandef) &&
	    (!csa_ie.mode || !beacon)) {
1413 1414 1415 1416 1417 1418 1419 1420 1421
		if (ifmgd->csa_ignored_same_chan)
			return;
		sdata_info(sdata,
			   "AP %pM tries to chanswitch to same channel, ignore\n",
			   ifmgd->associated->bssid);
		ifmgd->csa_ignored_same_chan = true;
		return;
	}

1422 1423 1424 1425 1426 1427 1428 1429
	/*
	 * Drop all TDLS peers - either we disconnect or move to a different
	 * channel from this point on. There's no telling what our peer will do.
	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
	 * have an incompatible wider chandef.
	 */
	ieee80211_teardown_tdls_peers(sdata);

1430
	mutex_lock(&local->mtx);
1431
	mutex_lock(&local->chanctx_mtx);
1432 1433 1434 1435 1436
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
1437
		goto drop_connection;
1438 1439 1440 1441
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1442
	if (local->use_chanctx &&
1443
	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1444 1445
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
1446
		goto drop_connection;
J
Johannes Berg 已提交
1447 1448
	}

1449 1450 1451
	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
1452
		goto drop_connection;
1453 1454
	}

1455 1456 1457
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1458
		sdata_info(sdata,
1459 1460
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1461
		goto drop_connection;
J
Johannes Berg 已提交
1462
	}
1463
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1464

1465
	sdata->vif.csa_active = true;
1466
	sdata->csa_chandef = csa_ie.chandef;
1467
	sdata->csa_block_tx = csa_ie.mode;
1468
	ifmgd->csa_ignored_same_chan = false;
J
Johannes Berg 已提交
1469

1470
	if (sdata->csa_block_tx)
1471 1472
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1473
	mutex_unlock(&local->mtx);
1474

1475 1476 1477
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1478
	if (local->ops->channel_switch) {
1479
		/* use driver's channel switch callback */
1480
		drv_channel_switch(local, sdata, &ch_switch);
1481 1482 1483 1484
		return;
	}

	/* channel switch handled in software */
1485
	if (csa_ie.count <= 1)
1486
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1487
	else
1488
		mod_timer(&ifmgd->chswitch_timer,
1489 1490
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1491 1492
	return;
 drop_connection:
1493 1494 1495 1496 1497 1498 1499 1500
	/*
	 * This is just so that the disconnect flow will know that
	 * we were trying to switch channel and failed. In case the
	 * mode is 1 (we are not allowed to Tx), we will know not to
	 * send a deauthentication frame. Those two fields will be
	 * reset when the disconnection worker runs.
	 */
	sdata->vif.csa_active = true;
1501
	sdata->csa_block_tx = csa_ie.mode;
1502

1503 1504 1505
	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
1506 1507
}

1508 1509 1510 1511 1512 1513
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1514
{
1515 1516
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1517
	int i, chan_increment;
1518
	bool have_chan_pwr = false;
1519

1520 1521
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1522
		return false;
1523

1524 1525 1526 1527 1528 1529 1530
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
1531 1532
	case NL80211_BAND_2GHZ:
	case NL80211_BAND_60GHZ:
1533 1534
		chan_increment = 1;
		break;
1535
	case NL80211_BAND_5GHZ:
1536
	case NL80211_BAND_6GHZ:
1537 1538
		chan_increment = 4;
		break;
1539
	}
1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1551
				*chan_pwr = triplet->chans.max_power;
1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1563
	if (have_chan_pwr && pwr_constr_elem)
1564
		*pwr_reduction = *pwr_constr_elem;
1565 1566 1567
	else
		*pwr_reduction = 0;

1568 1569 1570
	return have_chan_pwr;
}

1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1585 1586 1587 1588
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1589 1590
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1591
{
1592 1593 1594
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1595
	int new_ap_level;
1596
	__le16 capab = mgmt->u.probe_resp.capab_info;
1597

1598 1599 1600
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1601 1602 1603
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1604 1605 1606 1607 1608 1609 1610 1611
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1612
	}
1613

1614
	if (!has_80211h_pwr && !has_cisco_pwr)
1615
		return 0;
1616

1617 1618 1619 1620 1621
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1622 1623 1624 1625 1626
		new_ap_level = pwr_level_80211h;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1627 1628 1629 1630
		sdata_dbg(sdata,
			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			  sdata->u.mgd.bssid);
1631
	} else {  /* has_cisco_pwr is always true here. */
1632 1633 1634 1635 1636
		new_ap_level = pwr_level_cisco;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1637 1638 1639
		sdata_dbg(sdata,
			  "Limiting TX power to %d dBm as advertised by %pM\n",
			  pwr_level_cisco, sdata->u.mgd.bssid);
1640
	}
1641

1642 1643 1644 1645
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1646 1647
}

1648 1649 1650 1651 1652 1653
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1654 1655 1656 1657
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1658
	if (local->scanning)
J
Johannes Berg 已提交
1659 1660
		return;

1661
	if (conf->dynamic_ps_timeout > 0 &&
1662
	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1663 1664 1665
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
1666
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1667
			ieee80211_send_nullfunc(local, sdata, true);
1668

1669 1670
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1671 1672 1673 1674
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1692 1693 1694 1695
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1696
	bool authorized = false;
1697 1698 1699 1700

	if (!mgd->powersave)
		return false;

1701 1702 1703
	if (mgd->broken_ap)
		return false;

1704 1705 1706
	if (!mgd->associated)
		return false;

1707
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1708 1709
		return false;

1710
	if (!mgd->have_beacon)
1711 1712
		return false;

1713 1714 1715
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1716
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1717 1718
	rcu_read_unlock();

J
Johannes Berg 已提交
1719
	return authorized;
1720 1721
}

1722
/* need to hold RTNL or interface lock */
J
Johannes Berg 已提交
1723
void ieee80211_recalc_ps(struct ieee80211_local *local)
1724 1725 1726
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1727
	int timeout;
1728

1729
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1730 1731 1732 1733 1734
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1735
		if (!ieee80211_sdata_running(sdata))
1736
			continue;
1737 1738 1739 1740 1741 1742 1743 1744
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1745 1746 1747 1748 1749 1750
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1751
	if (count == 1 && ieee80211_powersave_allowed(found)) {
J
Johannes Berg 已提交
1752
		u8 dtimper = found->u.mgd.dtim_period;
1753

1754
		timeout = local->dynamic_ps_forced_timeout;
J
Johannes Berg 已提交
1755 1756
		if (timeout < 0)
			timeout = 100;
1757
		local->hw.conf.dynamic_ps_timeout = timeout;
1758

J
Johannes Berg 已提交
1759 1760 1761 1762 1763 1764
		/* If the TIM IE is invalid, pretend the value is 1 */
		if (!dtimper)
			dtimper = 1;

		local->hw.conf.ps_dtim_period = dtimper;
		local->ps_sdata = found;
1765
	} else {
1766
		local->ps_sdata = NULL;
1767
	}
1768 1769 1770 1771

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1772 1773 1774 1775 1776 1777 1778 1779 1780 1781
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1794
					IEEE80211_MAX_QUEUE_MAP,
1795 1796
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1797 1798 1799 1800 1801 1802 1803 1804
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1805
	struct ieee80211_if_managed *ifmgd;
1806 1807
	unsigned long flags;
	int q;
1808 1809 1810 1811 1812

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1813 1814
	ifmgd = &sdata->u.mgd;

1815 1816 1817
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1818
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1819 1820
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1821 1822 1823 1824 1825
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1844 1845
	}

1846
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1847
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1848
		if (drv_tx_frames_pending(local)) {
1849 1850 1851
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1852
		} else {
1853
			ieee80211_send_nullfunc(local, sdata, true);
1854
			/* Flush to get the tx status of nullfunc frame */
1855
			ieee80211_flush_queues(local, sdata, false);
1856
		}
1857 1858
	}

1859 1860
	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1861 1862 1863 1864 1865
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1866 1867
}

1868
void ieee80211_dynamic_ps_timer(struct timer_list *t)
1869
{
1870
	struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
1871

1872
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1873 1874
}

1875 1876
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
1877
	struct delayed_work *delayed_work = to_delayed_work(work);
1878 1879 1880
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1881
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1882

1883 1884 1885 1886 1887 1888 1889 1890
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1891 1892
}

1893 1894 1895 1896 1897
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1898
	bool ret = false;
1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
1943 1944 1945 1946 1947 1948
			/* Usually the loop will result in using BK even if it
			 * requires admission control, but such a configuration
			 * makes no sense and we have to transmit somehow - the
			 * AC selection does the same thing.
			 * If we started out trying to downgrade from BK, then
			 * the extra condition here might be needed.
1949
			 */
1950 1951
			if (non_acm_ac >= IEEE80211_NUM_ACS)
				non_acm_ac = IEEE80211_AC_BK;
1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1986
/* MLME */
L
Luca Coelho 已提交
1987 1988 1989 1990 1991
static bool
ieee80211_sta_wmm_params(struct ieee80211_local *local,
			 struct ieee80211_sub_if_data *sdata,
			 const u8 *wmm_param, size_t wmm_param_len,
			 const struct ieee80211_mu_edca_param_set *mu_edca)
1992
{
1993
	struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1994
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1995
	size_t left;
1996
	int count, mu_edca_count, ac;
J
Johannes Berg 已提交
1997 1998
	const u8 *pos;
	u8 uapsd_queues = 0;
1999

2000
	if (!local->ops->conf_tx)
2001
		return false;
2002

J
Johannes Berg 已提交
2003
	if (local->hw.queues < IEEE80211_NUM_ACS)
2004
		return false;
2005 2006

	if (!wmm_param)
2007
		return false;
2008

2009
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
2010
		return false;
K
Kalle Valo 已提交
2011 2012

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
2013
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
2014

2015
	count = wmm_param[6] & 0x0f;
2016 2017 2018 2019 2020 2021 2022
	/* -1 is the initial value of ifmgd->mu_edca_last_param_set.
	 * if mu_edca was preset before and now it disappeared tell
	 * the driver about it.
	 */
	mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
	if (count == ifmgd->wmm_last_param_set &&
	    mu_edca_count == ifmgd->mu_edca_last_param_set)
2023
		return false;
2024
	ifmgd->wmm_last_param_set = count;
2025
	ifmgd->mu_edca_last_param_set = mu_edca_count;
2026 2027 2028 2029 2030 2031

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
2032
	sdata->wmm_acm = 0;
2033 2034 2035
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
2036
		bool uapsd = false;
2037 2038

		switch (aci) {
2039
		case 1: /* AC_BK */
2040
			ac = IEEE80211_AC_BK;
J
Johannes Berg 已提交
2041
			if (acm)
Y
Yoni Divinsky 已提交
2042
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
2043 2044
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
L
Luca Coelho 已提交
2045 2046 2047
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2048
			break;
2049
		case 2: /* AC_VI */
2050
			ac = IEEE80211_AC_VI;
J
Johannes Berg 已提交
2051
			if (acm)
Y
Yoni Divinsky 已提交
2052
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
2053 2054
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
L
Luca Coelho 已提交
2055 2056 2057
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2058
			break;
2059
		case 3: /* AC_VO */
2060
			ac = IEEE80211_AC_VO;
J
Johannes Berg 已提交
2061
			if (acm)
Y
Yoni Divinsky 已提交
2062
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
2063 2064
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
L
Luca Coelho 已提交
2065 2066 2067
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2068
			break;
2069
		case 0: /* AC_BE */
2070
		default:
2071
			ac = IEEE80211_AC_BE;
J
Johannes Berg 已提交
2072
			if (acm)
Y
Yoni Divinsky 已提交
2073
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
2074 2075
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
L
Luca Coelho 已提交
2076 2077 2078
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_be;
2079 2080 2081
			break;
		}

2082
		params[ac].aifs = pos[0] & 0x0f;
2083

2084
		if (params[ac].aifs < 2) {
2085 2086
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2087 2088
				   params[ac].aifs, aci);
			params[ac].aifs = 2;
2089
		}
2090 2091 2092 2093 2094
		params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
		params[ac].txop = get_unaligned_le16(pos + 2);
		params[ac].acm = acm;
		params[ac].uapsd = uapsd;
K
Kalle Valo 已提交
2095

2096
		if (params[ac].cw_min == 0 ||
2097
		    params[ac].cw_min > params[ac].cw_max) {
2098 2099 2100 2101 2102
			sdata_info(sdata,
				   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
				   params[ac].cw_min, params[ac].cw_max, aci);
			return false;
		}
2103
		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2104 2105
	}

2106 2107 2108 2109 2110 2111 2112 2113 2114 2115
	/* WMM specification requires all 4 ACIs. */
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		if (params[ac].cw_min == 0) {
			sdata_info(sdata,
				   "AP has invalid WMM params (missing AC %d), using defaults\n",
				   ac);
			return false;
		}
	}

2116
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
J
Johannes Berg 已提交
2117
		mlme_dbg(sdata,
2118 2119 2120 2121 2122 2123 2124 2125
			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
			 ac, params[ac].acm,
			 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
			 params[ac].txop, params[ac].uapsd,
			 ifmgd->tx_tspec[ac].downgraded);
		sdata->tx_conf[ac] = params[ac];
		if (!ifmgd->tx_tspec[ac].downgraded &&
		    drv_conf_tx(local, sdata, ac, &params[ac]))
J
Johannes Berg 已提交
2126
			sdata_err(sdata,
2127 2128
				  "failed to set TX queue parameters for AC %d\n",
				  ac);
2129
	}
2130 2131

	/* enable WMM or activate new settings */
2132
	sdata->vif.bss_conf.qos = true;
2133
	return true;
2134 2135
}

2136 2137 2138 2139
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

2140
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2141 2142 2143 2144 2145 2146 2147 2148 2149 2150
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
2151 2152
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
2153
{
J
Johannes Berg 已提交
2154
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2155
	struct ieee80211_supported_band *sband;
2156
	u32 changed = 0;
J
Johannes Berg 已提交
2157 2158 2159 2160
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

2161 2162 2163 2164
	sband = ieee80211_get_sband(sdata);
	if (!sband)
		return changed;

J
Johannes Berg 已提交
2165 2166 2167 2168 2169 2170 2171 2172 2173
	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2174 2175
	if (sband->band == NL80211_BAND_5GHZ ||
	    sband->band == NL80211_BAND_6GHZ)
2176
		use_short_slot = true;
2177

2178 2179 2180
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
2181
	}
2182

2183 2184
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
2185
		changed |= BSS_CHANGED_ERP_PREAMBLE;
2186
	}
2187

J
Johannes Berg 已提交
2188 2189 2190
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
2191 2192 2193 2194 2195
	}

	return changed;
}

2196
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2197
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2198
				     u32 bss_info_changed)
2199
{
2200
	struct ieee80211_bss *bss = (void *)cbss->priv;
2201
	struct ieee80211_local *local = sdata->local;
2202
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2203

J
Johannes Berg 已提交
2204
	bss_info_changed |= BSS_CHANGED_ASSOC;
2205
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
2206
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
2207

2208
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
2209
		beacon_loss_count * bss_conf->beacon_int));
2210

2211 2212
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2213

2214 2215
	ieee80211_check_rate_mask(sdata);

2216 2217
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

2218 2219
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2220
		const struct cfg80211_bss_ies *ies;
2221

2222 2223 2224 2225 2226 2227 2228 2229
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
2230 2231
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
2232
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
2233 2234
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
2235 2236
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
2237
		}
2238
		rcu_read_unlock();
2239 2240
	}

J
Johannes Berg 已提交
2241
	/* just to be sure */
2242
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
2243

2244
	ieee80211_led_assoc(local, 1);
2245

2246
	if (sdata->u.mgd.have_beacon) {
2247 2248 2249 2250 2251 2252 2253
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
2254
		bss_conf->beacon_rate = bss->beacon_rate;
2255
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
2256
	} else {
2257
		bss_conf->beacon_rate = NULL;
2258
		bss_conf->dtim_period = 0;
2259
	}
2260

2261
	bss_conf->assoc = 1;
2262

2263
	/* Tell the driver to monitor connection quality (if supported) */
2264
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2265
	    bss_conf->cqm_rssi_thold)
2266 2267
		bss_info_changed |= BSS_CHANGED_CQM;

2268
	/* Enable ARP filtering */
2269
	if (bss_conf->arp_addr_cnt)
2270 2271
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
2272
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
2273

J
Johannes Berg 已提交
2274
	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2275
	ieee80211_recalc_ps(local);
J
Johannes Berg 已提交
2276
	mutex_unlock(&local->iflist_mtx);
2277

2278
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
2279 2280
	ieee80211_recalc_ps_vif(sdata);

2281
	netif_carrier_on(sdata->dev);
2282 2283
}

2284
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2285 2286
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
2287
{
2288
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2289
	struct ieee80211_local *local = sdata->local;
2290
	u32 changed = 0;
2291

2292
	sdata_assert_lock(sdata);
2293

2294 2295 2296
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
2297 2298 2299
	if (WARN_ON(!ifmgd->associated))
		return;

2300 2301
	ieee80211_stop_poll(sdata);

2302
	ifmgd->associated = NULL;
2303 2304
	netif_carrier_off(sdata->dev);

2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2316 2317 2318
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2319 2320 2321
	/* make sure ongoing transmission finishes */
	synchronize_net();

2322 2323 2324 2325 2326 2327
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2328
	if (tx)
2329
		ieee80211_flush_queues(local, sdata, true);
2330

2331
	/* deauthenticate/disassociate now */
2332 2333 2334 2335 2336 2337 2338 2339 2340
	if (tx || frame_buf) {
		/*
		 * In multi channel scenarios guarantee that the virtual
		 * interface is granted immediate airtime to transmit the
		 * deauthentication frame by calling mgd_prepare_tx, if the
		 * driver requested so.
		 */
		if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
		    !ifmgd->have_beacon)
2341
			drv_mgd_prepare_tx(sdata->local, sdata, 0);
2342

2343 2344 2345
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid,
					       ifmgd->bssid, stype, reason,
					       tx, frame_buf);
2346
	}
2347

2348
	/* flush out frame - make sure the deauth was actually sent */
2349
	if (tx)
2350
		ieee80211_flush_queues(local, sdata, false);
2351

2352
	/* clear bssid only after building the needed mgmt frames */
2353
	eth_zero_addr(ifmgd->bssid);
2354

2355
	/* remove AP and TDLS peers */
2356
	sta_info_flush(sdata);
2357 2358

	/* finally reset all BSS / config parameters */
2359 2360 2361
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2362 2363
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2364

J
Janusz Dziedzic 已提交
2365 2366 2367
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2368

2369
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2370 2371
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2372 2373
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2374 2375 2376 2377 2378 2379 2380

	/* reset MU-MIMO ownership and group data */
	memset(sdata->vif.bss_conf.mu_group.membership, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.membership));
	memset(sdata->vif.bss_conf.mu_group.position, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.position));
	changed |= BSS_CHANGED_MU_GROUPS;
2381
	sdata->vif.mu_mimo_owner = false;
2382

2383
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2384

2385 2386 2387
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2388
	/* Disable ARP filtering */
2389
	if (sdata->vif.bss_conf.arp_addr_cnt)
2390 2391
		changed |= BSS_CHANGED_ARP_FILTER;

2392 2393 2394
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2395 2396
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2397
	ieee80211_bss_info_change_notify(sdata, changed);
2398

2399
	/* disassociated - set to defaults now */
2400
	ieee80211_set_wmm_default(sdata, false, false);
2401

2402 2403 2404 2405
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2406

2407
	sdata->vif.bss_conf.dtim_period = 0;
2408 2409
	sdata->vif.bss_conf.beacon_rate = NULL;

2410
	ifmgd->have_beacon = false;
2411

2412
	ifmgd->flags = 0;
2413
	mutex_lock(&local->mtx);
2414
	ieee80211_vif_release_channel(sdata);
2415 2416

	sdata->vif.csa_active = false;
2417
	ifmgd->csa_waiting_bcn = false;
2418
	ifmgd->csa_ignored_same_chan = false;
2419 2420 2421 2422 2423
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2424
	mutex_unlock(&local->mtx);
2425

2426 2427 2428 2429
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2430
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2431
}
2432

2433 2434 2435 2436 2437 2438 2439 2440
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2441 2442
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2443
	 */
J
Johannes Berg 已提交
2444 2445 2446
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2447
	ieee80211_sta_reset_conn_monitor(sdata);
2448
}
2449

2450 2451 2452
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2453
	struct ieee80211_local *local = sdata->local;
2454

2455
	mutex_lock(&local->mtx);
2456 2457
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2458

2459
	__ieee80211_stop_poll(sdata);
2460 2461

	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2462
	ieee80211_recalc_ps(local);
2463
	mutex_unlock(&local->iflist_mtx);
2464

2465
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2466
		goto out;
2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2478 2479
out:
	mutex_unlock(&local->mtx);
2480 2481
}

2482 2483 2484 2485 2486
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
S
Sara Sharon 已提交
2487
	u16 tid = ieee80211_get_tid(hdr);
2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2517
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2518
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2519
{
2520 2521
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2522
	if (!ieee80211_is_data(hdr->frame_control))
2523 2524
	    return;

2525
	if (ieee80211_is_any_nullfunc(hdr->frame_control) &&
2526
	    sdata->u.mgd.probe_send_count > 0) {
2527
		if (ack)
2528
			ieee80211_sta_reset_conn_monitor(sdata);
2529 2530
		else
			sdata->u.mgd.nullfunc_failed = true;
2531
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2532
		return;
2533
	}
2534 2535 2536

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2537 2538
}

2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552
static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
					  const u8 *src, const u8 *dst,
					  const u8 *ssid, size_t ssid_len,
					  struct ieee80211_channel *channel)
{
	struct sk_buff *skb;

	skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
					ssid, ssid_len, NULL, 0,
					IEEE80211_PROBE_FLAG_DIRECTED);
	if (skb)
		ieee80211_tx_skb(sdata, skb);
}

2553 2554 2555 2556
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2557
	u8 *dst = ifmgd->associated->bssid;
2558
	u8 unicast_limit = max(1, max_probe_tries - 3);
J
Johannes Berg 已提交
2559
	struct sta_info *sta;
2560 2561 2562 2563 2564 2565 2566 2567

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2568

2569 2570 2571 2572 2573 2574 2575
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2576 2577
	ifmgd->probe_send_count++;

J
Johannes Berg 已提交
2578 2579 2580 2581 2582 2583 2584 2585
	if (dst) {
		mutex_lock(&sdata->local->sta_mtx);
		sta = sta_info_get(sdata, dst);
		if (!WARN_ON(!sta))
			ieee80211_check_fast_rx(sta);
		mutex_unlock(&sdata->local->sta_mtx);
	}

2586
	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2587
		ifmgd->nullfunc_failed = false;
2588 2589 2590 2591
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
			ifmgd->probe_send_count--;
		else
			ieee80211_send_nullfunc(sdata->local, sdata, false);
2592
	} else {
2593 2594
		int ssid_len;

2595
		rcu_read_lock();
2596
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2597 2598 2599 2600 2601
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2602 2603 2604
		ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
					      ssid + 2, ssid_len,
					      ifmgd->associated->channel);
2605
		rcu_read_unlock();
2606
	}
2607

2608
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2609
	run_again(sdata, ifmgd->probe_timeout);
2610 2611
}

J
Johannes Berg 已提交
2612 2613
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2614 2615
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2616
	bool already = false;
2617

2618
	if (!ieee80211_sdata_running(sdata))
2619 2620
		return;

2621
	sdata_lock(sdata);
2622 2623 2624 2625

	if (!ifmgd->associated)
		goto out;

2626 2627 2628 2629 2630 2631 2632
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2633
	if (beacon) {
J
Johannes Berg 已提交
2634
		mlme_dbg_ratelimited(sdata,
2635 2636
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2637

2638
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2639
	}
2640

J
Johannes Berg 已提交
2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2652
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2653 2654
		already = true;

E
Eliad Peller 已提交
2655 2656
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2657 2658
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2659 2660 2661
	if (already)
		goto out;

2662
	mutex_lock(&sdata->local->iflist_mtx);
J
Johannes Berg 已提交
2663
	ieee80211_recalc_ps(sdata->local);
2664 2665
	mutex_unlock(&sdata->local->iflist_mtx);

2666 2667
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2668
 out:
2669
	sdata_unlock(sdata);
2670 2671
}

2672 2673 2674 2675 2676
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2677
	struct cfg80211_bss *cbss;
2678 2679
	struct sk_buff *skb;
	const u8 *ssid;
2680
	int ssid_len;
2681 2682 2683 2684

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2685
	sdata_assert_lock(sdata);
2686

2687 2688 2689 2690 2691 2692 2693
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2694 2695
		return NULL;

2696
	rcu_read_lock();
2697
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2698 2699
	if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
		      "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
2700 2701 2702 2703
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2704
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2705
					(u32) -1, cbss->channel,
2706
					ssid + 2, ssid_len,
2707
					NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
2708
	rcu_read_unlock();
2709 2710 2711 2712 2713

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731
static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
					const u8 *buf, size_t len, bool tx,
					u16 reason)
{
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
		.u.mlme.reason = reason,
	};

	if (tx)
		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
	else
		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);

	drv_event_callback(sdata->local, sdata, &event);
}

2732
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2733
{
2734
	struct ieee80211_local *local = sdata->local;
2735
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2736
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2737
	bool tx;
2738

2739
	sdata_lock(sdata);
2740
	if (!ifmgd->associated) {
2741
		sdata_unlock(sdata);
2742 2743 2744
		return;
	}

2745 2746
	tx = !sdata->csa_block_tx;

2747 2748 2749 2750 2751
	/* AP is probably out of range (or not reachable for another reason) so
	 * remove the bss struct for that AP.
	 */
	cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);

2752 2753
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2754
			       tx, frame_buf);
2755
	mutex_lock(&local->mtx);
2756
	sdata->vif.csa_active = false;
2757
	ifmgd->csa_waiting_bcn = false;
2758 2759 2760 2761 2762
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2763
	mutex_unlock(&local->mtx);
2764

2765
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
2766 2767
				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);

2768
	sdata_unlock(sdata);
2769 2770
}

2771
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2772 2773 2774
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2775
			     u.mgd.beacon_connection_loss_work);
2776 2777
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

2778 2779
	if (ifmgd->associated)
		ifmgd->beacon_loss_count++;
J
Johannes Berg 已提交
2780

2781
	if (ifmgd->connection_loss) {
2782 2783
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2784
		__ieee80211_disconnect(sdata);
2785
	} else {
2786
		ieee80211_mgd_probe_ap(sdata, true);
2787 2788 2789 2790 2791 2792 2793 2794 2795
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2796
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2797 2798
}

2799 2800 2801
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2802
	struct ieee80211_hw *hw = &sdata->local->hw;
2803

J
Johannes Berg 已提交
2804 2805
	trace_api_beacon_loss(sdata);

2806
	sdata->u.mgd.connection_loss = false;
2807
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2808 2809 2810
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2811 2812 2813 2814 2815
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2816 2817
	trace_api_connection_loss(sdata);

2818
	sdata->u.mgd.connection_loss = true;
2819 2820 2821 2822 2823
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2824 2825 2826 2827 2828
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2829
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2830 2831

	if (!assoc) {
2832 2833 2834 2835 2836 2837
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2838 2839
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

2840
		eth_zero_addr(sdata->u.mgd.bssid);
J
Johannes Berg 已提交
2841
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2842
		sdata->u.mgd.flags = 0;
2843
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2844
		ieee80211_vif_release_channel(sdata);
2845
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2846 2847
	}

2848
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2849 2850 2851 2852
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

2853
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2854
					 bool assoc, bool abandon)
2855 2856 2857 2858 2859 2860 2861 2862 2863 2864 2865 2866 2867 2868 2869 2870 2871
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

	sdata_assert_lock(sdata);

	if (!assoc) {
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		eth_zero_addr(sdata->u.mgd.bssid);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
		sdata->u.mgd.flags = 0;
2872 2873
		sdata->vif.mu_mimo_owner = false;

2874 2875 2876
		mutex_lock(&sdata->local->mtx);
		ieee80211_vif_release_channel(sdata);
		mutex_unlock(&sdata->local->mtx);
2877 2878 2879

		if (abandon)
			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
2880 2881 2882 2883 2884 2885
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

J
Johannes Berg 已提交
2886 2887 2888
static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2889
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2890 2891 2892
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2893
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2894 2895

	pos = mgmt->u.auth.variable;
2896 2897
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, auth_data->bss->bssid);
J
Johannes Berg 已提交
2898 2899 2900
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
2901
	drv_mgd_prepare_tx(sdata->local, sdata, 0);
2902
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2903 2904
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2905
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2906 2907 2908
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2909
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2910 2911
}

2912 2913 2914
static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
				    const u8 *bssid)
{
2915
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2916
	struct sta_info *sta;
2917
	bool result = true;
2918

2919 2920 2921 2922 2923 2924
	sdata_info(sdata, "authenticated\n");
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
	ifmgd->auth_data->timeout_started = true;
	run_again(sdata, ifmgd->auth_data->timeout);

2925 2926 2927 2928 2929
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2930 2931
		result = false;
		goto out;
2932 2933 2934
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2935 2936
		result = false;
		goto out;
2937 2938
	}

2939 2940 2941
out:
	mutex_unlock(&sdata->local->sta_mtx);
	return result;
2942 2943
}

2944 2945
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2946 2947 2948 2949
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
2950 2951 2952 2953
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = AUTH_EVENT,
	};
J
Johannes Berg 已提交
2954

2955
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2956 2957

	if (len < 24 + 6)
2958
		return;
J
Johannes Berg 已提交
2959 2960

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2961
		return;
J
Johannes Berg 已提交
2962 2963 2964

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2965
	if (!ether_addr_equal(bssid, mgmt->bssid))
2966
		return;
J
Johannes Berg 已提交
2967 2968 2969 2970 2971 2972

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2973 2974 2975 2976 2977
	    (auth_alg != WLAN_AUTH_SAE &&
	     auth_transaction != ifmgd->auth_data->expected_transaction) ||
	    (auth_alg == WLAN_AUTH_SAE &&
	     (auth_transaction < ifmgd->auth_data->expected_transaction ||
	      auth_transaction > 2))) {
2978 2979 2980 2981
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2982
		return;
2983
	}
J
Johannes Berg 已提交
2984 2985

	if (status_code != WLAN_STATUS_SUCCESS) {
2986 2987 2988 2989 2990 2991
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);

		if (auth_alg == WLAN_AUTH_SAE &&
		    status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED)
			return;

J
Johannes Berg 已提交
2992 2993
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2994
		ieee80211_destroy_auth_data(sdata, false);
2995 2996 2997
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
2998
		return;
J
Johannes Berg 已提交
2999 3000 3001 3002 3003 3004
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
3005
	case WLAN_AUTH_SAE:
3006 3007 3008
	case WLAN_AUTH_FILS_SK:
	case WLAN_AUTH_FILS_SK_PFS:
	case WLAN_AUTH_FILS_PK:
J
Johannes Berg 已提交
3009 3010 3011 3012 3013
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
3014
			return;
J
Johannes Berg 已提交
3015 3016 3017 3018 3019
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
3020
		return;
J
Johannes Berg 已提交
3021 3022
	}

3023 3024
	event.u.mlme.status = MLME_SUCCESS;
	drv_event_callback(sdata->local, sdata, &event);
3025 3026 3027 3028
	if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
	    (auth_transaction == 2 &&
	     ifmgd->auth_data->expected_transaction == 2)) {
		if (!ieee80211_mark_sta_auth(sdata, bssid))
3029
			return; /* ignore frame -- wait for timeout */
3030 3031 3032 3033
	} else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
		   auth_transaction == 2) {
		sdata_info(sdata, "SAE peer confirmed\n");
		ifmgd->auth_data->peer_confirmed = true;
3034 3035
	}

3036
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
J
Johannes Berg 已提交
3037 3038
}

3039 3040 3041
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

3042
const char *ieee80211_get_reason_code_string(u16 reason_code)
3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070 3071 3072 3073 3074 3075 3076 3077 3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
3095

3096 3097
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
3098
{
3099
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3100
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3101

3102
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3103

3104
	if (len < 24 + 2)
3105
		return;
3106

3107 3108 3109 3110 3111
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3112 3113 3114
	if (ifmgd->associated &&
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
		const u8 *bssid = ifmgd->associated->bssid;
3115

3116 3117 3118
		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));
3119

3120
		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3121

3122 3123 3124 3125
		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
					    reason_code);
		return;
	}
3126

3127 3128 3129
	if (ifmgd->assoc_data &&
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
		const u8 *bssid = ifmgd->assoc_data->bss->bssid;
3130

3131 3132 3133 3134 3135
		sdata_info(sdata,
			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));

3136
		ieee80211_destroy_assoc_data(sdata, false, true);
3137 3138 3139 3140

		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
		return;
	}
3141 3142 3143
}


3144 3145
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
3146
{
3147
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3148 3149
	u16 reason_code;

3150
	sdata_assert_lock(sdata);
3151

J
Johannes Berg 已提交
3152
	if (len < 24 + 2)
3153
		return;
3154

J
Johannes Berg 已提交
3155
	if (!ifmgd->associated ||
3156
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3157
		return;
3158 3159 3160

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

3161 3162 3163 3164 3165
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3166 3167 3168
	sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
		   mgmt->sa, reason_code,
		   ieee80211_get_reason_code_string(reason_code));
3169

3170 3171
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

3172
	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
3173 3174
}

3175 3176 3177 3178
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
3179
				int *min_rate, int *min_rate_index,
3180
				int shift)
3181 3182 3183 3184
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
3185
		int rate = supp_rates[i] & 0x7f;
3186 3187
		bool is_basic = !!(supp_rates[i] & 0x80);

3188
		if ((rate * 5 * (1 << shift)) > 110)
3189 3190 3191
			*have_higher_than_11mbit = true;

		/*
3192 3193
		 * Skip HT, VHT and HE BSS membership selectors since they're
		 * not rates.
3194
		 *
3195
		 * Note: Even though the membership selector and the basic
3196 3197 3198
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
3199
		if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3200 3201
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY))
3202 3203 3204
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
3205 3206 3207 3208 3209 3210 3211
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
3212 3213 3214
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
3215 3216
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
3217 3218 3219 3220 3221 3222 3223
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
3224

3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235 3236 3237
static bool ieee80211_twt_req_supported(const struct sta_info *sta,
					const struct ieee802_11_elems *elems)
{
	if (elems->ext_capab_len < 10)
		return false;

	if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
		return false;

	return sta->sta.he_cap.he_cap_elem.mac_cap_info[0] &
		IEEE80211_HE_MAC_CAP0_TWT_RES;
}

3238 3239 3240 3241 3242 3243 3244 3245 3246 3247 3248 3249 3250
static int ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee802_11_elems *elems)
{
	bool twt = ieee80211_twt_req_supported(sta, elems);

	if (sdata->vif.bss_conf.twt_requester != twt) {
		sdata->vif.bss_conf.twt_requester = twt;
		return BSS_CHANGED_TWT;
	}
	return 0;
}

J
Johannes Berg 已提交
3251 3252
static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
3253 3254
				    struct ieee80211_mgmt *mgmt, size_t len,
				    struct ieee802_11_elems *elems)
3255
{
3256
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3257
	struct ieee80211_local *local = sdata->local;
3258
	struct ieee80211_supported_band *sband;
3259
	struct sta_info *sta;
J
Johannes Berg 已提交
3260
	u16 capab_info, aid;
J
Johannes Berg 已提交
3261
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3262 3263
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
3264
	bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
J
Johannes Berg 已提交
3265
	u32 changed = 0;
3266
	int err;
3267
	bool ret;
3268

J
Johannes Berg 已提交
3269
	/* AssocResp and ReassocResp have identical structure */
3270 3271

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
3272
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3273

3274 3275 3276 3277 3278
	/*
	 * The 5 MSB of the AID field are reserved
	 * (802.11-2016 9.4.1.8 AID field)
	 */
	aid &= 0x7ff;
3279

3280 3281 3282
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
3283 3284
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
3285 3286 3287 3288
		aid = 0;
		ifmgd->broken_ap = true;
	}

3289
	if (!elems->supp_rates) {
J
Johannes Berg 已提交
3290
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
3291
		return false;
3292 3293
	}

3294
	sdata->vif.bss_conf.aid = aid;
3295
	ifmgd->tdls_chan_switch_prohibited =
3296 3297
		elems->ext_capab && elems->ext_capab_len >= 5 &&
		(elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
3298

3299 3300 3301 3302 3303 3304 3305
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
3306 3307 3308 3309 3310 3311
	if (!is_6ghz &&
	    ((assoc_data->wmm && !elems->wmm_param) ||
	     (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	      (!elems->ht_cap_elem || !elems->ht_operation)) ||
	     (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	      (!elems->vht_cap_elem || !elems->vht_operation)))) {
3312 3313 3314 3315 3316 3317 3318 3319 3320 3321 3322 3323 3324
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
3325 3326 3327
				       false, &bss_elems,
				       mgmt->bssid,
				       assoc_data->bss->bssid);
3328
		if (assoc_data->wmm &&
3329 3330
		    !elems->wmm_param && bss_elems.wmm_param) {
			elems->wmm_param = bss_elems.wmm_param;
3331 3332 3333 3334 3335 3336 3337 3338
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
3339
		if (!elems->ht_cap_elem && bss_elems.ht_cap_elem &&
3340
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3341
			elems->ht_cap_elem = bss_elems.ht_cap_elem;
3342 3343 3344
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
3345
		if (!elems->ht_operation && bss_elems.ht_operation &&
3346
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3347
			elems->ht_operation = bss_elems.ht_operation;
3348 3349 3350
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
3351
		if (!elems->vht_cap_elem && bss_elems.vht_cap_elem &&
3352
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3353
			elems->vht_cap_elem = bss_elems.vht_cap_elem;
3354 3355 3356
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
3357
		if (!elems->vht_operation && bss_elems.vht_operation &&
3358
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3359
			elems->vht_operation = bss_elems.vht_operation;
3360 3361 3362 3363 3364
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

3365 3366 3367 3368
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
3369
	if (!is_6ghz && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3370
	    (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
3371
		sdata_info(sdata,
3372 3373 3374
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
3375 3376
	}

3377
	if (!is_6ghz && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3378
	    (!elems->vht_cap_elem || !elems->vht_operation)) {
3379
		sdata_info(sdata,
3380 3381 3382
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
3383 3384
	}

3385 3386 3387 3388 3389 3390 3391 3392
	if (is_6ghz && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
	    !elems->he_6ghz_capa) {
		sdata_info(sdata,
			   "HE 6 GHz AP is missing HE 6 GHz band capability\n");
		ret = false;
		goto out;
	}

3393 3394 3395 3396 3397
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
3398
	sta = sta_info_get(sdata, cbss->bssid);
3399 3400
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
3401 3402
		ret = false;
		goto out;
3403
	}
3404

3405 3406 3407 3408 3409 3410
	sband = ieee80211_get_sband(sdata);
	if (!sband) {
		mutex_unlock(&sdata->local->sta_mtx);
		ret = false;
		goto out;
	}
3411

L
Luca Coelho 已提交
3412
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3413
	    (!elems->he_cap || !elems->he_operation)) {
L
Luca Coelho 已提交
3414 3415 3416 3417 3418 3419 3420
		mutex_unlock(&sdata->local->sta_mtx);
		sdata_info(sdata,
			   "HE AP is missing HE capability/operation\n");
		ret = false;
		goto out;
	}

3421
	/* Set up internal HT/VHT capabilities */
3422
	if (elems->ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
3423
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3424
						  elems->ht_cap_elem, sta);
3425

3426
	if (elems->vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
M
Mahesh Palivela 已提交
3427
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3428
						    elems->vht_cap_elem, sta);
M
Mahesh Palivela 已提交
3429

3430 3431
	if (elems->he_operation && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
	    elems->he_cap) {
L
Luca Coelho 已提交
3432
		ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
3433 3434
						  elems->he_cap,
						  elems->he_cap_len,
3435
						  elems->he_6ghz_capa,
L
Luca Coelho 已提交
3436 3437 3438
						  sta);

		bss_conf->he_support = sta->sta.he_cap.has_he;
3439 3440 3441 3442 3443 3444 3445 3446
		if (elems->rsnx && elems->rsnx_len &&
		    (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
		    wiphy_ext_feature_isset(local->hw.wiphy,
					    NL80211_EXT_FEATURE_PROTECTED_TWT))
			bss_conf->twt_protected = true;
		else
			bss_conf->twt_protected = false;

3447
		changed |= ieee80211_recalc_twt_req(sdata, sta, elems);
L
Luca Coelho 已提交
3448 3449
	} else {
		bss_conf->he_support = false;
3450
		bss_conf->twt_requester = false;
3451
		bss_conf->twt_protected = false;
L
Luca Coelho 已提交
3452 3453 3454
	}

	if (bss_conf->he_support) {
3455
		bss_conf->he_bss_color.color =
3456
			le32_get_bits(elems->he_operation->he_oper_params,
3457
				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3458 3459 3460 3461 3462 3463 3464
		bss_conf->he_bss_color.partial =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
		bss_conf->he_bss_color.disabled =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
		changed |= BSS_CHANGED_HE_BSS_COLOR;
L
Luca Coelho 已提交
3465 3466

		bss_conf->htc_trig_based_pkt_ext =
3467
			le32_get_bits(elems->he_operation->he_oper_params,
3468
			      IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
L
Luca Coelho 已提交
3469
		bss_conf->frame_time_rts_th =
3470
			le32_get_bits(elems->he_operation->he_oper_params,
3471
			      IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
L
Luca Coelho 已提交
3472 3473 3474 3475 3476 3477 3478 3479 3480

		bss_conf->multi_sta_back_32bit =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP;

		bss_conf->ack_enabled =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_ACK_EN;

3481 3482 3483
		bss_conf->uora_exists = !!elems->uora_element;
		if (elems->uora_element)
			bss_conf->uora_ocw_range = elems->uora_element[0];
L
Luca Coelho 已提交
3484

3485 3486
		ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
		ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
L
Luca Coelho 已提交
3487 3488 3489
		/* TODO: OPEN: what happens if BSS color disable is set? */
	}

S
Sara Sharon 已提交
3490 3491 3492 3493 3494 3495 3496 3497
	if (cbss->transmitted_bss) {
		bss_conf->nontransmitted = true;
		ether_addr_copy(bss_conf->transmitter_bssid,
				cbss->transmitted_bss->bssid);
		bss_conf->bssid_indicator = cbss->max_bssid_indicator;
		bss_conf->bssid_index = cbss->bssid_index;
	}

3498 3499 3500 3501 3502 3503
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
3504

3505 3506 3507 3508 3509
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
3510 3511
	if (elems->opmode_notif &&
	    !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
3512 3513
		u8 nss;

3514
		nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
3515 3516 3517 3518 3519
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

3520
	rate_control_rate_init(sta);
3521

3522
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
J
Johannes Berg 已提交
3523
		set_sta_flag(sta, WLAN_STA_MFP);
3524 3525 3526 3527
		sta->sta.mfp = true;
	} else {
		sta->sta.mfp = false;
	}
3528

3529
	sta->sta.wme = elems->wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3530

3531
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3532 3533 3534
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
3535 3536 3537
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
3538 3539
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
3540 3541
		ret = false;
		goto out;
3542 3543
	}

3544
	mutex_unlock(&sdata->local->sta_mtx);
3545

3546 3547 3548 3549 3550 3551 3552
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;
3553
	ifmgd->mu_edca_last_param_set = -1;
3554

3555
	if (ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
3556
		ieee80211_set_wmm_default(sdata, false, false);
3557 3558 3559
	} else if (!ieee80211_sta_wmm_params(local, sdata, elems->wmm_param,
					     elems->wmm_param_len,
					     elems->mu_edca_param_set)) {
3560 3561 3562 3563 3564 3565 3566 3567 3568 3569 3570
		/* still enable QoS since we might have HT/VHT */
		ieee80211_set_wmm_default(sdata, false, true);
		/* set the disable-WMM flag in this case to disable
		 * tracking WMM parameter changes in the beacon if
		 * the parameters weren't actually valid. Doing so
		 * avoids changing parameters very strangely when
		 * the AP is going back and forth between valid and
		 * invalid parameters.
		 */
		ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
	}
3571
	changed |= BSS_CHANGED_QOS;
3572

3573
	if (elems->max_idle_period_ie) {
3574
		bss_conf->max_idle_period =
3575
			le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
3576
		bss_conf->protected_keep_alive =
3577
			!!(elems->max_idle_period_ie->idle_options &
3578 3579 3580 3581 3582 3583 3584
			   WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
		changed |= BSS_CHANGED_KEEP_ALIVE;
	} else {
		bss_conf->max_idle_period = 0;
		bss_conf->protected_keep_alive = false;
	}

3585
	/* set assoc capability (AID was already set earlier),
J
Johannes Berg 已提交
3586 3587
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->assoc_capability = capab_info;
3588
	ieee80211_set_associated(sdata, cbss, changed);
3589

3590 3591 3592 3593 3594 3595 3596
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3597
	/*
J
Johannes Berg 已提交
3598 3599
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3600
	 */
J
Johannes Berg 已提交
3601
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3602
	ieee80211_sta_reset_beacon_monitor(sdata);
3603

3604 3605 3606 3607
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3608 3609
}

3610 3611 3612
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3613 3614 3615 3616 3617
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3618
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3619 3620
	u8 *pos;
	bool reassoc;
3621
	struct cfg80211_bss *bss;
3622 3623 3624 3625
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = ASSOC_EVENT,
	};
J
Johannes Berg 已提交
3626

3627
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3628 3629

	if (!assoc_data)
3630
		return;
3631
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3632
		return;
J
Johannes Berg 已提交
3633 3634 3635 3636 3637 3638 3639

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3640
		return;
J
Johannes Berg 已提交
3641

3642
	reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
J
Johannes Berg 已提交
3643 3644 3645 3646
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3647 3648 3649 3650
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3651

3652 3653 3654 3655
	if (assoc_data->fils_kek_len &&
	    fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
		return;

J
Johannes Berg 已提交
3656
	pos = mgmt->u.assoc_resp.variable;
3657 3658
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, assoc_data->bss->bssid);
J
Johannes Berg 已提交
3659 3660

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3661 3662
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3663
		u32 tu, ms;
3664
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3665
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3666 3667 3668
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3669
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3670
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3671
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3672 3673
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3674 3675
	}

3676
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3677 3678

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3679 3680
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
3681
		ieee80211_destroy_assoc_data(sdata, false, false);
3682 3683 3684
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3685
	} else {
3686
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len, &elems)) {
J
Johannes Berg 已提交
3687
			/* oops -- internal error -- send timeout for now */
3688
			ieee80211_destroy_assoc_data(sdata, false, false);
3689
			cfg80211_assoc_timeout(sdata->dev, bss);
3690
			return;
J
Johannes Berg 已提交
3691
		}
3692 3693
		event.u.mlme.status = MLME_SUCCESS;
		drv_event_callback(sdata->local, sdata, &event);
3694
		sdata_info(sdata, "associated\n");
3695 3696 3697 3698 3699 3700

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
3701
		ieee80211_destroy_assoc_data(sdata, true, false);
3702 3703 3704 3705 3706

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
3707
				uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
J
Johannes Berg 已提交
3708 3709
	}

3710 3711
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues,
			       ifmgd->assoc_req_ies, ifmgd->assoc_req_ies_len);
J
Johannes Berg 已提交
3712
}
J
Johannes Berg 已提交
3713

3714
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3715
				  struct ieee80211_mgmt *mgmt, size_t len,
3716
				  struct ieee80211_rx_status *rx_status)
3717 3718
{
	struct ieee80211_local *local = sdata->local;
3719
	struct ieee80211_bss *bss;
3720
	struct ieee80211_channel *channel;
3721

3722
	sdata_assert_lock(sdata);
3723

3724 3725
	channel = ieee80211_get_channel_khz(local->hw.wiphy,
					ieee80211_rx_status_to_khz(rx_status));
3726
	if (!channel)
3727 3728
		return;

3729
	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
3730 3731
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3732
		ieee80211_rx_bss_put(local, bss);
3733
	}
3734 3735 3736
}


3737
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3738
					 struct sk_buff *skb)
3739
{
J
Johannes Berg 已提交
3740
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3741
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3742
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
3743
	struct ieee80211_channel *channel;
J
Johannes Berg 已提交
3744
	size_t baselen, len = skb->len;
3745

3746 3747
	ifmgd = &sdata->u.mgd;

3748
	sdata_assert_lock(sdata);
3749

3750 3751 3752 3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763 3764
	/*
	 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
	 * "If a 6 GHz AP receives a Probe Request frame  and responds with
	 * a Probe Response frame [..], the Address 1 field of the Probe
	 * Response frame shall be set to the broadcast address [..]"
	 * So, on 6GHz band we should also accept broadcast responses.
	 */
	channel = ieee80211_get_channel(sdata->local->hw.wiphy,
					rx_status->freq);
	if (!channel)
		return;

	if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
	    (channel->band != NL80211_BAND_6GHZ ||
	     !is_broadcast_ether_addr(mgmt->da)))
3765 3766
		return; /* ignore ProbeResp to foreign address */

3767 3768 3769 3770
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

3771
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
3772

3773
	if (ifmgd->associated &&
3774
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3775
		ieee80211_reset_ap_probe(sdata);
3776 3777
}

3778 3779 3780
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3781 3782 3783
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3784 3785 3786 3787 3788 3789 3790 3791 3792 3793
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3794 3795 3796 3797 3798
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3799 3800
	(1ULL << WLAN_EID_HT_OPERATION) |
	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3801

3802 3803 3804 3805 3806
static void ieee80211_handle_beacon_sig(struct ieee80211_sub_if_data *sdata,
					struct ieee80211_if_managed *ifmgd,
					struct ieee80211_bss_conf *bss_conf,
					struct ieee80211_local *local,
					struct ieee80211_rx_status *rx_status)
3807
{
3808
	/* Track average RSSI from the Beacon frames of the current AP */
3809

3810 3811
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3812
		ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3813
		ifmgd->last_cqm_event_signal = 0;
3814
		ifmgd->count_beacon_signal = 1;
3815
		ifmgd->last_ave_beacon_signal = 0;
3816
	} else {
3817
		ifmgd->count_beacon_signal++;
3818
	}
3819

3820 3821
	ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);

3822 3823
	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3824
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3825
		int last_sig = ifmgd->last_ave_beacon_signal;
3826 3827 3828
		struct ieee80211_event event = {
			.type = RSSI_EVENT,
		};
3829 3830 3831 3832 3833 3834 3835 3836

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3837 3838
			event.u.rssi.data = RSSI_EVENT_HIGH;
			drv_event_callback(local, sdata, &event);
3839 3840 3841 3842
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3843 3844
			event.u.rssi.data = RSSI_EVENT_LOW;
			drv_event_callback(local, sdata, &event);
3845 3846 3847
		}
	}

3848
	if (bss_conf->cqm_rssi_thold &&
3849
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3850
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3851
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3852 3853 3854
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
3855

3856 3857 3858 3859 3860 3861
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3862
				sig, GFP_KERNEL);
3863 3864 3865 3866 3867 3868
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3869
				sig, GFP_KERNEL);
3870 3871 3872
		}
	}

3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895
	if (bss_conf->cqm_rssi_low &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
		int last_event = ifmgd->last_cqm_event_signal;
		int low = bss_conf->cqm_rssi_low;
		int high = bss_conf->cqm_rssi_high;

		if (sig < low &&
		    (last_event == 0 || last_event >= low)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				sig, GFP_KERNEL);
		} else if (sig > high &&
			   (last_event == 0 || last_event <= high)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				sig, GFP_KERNEL);
		}
	}
3896 3897
}

S
Sara Sharon 已提交
3898 3899 3900 3901 3902 3903 3904 3905 3906 3907
static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
				    struct cfg80211_bss *bss)
{
	if (ether_addr_equal(tx_bssid, bss->bssid))
		return true;
	if (!bss->transmitted_bss)
		return false;
	return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
}

3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
	size_t baselen;
	struct ieee802_11_elems elems;
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
	struct sta_info *sta;
	u32 changed = 0;
	bool erp_valid;
	u8 erp_value = 0;
	u32 ncrc;
	u8 *bssid;
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_assert_lock(sdata);

	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
		return;
	}

3941 3942
	if (ieee80211_rx_status_to_khz(rx_status) !=
	    ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
3943 3944 3945 3946 3947 3948 3949
		rcu_read_unlock();
		return;
	}
	chan = chanctx_conf->def.chan;
	rcu_read_unlock();

	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
S
Sara Sharon 已提交
3950
	    ieee80211_rx_our_beacon(mgmt->bssid, ifmgd->assoc_data->bss)) {
3951
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3952 3953 3954
				       len - baselen, false, &elems,
				       mgmt->bssid,
				       ifmgd->assoc_data->bss->bssid);
3955

3956
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
S
Sara Sharon 已提交
3957 3958 3959

		if (elems.dtim_period)
			ifmgd->dtim_period = elems.dtim_period;
3960 3961 3962 3963 3964 3965 3966
		ifmgd->have_beacon = true;
		ifmgd->assoc_data->need_beacon = false;
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
S
Sara Sharon 已提交
3967
			sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
3968
		}
S
Sara Sharon 已提交
3969 3970 3971 3972 3973 3974 3975 3976 3977

		if (elems.mbssid_config_ie)
			bss_conf->profile_periodicity =
				elems.mbssid_config_ie->profile_periodicity;

		if (elems.ext_capab_len >= 11 &&
		    (elems.ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			bss_conf->ema_ap = true;

3978 3979 3980 3981 3982 3983 3984 3985
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
		ifmgd->assoc_data->timeout_started = true;
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
	}

	if (!ifmgd->associated ||
S
Sara Sharon 已提交
3986
	    !ieee80211_rx_our_beacon(mgmt->bssid,  ifmgd->associated))
3987 3988 3989 3990 3991 3992
		return;
	bssid = ifmgd->associated->bssid;

	if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
		ieee80211_handle_beacon_sig(sdata, ifmgd, bss_conf,
					    local, rx_status);
3993

3994
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3995
		mlme_dbg_ratelimited(sdata,
3996
				     "cancelling AP probe due to a received beacon\n");
3997
		ieee80211_reset_ap_probe(sdata);
3998 3999
	}

J
Johannes Berg 已提交
4000 4001 4002 4003
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
4004
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
4005

4006 4007
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
4008
					  len - baselen, false, &elems,
4009 4010
					  care_about_ies, ncrc,
					  mgmt->bssid, bssid);
4011

4012
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
4013
	    ieee80211_check_tim(elems.tim, elems.tim_len, bss_conf->aid)) {
4014 4015 4016 4017 4018
		if (local->hw.conf.dynamic_ps_timeout > 0) {
			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
				ieee80211_hw_config(local,
						    IEEE80211_CONF_CHANGE_PS);
4019
			}
4020
			ieee80211_send_nullfunc(local, sdata, false);
4021 4022 4023 4024 4025 4026 4027 4028 4029 4030 4031 4032
		} else if (!local->pspolling && sdata->u.mgd.powersave) {
			local->pspolling = true;

			/*
			 * Here is assumed that the driver will be
			 * able to send ps-poll frame and receive a
			 * response even though power save mode is
			 * enabled, but some drivers might require
			 * to disable power save here. This needs
			 * to be investigated.
			 */
			ieee80211_send_pspoll(local, sdata);
4033 4034
		}
	}
J
Johannes Berg 已提交
4035

4036 4037
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
J
Janusz Dziedzic 已提交
4038
		struct ieee80211_p2p_noa_attr noa = {};
4039 4040 4041 4042 4043
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
4044
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
4045 4046 4047 4048 4049 4050 4051 4052 4053 4054 4055 4056 4057 4058 4059 4060
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
4061 4062 4063 4064 4065
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

4066 4067 4068
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

4069 4070 4071 4072 4073 4074 4075 4076
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
4077
	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4078 4079 4080 4081
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
S
Sara Sharon 已提交
4082
		sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
4083 4084
	}

4085
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
4086
		return;
4087
	ifmgd->beacon_crc = ncrc;
4088
	ifmgd->beacon_crc_valid = true;
4089

4090
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
4091

4092
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
4093
					 rx_status->device_timestamp,
4094 4095
					 &elems, true);

4096 4097
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
L
Luca Coelho 已提交
4098 4099
				     elems.wmm_param_len,
				     elems.mu_edca_param_set))
4100 4101
		changed |= BSS_CHANGED_QOS;

4102 4103
	/*
	 * If we haven't had a beacon before, tell the driver about the
4104
	 * DTIM period (and beacon timing if desired) now.
4105
	 */
4106
	if (!ifmgd->have_beacon) {
4107
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
S
Sara Sharon 已提交
4108
		bss_conf->dtim_period = elems.dtim_period ?: 1;
4109

4110 4111
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
4112 4113

		mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
4114
		ieee80211_recalc_ps(local);
4115 4116
		mutex_unlock(&local->iflist_mtx);

4117
		ieee80211_recalc_ps_vif(sdata);
4118 4119
	}

4120
	if (elems.erp_info) {
J
Johannes Berg 已提交
4121 4122 4123 4124
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
4125
	}
J
Johannes Berg 已提交
4126 4127 4128
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
4129

4130
	mutex_lock(&local->sta_mtx);
4131 4132
	sta = sta_info_get(sdata, bssid);

4133 4134
	changed |= ieee80211_recalc_twt_req(sdata, sta, &elems);

4135 4136
	if (ieee80211_config_bw(sdata, sta, elems.ht_cap_elem,
				elems.vht_cap_elem, elems.ht_operation,
L
Luca Coelho 已提交
4137 4138
				elems.vht_operation, elems.he_operation,
				bssid, &changed)) {
4139
		mutex_unlock(&local->sta_mtx);
4140 4141 4142
		sdata_info(sdata,
			   "failed to follow AP %pM bandwidth change, disconnect\n",
			   bssid);
4143 4144 4145
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
4146 4147 4148
		ieee80211_report_disconnect(sdata, deauth_buf,
					    sizeof(deauth_buf), true,
					    WLAN_REASON_DEAUTH_LEAVING);
4149
		return;
4150
	}
4151 4152 4153

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
4154
					    rx_status->band);
4155
	mutex_unlock(&local->sta_mtx);
4156

4157 4158 4159
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
4160 4161
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
4162

4163
	ieee80211_bss_info_change_notify(sdata, changed);
4164 4165
}

4166 4167
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
4168 4169 4170 4171
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
4172 4173
	struct ieee802_11_elems elems;
	int ies_len;
4174 4175 4176 4177 4178

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

4179
	sdata_lock(sdata);
4180

J
Johannes Berg 已提交
4181 4182
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
4183
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
4184 4185 4186 4187 4188
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
4189
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4190 4191
		break;
	case IEEE80211_STYPE_DEAUTH:
4192
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4193 4194
		break;
	case IEEE80211_STYPE_DISASSOC:
4195
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4196 4197 4198
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
4199
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4200 4201
		break;
	case IEEE80211_STYPE_ACTION:
4202
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
4203 4204 4205
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
4206 4207 4208 4209

			if (ies_len < 0)
				break;

4210
			/* CSA IE cannot be overridden, no need for BSSID */
4211 4212
			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
4213
				ies_len, true, &elems, mgmt->bssid, NULL);
4214 4215 4216 4217

			if (elems.parse_error)
				break;

4218
			ieee80211_sta_process_chanswitch(sdata,
4219 4220 4221
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4222 4223 4224 4225 4226 4227 4228 4229
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

4230 4231 4232 4233
			/*
			 * extended CSA IE can't be overridden, no need for
			 * BSSID
			 */
4234 4235
			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
4236
				ies_len, true, &elems, mgmt->bssid, NULL);
4237 4238 4239 4240 4241 4242 4243 4244

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
4245
			ieee80211_sta_process_chanswitch(sdata,
4246 4247 4248
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4249
		}
4250
		break;
4251
	}
4252
	sdata_unlock(sdata);
4253 4254
}

4255
static void ieee80211_sta_timer(struct timer_list *t)
4256
{
J
Johannes Berg 已提交
4257
	struct ieee80211_sub_if_data *sdata =
4258
		from_timer(sdata, t, u.mgd.timer);
4259

4260
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
4261 4262
}

4263
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
4264
					  u8 *bssid, u8 reason, bool tx)
4265
{
4266
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4267

4268
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
4269
			       tx, frame_buf);
4270

4271 4272
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    reason);
4273 4274
}

4275
static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4276 4277 4278 4279
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
4280
	u32 tx_flags = 0;
4281 4282
	u16 trans = 1;
	u16 status = 0;
4283
	u16 prepare_tx_duration = 0;
J
Johannes Berg 已提交
4284

4285
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4286 4287 4288 4289 4290 4291 4292

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
4293 4294
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
4295 4296 4297 4298 4299 4300 4301 4302 4303 4304

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

4305 4306 4307 4308 4309
	if (auth_data->algorithm == WLAN_AUTH_SAE)
		prepare_tx_duration =
			jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);

	drv_mgd_prepare_tx(local, sdata, prepare_tx_duration);
J
Johannes Berg 已提交
4310

4311 4312 4313
	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
		   auth_data->bss->bssid, auth_data->tries,
		   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
4314

4315
	auth_data->expected_transaction = 2;
4316

4317 4318 4319 4320 4321
	if (auth_data->algorithm == WLAN_AUTH_SAE) {
		trans = auth_data->sae_trans;
		status = auth_data->sae_status;
		auth_data->expected_transaction = trans;
	}
J
Johannes Berg 已提交
4322

4323 4324 4325
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
4326

4327 4328 4329 4330 4331
	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
			    auth_data->data, auth_data->data_len,
			    auth_data->bss->bssid,
			    auth_data->bss->bssid, NULL, 0, 0,
			    tx_flags);
J
Johannes Berg 已提交
4332

4333
	if (tx_flags == 0) {
4334 4335 4336 4337 4338
		if (auth_data->algorithm == WLAN_AUTH_SAE)
			auth_data->timeout = jiffies +
				IEEE80211_AUTH_TIMEOUT_SAE;
		else
			auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
4339
	} else {
4340 4341
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
4342
	}
J
Johannes Berg 已提交
4343

4344 4345 4346
	auth_data->timeout_started = true;
	run_again(sdata, auth_data->timeout);

J
Johannes Berg 已提交
4347 4348 4349 4350 4351 4352 4353 4354
	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

4355
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4356 4357 4358

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
4359 4360
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
4361 4362 4363 4364 4365 4366 4367 4368 4369 4370

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
4371 4372 4373
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
4374 4375
	ieee80211_send_assoc(sdata);

4376
	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
4377
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
4378
		assoc_data->timeout_started = true;
4379
		run_again(sdata, assoc_data->timeout);
4380
	} else {
4381 4382 4383 4384 4385
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
4386
	}
J
Johannes Berg 已提交
4387 4388 4389 4390

	return 0;
}

4391 4392 4393 4394 4395 4396 4397 4398 4399 4400 4401 4402
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

4403
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4404 4405
{
	struct ieee80211_local *local = sdata->local;
4406
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4407

4408
	sdata_lock(sdata);
4409

4410 4411 4412 4413 4414
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
4415
		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
4416
			if (status_acked) {
4417 4418 4419 4420 4421 4422 4423 4424 4425
				if (ifmgd->auth_data->algorithm ==
				    WLAN_AUTH_SAE)
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SAE;
				else
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SHORT;
4426
				run_again(sdata, ifmgd->auth_data->timeout);
4427 4428 4429
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
4430
			ifmgd->auth_data->timeout_started = true;
4431 4432 4433 4434 4435 4436
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
4437
				run_again(sdata, ifmgd->assoc_data->timeout);
4438 4439 4440
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
4441
			ifmgd->assoc_data->timeout_started = true;
4442 4443 4444
		}
	}

4445
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
4446 4447 4448 4449 4450 4451 4452
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
4453
		} else if (ieee80211_auth(sdata)) {
J
Johannes Berg 已提交
4454
			u8 bssid[ETH_ALEN];
4455 4456 4457 4458 4459
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = AUTH_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4460 4461 4462 4463 4464

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

4465
			cfg80211_auth_timeout(sdata->dev, bssid);
4466
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4467
		}
4468
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
4469
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
4470

4471
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
4472
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
4473
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
4474
		    ieee80211_do_assoc(sdata)) {
4475
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4476 4477 4478 4479 4480
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = ASSOC_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4481

4482
			ieee80211_destroy_assoc_data(sdata, false, false);
4483
			cfg80211_assoc_timeout(sdata->dev, bss);
4484
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4485
		}
4486
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
4487
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
4488

4489
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
4490
	    ifmgd->associated) {
4491
		u8 bssid[ETH_ALEN];
4492
		int max_tries;
4493

4494
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
4495

4496
		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
4497
			max_tries = max_nullfunc_tries;
4498
		else
4499
			max_tries = max_probe_tries;
4500

4501 4502 4503
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
4504 4505
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4506 4507 4508 4509
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
4510 4511
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
4512 4513 4514
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
4515
				ieee80211_sta_connection_lost(sdata, bssid,
4516 4517
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
4518 4519
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
4520
			run_again(sdata, ifmgd->probe_timeout);
4521
		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
J
Johannes Berg 已提交
4522 4523 4524
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
4525
			ieee80211_sta_connection_lost(sdata, bssid,
4526
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
4527
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4528 4529 4530 4531
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
4532 4533
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
4534 4535 4536 4537
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
4538 4539 4540
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, disconnecting.\n",
				 bssid, probe_wait_ms);
4541

4542
			ieee80211_sta_connection_lost(sdata, bssid,
4543
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
4544 4545 4546
		}
	}

4547
	sdata_unlock(sdata);
4548 4549
}

4550
static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4551 4552
{
	struct ieee80211_sub_if_data *sdata =
4553
		from_timer(sdata, t, u.mgd.bcn_mon_timer);
4554
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4555

4556
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4557 4558
		return;

4559
	sdata->u.mgd.connection_loss = false;
4560 4561
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
4562 4563
}

4564
static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4565 4566
{
	struct ieee80211_sub_if_data *sdata =
4567
		from_timer(sdata, t, u.mgd.conn_mon_timer);
J
Johannes Berg 已提交
4568 4569 4570
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

4571
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4572 4573
		return;

4574
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
4575 4576 4577 4578 4579 4580 4581 4582 4583 4584 4585
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
4586 4587
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
4588
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
4589
		__ieee80211_stop_poll(sdata);
4590

J
Johannes Berg 已提交
4591
		/* let's probe the connection once */
4592
		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
4593 4594
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
4595
	}
J
Johannes Berg 已提交
4596
}
4597

4598
#ifdef CONFIG_PM
4599 4600 4601 4602 4603 4604 4605
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

4606 4607 4608 4609 4610
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

4611
		/*
4612 4613 4614
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
4615
		 */
4616
		ieee80211_send_deauth_disassoc(sdata, bssid, bssid,
4617 4618 4619
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
4620
		if (ifmgd->assoc_data)
4621
			ieee80211_destroy_assoc_data(sdata, false, true);
4622 4623
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
4624 4625 4626 4627
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

4628 4629 4630 4631 4632 4633 4634 4635 4636 4637 4638 4639 4640 4641 4642 4643 4644 4645 4646 4647 4648 4649 4650 4651 4652 4653 4654 4655
	/* This is a bit of a hack - we should find a better and more generic
	 * solution to this. Normally when suspending, cfg80211 will in fact
	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
	 * auth (not so important) or assoc (this is the problem) process.
	 *
	 * As a consequence, it can happen that we are in the process of both
	 * associating and suspending, and receive an association response
	 * after cfg80211 has checked if it needs to disconnect, but before
	 * we actually set the flag to drop incoming frames. This will then
	 * cause the workqueue flush to process the association response in
	 * the suspend, resulting in a successful association just before it
	 * tries to remove the interface from the driver, which now though
	 * has a channel context assigned ... this results in issues.
	 *
	 * To work around this (for now) simply deauth here again if we're
	 * now connected.
	 */
	if (ifmgd->associated && !sdata->local->wowlan) {
		u8 bssid[ETH_ALEN];
		struct cfg80211_deauth_request req = {
			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
			.bssid = bssid,
		};

		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
		ieee80211_mgd_deauth(sdata, &req);
	}

4656 4657 4658
	sdata_unlock(sdata);
}

4659 4660 4661 4662
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4663
	sdata_lock(sdata);
4664
	if (!ifmgd->associated) {
4665
		sdata_unlock(sdata);
4666 4667 4668 4669 4670 4671 4672 4673 4674 4675
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4676
		sdata_unlock(sdata);
4677 4678
		return;
	}
4679
	sdata_unlock(sdata);
4680 4681 4682
}
#endif

J
Johannes Berg 已提交
4683 4684
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4685
{
4686
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4687

4688
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4689
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4690
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4691 4692
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4693 4694
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4695
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4696 4697
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4698 4699 4700 4701
	timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
	timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
	timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
	timer_setup(&ifmgd->chswitch_timer, ieee80211_chswitch_timer, 0);
4702 4703
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4704

4705
	ifmgd->flags = 0;
4706
	ifmgd->powersave = sdata->wdev.ps;
4707 4708
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4709
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4710

4711
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4712 4713 4714
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4715 4716 4717 4718 4719

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4720 4721
}

4722 4723
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4724
{
4725
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4726

4727 4728
	/* Restart STA timers */
	rcu_read_lock();
4729 4730 4731 4732
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4733 4734
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4735

J
Johannes Berg 已提交
4736 4737 4738 4739 4740 4741 4742 4743 4744 4745 4746 4747
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4748
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4749 4750 4751 4752 4753 4754 4755 4756 4757 4758 4759 4760
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4761
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

L
Luca Coelho 已提交
4780 4781 4782 4783 4784 4785
static bool
ieee80211_verify_sta_he_mcs_support(struct ieee80211_supported_band *sband,
				    const struct ieee80211_he_operation *he_op)
{
	const struct ieee80211_sta_he_cap *sta_he_cap =
		ieee80211_get_he_sta_cap(sband);
4786
	u16 ap_min_req_set;
L
Luca Coelho 已提交
4787 4788 4789 4790 4791
	int i;

	if (!sta_he_cap || !he_op)
		return false;

4792 4793
	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);

L
Luca Coelho 已提交
4794 4795 4796 4797 4798 4799 4800 4801 4802 4803 4804 4805 4806 4807 4808 4809 4810 4811 4812 4813 4814 4815 4816 4817 4818 4819 4820 4821 4822 4823 4824 4825 4826 4827 4828 4829 4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840 4841
	/* Need to go over for 80MHz, 160MHz and for 80+80 */
	for (i = 0; i < 3; i++) {
		const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
			&sta_he_cap->he_mcs_nss_supp;
		u16 sta_mcs_map_rx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
		u16 sta_mcs_map_tx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
		u8 nss;
		bool verified = true;

		/*
		 * For each band there is a maximum of 8 spatial streams
		 * possible. Each of the sta_mcs_map_* is a 16-bit struct built
		 * of 2 bits per NSS (1-8), with the values defined in enum
		 * ieee80211_he_mcs_support. Need to make sure STA TX and RX
		 * capabilities aren't less than the AP's minimum requirements
		 * for this HE BSS per SS.
		 * It is enough to find one such band that meets the reqs.
		 */
		for (nss = 8; nss > 0; nss--) {
			u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
			u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
			u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;

			if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
				continue;

			/*
			 * Make sure the HE AP doesn't require MCSs that aren't
			 * supported by the client
			 */
			if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
				verified = false;
				break;
			}
		}

		if (verified)
			return true;
	}

	/* If here, STA doesn't meet AP's HE min requirements */
	return false;
}

4842 4843
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4844 4845 4846
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4847
	const struct ieee80211_ht_cap *ht_cap = NULL;
4848
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4849
	const struct ieee80211_vht_operation *vht_oper = NULL;
L
Luca Coelho 已提交
4850
	const struct ieee80211_he_operation *he_oper = NULL;
4851
	struct ieee80211_supported_band *sband;
4852
	struct cfg80211_chan_def chandef;
4853
	bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4854
	struct ieee80211_bss *bss = (void *)cbss->priv;
J
Johannes Berg 已提交
4855
	int ret;
4856 4857
	u32 i;
	bool have_80mhz;
4858

4859 4860
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4861 4862 4863 4864
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4865
	/* disable HT/VHT/HE if we don't support them */
4866
	if (!sband->ht_cap.ht_supported && !is_6ghz) {
4867 4868 4869 4870 4871
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

4872
	if (!sband->vht_cap.vht_supported && !is_6ghz) {
4873
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4874 4875
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}
4876 4877 4878 4879

	if (!ieee80211_get_he_sta_cap(sband))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

4880 4881
	rcu_read_lock();

4882
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) && !is_6ghz) {
4883
		const u8 *ht_oper_ie, *ht_cap_ie;
4884

4885
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4886 4887
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4888

4889 4890 4891 4892 4893
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4894 4895 4896
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4897 4898
	}

4899
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) && !is_6ghz) {
4900
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4901

4902 4903
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4904 4905 4906 4907
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4908
			sdata_info(sdata,
4909
				   "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4910 4911
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4912
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
4913
		}
4914 4915 4916 4917 4918 4919

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4920 4921
	}

4922
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE)) {
L
Luca Coelho 已提交
4923 4924 4925 4926 4927 4928 4929 4930 4931 4932 4933 4934
		const struct cfg80211_bss_ies *ies;
		const u8 *he_oper_ie;

		ies = rcu_dereference(cbss->ies);
		he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
						  ies->data, ies->len);
		if (he_oper_ie &&
		    he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3]))
			he_oper = (void *)(he_oper_ie + 3);
		else
			he_oper = NULL;

4935
		if (!ieee80211_verify_sta_he_mcs_support(sband, he_oper))
L
Luca Coelho 已提交
4936 4937 4938
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

4939 4940 4941 4942 4943 4944 4945 4946 4947 4948 4949 4950 4951 4952
	/* Allow VHT if at least one channel on the sband supports 80 MHz */
	have_80mhz = false;
	for (i = 0; i < sband->n_channels; i++) {
		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
						IEEE80211_CHAN_NO_80MHZ))
			continue;

		have_80mhz = true;
		break;
	}

	if (!have_80mhz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4953 4954
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
4955
						     bss->vht_cap_info,
L
Luca Coelho 已提交
4956
						     ht_oper, vht_oper, he_oper,
4957
						     &chandef, false);
4958

J
Johannes Berg 已提交
4959 4960
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4961

4962 4963
	rcu_read_unlock();

4964 4965 4966 4967 4968
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HE && is_6ghz) {
		sdata_info(sdata, "Rejecting non-HE 6/7 GHz connection");
		return -EINVAL;
	}

4969 4970 4971
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4972
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4973 4974 4975 4976 4977 4978 4979
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4980 4981 4982 4983

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4984
		goto out;
4985

4986
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4987
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4988 4989 4990
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4991 4992
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4993
	return ret;
4994 4995
}

S
Sara Sharon 已提交
4996 4997 4998 4999 5000 5001 5002 5003 5004 5005 5006 5007 5008 5009 5010 5011 5012 5013 5014 5015 5016 5017 5018 5019 5020 5021 5022 5023 5024 5025 5026 5027 5028 5029
static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
			       u8 *dtim_count, u8 *dtim_period)
{
	const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
	const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
					 ies->len);
	const struct ieee80211_tim_ie *tim = NULL;
	const struct ieee80211_bssid_index *idx;
	bool valid = tim_ie && tim_ie[1] >= 2;

	if (valid)
		tim = (void *)(tim_ie + 2);

	if (dtim_count)
		*dtim_count = valid ? tim->dtim_count : 0;

	if (dtim_period)
		*dtim_period = valid ? tim->dtim_period : 0;

	/* Check if value is overridden by non-transmitted profile */
	if (!idx_ie || idx_ie[1] < 3)
		return valid;

	idx = (void *)(idx_ie + 2);

	if (dtim_count)
		*dtim_count = idx->dtim_count;

	if (dtim_period)
		*dtim_period = idx->dtim_period;

	return true;
}

5030
static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
5031 5032
				     struct cfg80211_bss *cbss, bool assoc,
				     bool override)
5033 5034 5035 5036 5037
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
5038
	struct ieee80211_supported_band *sband;
5039
	bool have_sta = false;
5040 5041
	int err;

5042 5043
	sband = local->hw.wiphy->bands[cbss->channel->band];

5044 5045 5046
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

5047 5048 5049 5050
	/* If a reconfig is happening, bail out */
	if (local->in_reconfig)
		return -EBUSY;

5051 5052 5053 5054 5055 5056 5057 5058 5059 5060 5061
	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
5062

5063 5064 5065 5066 5067 5068 5069 5070 5071 5072 5073 5074 5075
	/*
	 * Set up the information for the new channel before setting the
	 * new channel. We can't - completely race-free - change the basic
	 * rates bitmap and the channel (sband) that it refers to, but if
	 * we set it up before we at least avoid calling into the driver's
	 * bss_info_changed() method with invalid information (since we do
	 * call that from changing the channel - only for IDLE and perhaps
	 * some others, but ...).
	 *
	 * So to avoid that, just set up all the new information before the
	 * channel, but tell the driver to apply it only afterwards, since
	 * it might need the new channel for that.
	 */
J
Johannes Berg 已提交
5076
	if (new_sta) {
5077 5078 5079
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
J
Johannes Berg 已提交
5080
		const struct cfg80211_bss_ies *ies;
5081
		int shift = ieee80211_vif_get_shift(&sdata->vif);
5082 5083 5084 5085 5086

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
5087
				    &min_rate, &min_rate_index,
5088
				    shift);
5089 5090 5091 5092 5093 5094 5095 5096

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
5097 5098
		 * Allow this workaround only in case the AP provided at least
		 * one rate.
5099
		 */
5100 5101 5102 5103 5104 5105 5106
		if (min_rate_index < 0) {
			sdata_info(sdata,
				   "No legacy rates in association response\n");

			sta_info_free(local, new_sta);
			return -EINVAL;
		} else if (!basic_rates) {
J
Johannes Berg 已提交
5107 5108
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
5109 5110 5111
			basic_rates = BIT(min_rate_index);
		}

5112 5113 5114 5115 5116 5117
		if (rates)
			new_sta->sta.supp_rates[cbss->channel->band] = rates;
		else
			sdata_info(sdata,
				   "No rates found, keeping mandatory only\n");

5118 5119 5120
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
5121
		if (cbss->channel->band == NL80211_BAND_2GHZ &&
5122 5123 5124 5125 5126 5127 5128
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

5129 5130
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
5131
		rcu_read_lock();
5132 5133 5134 5135 5136
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
S
Sara Sharon 已提交
5137 5138 5139 5140

			ieee80211_get_dtim(ies,
					   &sdata->vif.bss_conf.sync_dtim_count,
					   NULL);
5141 5142
		} else if (!ieee80211_hw_check(&sdata->local->hw,
					       TIMING_BEACON_ONLY)) {
5143 5144 5145 5146 5147 5148 5149 5150 5151 5152 5153
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
5154
		rcu_read_unlock();
5155
	}
5156

5157 5158 5159 5160 5161 5162 5163 5164 5165 5166 5167 5168 5169 5170
	if (new_sta || override) {
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

	if (new_sta) {
		/*
		 * tell driver about BSSID, basic rates and timing
		 * this was set up above, before setting the channel
		 */
5171
		ieee80211_bss_info_change_notify(sdata,
5172 5173
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
5174 5175

		if (assoc)
J
Johannes Berg 已提交
5176
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
5177

J
Johannes Berg 已提交
5178 5179
		err = sta_info_insert(new_sta);
		new_sta = NULL;
5180
		if (err) {
J
Johannes Berg 已提交
5181 5182 5183
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
5184 5185 5186
			return err;
		}
	} else
5187
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
5188

5189 5190 5191 5192
	/* Cancel scan to ensure that nothing interferes with connection */
	if (local->scanning)
		ieee80211_scan_cancel(local);

5193 5194 5195
	return 0;
}

5196 5197 5198
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
5199
{
J
Johannes Berg 已提交
5200 5201 5202
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
5203
	u16 auth_alg;
J
Johannes Berg 已提交
5204
	int err;
5205
	bool cont_auth;
J
Johannes Berg 已提交
5206 5207

	/* prepare auth data structure */
J
Johannes Berg 已提交
5208

5209 5210 5211 5212 5213
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
5214
		if (fips_enabled)
5215
			return -EOPNOTSUPP;
5216 5217 5218 5219 5220 5221 5222 5223
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
5224 5225 5226
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
5227 5228 5229 5230 5231 5232 5233 5234 5235
	case NL80211_AUTHTYPE_FILS_SK:
		auth_alg = WLAN_AUTH_FILS_SK;
		break;
	case NL80211_AUTHTYPE_FILS_SK_PFS:
		auth_alg = WLAN_AUTH_FILS_SK_PFS;
		break;
	case NL80211_AUTHTYPE_FILS_PK:
		auth_alg = WLAN_AUTH_FILS_PK;
		break;
5236 5237
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
5238
	}
5239

5240
	if (ifmgd->assoc_data)
5241 5242
		return -EBUSY;

5243
	auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
5244
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
5245
	if (!auth_data)
J
Johannes Berg 已提交
5246
		return -ENOMEM;
5247

J
Johannes Berg 已提交
5248
	auth_data->bss = req->bss;
5249

5250
	if (req->auth_data_len >= 4) {
5251 5252 5253 5254 5255 5256
		if (req->auth_type == NL80211_AUTHTYPE_SAE) {
			__le16 *pos = (__le16 *) req->auth_data;

			auth_data->sae_trans = le16_to_cpu(pos[0]);
			auth_data->sae_status = le16_to_cpu(pos[1]);
		}
5257 5258 5259
		memcpy(auth_data->data, req->auth_data + 4,
		       req->auth_data_len - 4);
		auth_data->data_len += req->auth_data_len - 4;
5260 5261
	}

5262 5263 5264 5265 5266 5267 5268
	/* Check if continuing authentication or trying to authenticate with the
	 * same BSS that we were in the process of authenticating with and avoid
	 * removal and re-addition of the STA entry in
	 * ieee80211_prep_connection().
	 */
	cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss;

5269
	if (req->ie && req->ie_len) {
5270 5271 5272
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
5273
	}
5274

J
Johannes Berg 已提交
5275
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
5276 5277 5278
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
5279 5280
	}

J
Johannes Berg 已提交
5281
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
5282

J
Johannes Berg 已提交
5283
	/* try to authenticate/probe */
5284

5285 5286 5287 5288 5289 5290 5291
	if (ifmgd->auth_data) {
		if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
			auth_data->peer_confirmed =
				ifmgd->auth_data->peer_confirmed;
		}
		ieee80211_destroy_auth_data(sdata, cont_auth);
	}
5292

J
Johannes Berg 已提交
5293 5294
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
5295

5296 5297 5298 5299 5300 5301 5302 5303 5304
	/* If this is continuation of an ongoing SAE authentication exchange
	 * (i.e., request to send SAE Confirm) and the peer has already
	 * confirmed, mark authentication completed since we are about to send
	 * out SAE Confirm.
	 */
	if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
	    auth_data->peer_confirmed && auth_data->sae_trans == 2)
		ieee80211_mark_sta_auth(sdata, req->bss->bssid);

5305 5306 5307
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5308 5309 5310
		sdata_info(sdata,
			   "disconnect from AP %pM for new auth to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5311 5312 5313 5314
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5315 5316 5317
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5318
	}
J
Johannes Berg 已提交
5319

J
Johannes Berg 已提交
5320
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
5321

5322
	err = ieee80211_prep_connection(sdata, req->bss, cont_auth, false);
5323
	if (err)
J
Johannes Berg 已提交
5324
		goto err_clear;
J
Johannes Berg 已提交
5325

5326
	err = ieee80211_auth(sdata);
J
Johannes Berg 已提交
5327 5328 5329 5330 5331 5332
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
5333
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
5334
	return 0;
J
Johannes Berg 已提交
5335 5336

 err_clear:
5337
	eth_zero_addr(ifmgd->bssid);
5338
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5339
	ifmgd->auth_data = NULL;
5340 5341 5342
	mutex_lock(&sdata->local->mtx);
	ieee80211_vif_release_channel(sdata);
	mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
5343 5344
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
5345 5346
}

5347 5348
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
5349
{
5350
	bool is_6ghz = req->bss->channel->band == NL80211_BAND_6GHZ;
J
Johannes Berg 已提交
5351
	struct ieee80211_local *local = sdata->local;
5352
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5353
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
5354
	struct ieee80211_mgd_assoc_data *assoc_data;
5355
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
5356
	struct ieee80211_supported_band *sband;
5357
	const u8 *ssidie, *ht_ie, *vht_ie;
5358
	int i, err;
5359
	bool override = false;
5360

J
Johannes Berg 已提交
5361 5362 5363 5364
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

5365 5366
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
5367
	if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
5368 5369 5370 5371 5372 5373 5374 5375
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

5376 5377 5378
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5379 5380 5381
		sdata_info(sdata,
			   "disconnect from AP %pM for new assoc to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5382 5383 5384 5385
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5386 5387 5388
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5389
	}
J
Johannes Berg 已提交
5390 5391 5392 5393

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
5394
	}
5395

J
Johannes Berg 已提交
5396 5397 5398 5399
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
5400

J
Johannes Berg 已提交
5401 5402 5403 5404
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
5405
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
5406
		ieee80211_destroy_auth_data(sdata, match);
5407 5408
	}

J
Johannes Berg 已提交
5409
	/* prepare assoc data */
5410

5411 5412
	ifmgd->beacon_crc_valid = false;

5413 5414 5415
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);

J
Johannes Berg 已提交
5416 5417 5418 5419 5420 5421 5422
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
5423
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
5424 5425
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
5426
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
5427
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5428
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
L
Luca Coelho 已提交
5429
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5430
			netdev_info(sdata->dev,
5431
				    "disabling HT/VHT/HE due to WEP/TKIP use\n");
5432 5433
		}
	}
5434

J
Johannes Berg 已提交
5435 5436
	sband = local->hw.wiphy->bands[req->bss->channel->band];

5437 5438 5439
	/* also disable HT/VHT/HE if the AP doesn't use WMM */
	if (!bss->wmm_used) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5440
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5441 5442 5443
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
		netdev_info(sdata->dev,
			    "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
5444 5445
	}

B
Ben Greear 已提交
5446 5447 5448 5449
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

5450 5451 5452 5453
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

5454
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
5455 5456 5457
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
5458

5459 5460 5461 5462 5463 5464 5465 5466 5467 5468 5469 5470 5471 5472 5473
	if (req->fils_kek) {
		/* should already be checked in cfg80211 - so warn */
		if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
			err = -EINVAL;
			goto err_free;
		}
		memcpy(assoc_data->fils_kek, req->fils_kek,
		       req->fils_kek_len);
		assoc_data->fils_kek_len = req->fils_kek_len;
	}

	if (req->fils_nonces)
		memcpy(assoc_data->fils_nonces, req->fils_nonces,
		       2 * FILS_NONCE_LEN);

J
Johannes Berg 已提交
5474
	assoc_data->bss = req->bss;
5475

J
Johannes Berg 已提交
5476 5477
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
5478
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
5479
		else
5480
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
5481
	} else
5482
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
5483

J
Johannes Berg 已提交
5484 5485 5486
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
5487

5488
	rcu_read_lock();
5489 5490 5491 5492
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
5493
	else if (!is_6ghz)
5494
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5495 5496 5497 5498
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
5499 5500 5501
	else if (!is_6ghz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT |
				IEEE80211_STA_DISABLE_HE;
5502
	rcu_read_unlock();
5503

5504
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
5505
		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
5506 5507 5508
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
5509
	if (bss->wmm_used && bss->uapsd_supported &&
5510
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
5511
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
5512 5513
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
5514
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
5515 5516 5517
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

5518
	if (req->prev_bssid)
J
Johannes Berg 已提交
5519
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
5520 5521 5522 5523 5524 5525 5526 5527 5528

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

5529 5530 5531 5532 5533
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

5534 5535 5536 5537 5538
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

5539 5540
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
5541 5542
	sdata->control_port_over_nl80211 =
					req->crypto.control_port_over_nl80211;
5543
	sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
5544 5545
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
5546

J
Johannes Berg 已提交
5547 5548 5549
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
5550
	ifmgd->dtim_period = 0;
5551
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
5552

5553 5554 5555 5556 5557 5558 5559 5560 5561 5562 5563 5564 5565 5566 5567 5568 5569 5570 5571 5572 5573 5574 5575 5576
	/* override HT/VHT configuration only if the AP and we support it */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
		struct ieee80211_sta_ht_cap sta_ht_cap;

		if (req->flags & ASSOC_REQ_DISABLE_HT)
			override = true;

		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

		/* check for 40 MHz disable override */
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
		    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
		    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
			override = true;

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
		    req->flags & ASSOC_REQ_DISABLE_VHT)
			override = true;
	}

	if (req->flags & ASSOC_REQ_DISABLE_HT) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5577
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5578 5579 5580 5581 5582 5583
	}

	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	err = ieee80211_prep_connection(sdata, req->bss, true, override);
5584 5585
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
5586

5587 5588
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
5589

5590
	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
5591 5592 5593 5594 5595 5596 5597 5598
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
5599
		assoc_data->timeout_started = true;
5600 5601
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
5602
		const struct element *elem;
5603 5604
		u8 dtim_count = 0;

S
Sara Sharon 已提交
5605 5606 5607
		ieee80211_get_dtim(beacon_ies, &dtim_count,
				   &ifmgd->dtim_period);

5608
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
5609
		assoc_data->timeout = jiffies;
5610
		assoc_data->timeout_started = true;
5611

5612
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5613 5614 5615 5616 5617
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
S
Sara Sharon 已提交
5618

5619 5620 5621 5622
		elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
					      beacon_ies->data, beacon_ies->len);
		if (elem && elem->datalen >= 3)
			sdata->vif.bss_conf.profile_periodicity = elem->data[2];
S
Sara Sharon 已提交
5623

5624 5625 5626 5627
		elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
					  beacon_ies->data, beacon_ies->len);
		if (elem && elem->datalen >= 11 &&
		    (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
S
Sara Sharon 已提交
5628
			sdata->vif.bss_conf.ema_ap = true;
5629 5630
	} else {
		assoc_data->timeout = jiffies;
5631
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
5632
	}
5633 5634
	rcu_read_unlock();

5635
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
5636

P
Paul Stewart 已提交
5637 5638 5639 5640 5641 5642 5643 5644 5645 5646
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
5647 5648
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
5649 5650
	}

5651
	return 0;
J
Johannes Berg 已提交
5652
 err_clear:
5653
	eth_zero_addr(ifmgd->bssid);
5654
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5655 5656 5657 5658
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
5659 5660
}

5661
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
5662
			 struct cfg80211_deauth_request *req)
5663
{
5664
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5665
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5666
	bool tx = !req->local_state_change;
5667

5668 5669 5670 5671 5672 5673
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
5674

5675
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5676
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5677
					       IEEE80211_STYPE_DEAUTH,
5678
					       req->reason_code, tx,
5679
					       frame_buf);
5680
		ieee80211_destroy_auth_data(sdata, false);
5681 5682 5683
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5684

5685
		return 0;
5686 5687
	}

5688 5689 5690 5691 5692 5693 5694
	if (ifmgd->assoc_data &&
	    ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting association with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5695
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5696
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5697 5698 5699
					       IEEE80211_STYPE_DEAUTH,
					       req->reason_code, tx,
					       frame_buf);
5700
		ieee80211_destroy_assoc_data(sdata, false, true);
5701 5702 5703 5704 5705 5706
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
		return 0;
	}

5707 5708
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
5709 5710 5711 5712 5713
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5714 5715
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
5716 5717 5718
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5719 5720
		return 0;
	}
5721

5722
	return -ENOTCONN;
5723
}
5724

5725
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
5726
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
5727
{
5728
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5729
	u8 bssid[ETH_ALEN];
5730
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
5731

J
Johannes Berg 已提交
5732 5733 5734 5735 5736 5737
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
5738
	if (ifmgd->associated != req->bss)
5739 5740
		return -ENOLINK;

J
Johannes Berg 已提交
5741
	sdata_info(sdata,
5742 5743
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
5744

5745
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
5746 5747 5748
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
5749

5750 5751
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    req->reason_code);
5752

5753 5754
	return 0;
}
5755

5756
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
5757 5758 5759
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

5760 5761 5762 5763 5764 5765 5766 5767 5768 5769
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
5770
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5771

5772
	sdata_lock(sdata);
5773 5774
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5775
		ieee80211_destroy_assoc_data(sdata, false, false);
5776 5777
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
5778 5779
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
5780 5781 5782 5783 5784 5785
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
5786 5787 5788
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = NULL;
	ifmgd->assoc_req_ies_len = 0;
5789
	spin_unlock_bh(&ifmgd->teardown_lock);
5790
	del_timer_sync(&ifmgd->timer);
5791
	sdata_unlock(sdata);
5792 5793
}

5794 5795
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
5796
			       s32 rssi_level,
5797 5798 5799 5800
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

5801
	trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
J
Johannes Berg 已提交
5802

5803
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
5804 5805
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
5806 5807 5808 5809 5810 5811 5812 5813 5814 5815

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);