mlme.c 144.5 KB
Newer Older
1 2
/*
 * BSS client mode implementation
3
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4 5 6 7
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8
 * Copyright 2013-2014  Intel Mobile Communications GmbH
9
 * Copyright (C) 2015 Intel Deutschland GmbH
10 11 12 13 14 15
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

16
#include <linux/delay.h>
17 18 19 20
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
21
#include <linux/moduleparam.h>
22
#include <linux/rtnetlink.h>
23
#include <linux/pm_qos.h>
24
#include <linux/crc32.h>
25
#include <linux/slab.h>
26
#include <linux/export.h>
27
#include <net/mac80211.h>
28
#include <asm/unaligned.h>
J
Johannes Berg 已提交
29

30
#include "ieee80211_i.h"
31
#include "driver-ops.h"
J
Johannes Berg 已提交
32 33
#include "rate.h"
#include "led.h"
34

35
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
36
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
37 38 39 40
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
41
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
42 43
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
44

45 46 47 48 49 50 51 52 53
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
54 55

/*
56 57 58 59 60 61
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
62
 */
63 64 65 66
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
67

J
Johannes Berg 已提交
68 69 70 71
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
72
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
73 74 75 76 77
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
78 79 80 81 82
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
83

84 85 86 87 88 89 90
/*
 * Weight given to the latest Beacon frame when calculating average signal
 * strength for Beacon frames received in the current BSS. This must be
 * between 1 and 15.
 */
#define IEEE80211_SIGNAL_AVE_WEIGHT	3

91 92 93 94 95 96
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
97 98 99 100 101 102 103 104 105 106
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
107 108
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
109
{
110
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
111

112 113 114
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
115 116
}

117
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
118
{
119
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
120 121
		return;

122
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
123 124
		return;

J
Johannes Berg 已提交
125
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
126
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
127 128
}

129 130
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
131 132
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

133 134 135
	if (unlikely(!sdata->u.mgd.associated))
		return;

136 137
	ifmgd->probe_send_count = 0;

138
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
139 140 141 142 143 144
		return;

	mod_timer(&sdata->u.mgd.conn_mon_timer,
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

145
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
146
{
147
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
148 149
}

150 151 152 153
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
154
			     const struct ieee80211_ht_cap *ht_cap,
155 156
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
157
			     struct cfg80211_chan_def *chandef, bool tracking)
158
{
159
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
160
	struct cfg80211_chan_def vht_chandef;
161
	struct ieee80211_sta_ht_cap sta_ht_cap;
162 163
	u32 ht_cfreq, ret;

164 165 166
	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

167 168 169 170 171
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
	chandef->center_freq2 = 0;

172
	if (!ht_cap || !ht_oper || !sta_ht_cap.ht_supported) {
173 174 175 176 177 178
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

179 180
	if (!(ht_cap->cap_info &
	      cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
181
		ret = IEEE80211_STA_DISABLE_40MHZ;
182
		vht_chandef = *chandef;
183 184 185
		goto out;
	}

186 187 188
	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
189
	if (!tracking && channel->center_freq != ht_cfreq) {
190 191 192 193 194 195 196
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
197 198 199 200
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
201 202 203 204 205
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	/* check 40 MHz support, if we have it */
206
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
207 208 209 210 211 212 213 214 215 216 217 218 219
		switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
		case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 += 10;
			break;
		case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 -= 10;
			break;
		}
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
220 221
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	vht_chandef.chan = channel;
	vht_chandef.center_freq1 =
		ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
					       channel->band);
	vht_chandef.center_freq2 = 0;

	switch (vht_oper->chan_width) {
	case IEEE80211_VHT_CHANWIDTH_USE_HT:
		vht_chandef.width = chandef->width;
239
		vht_chandef.center_freq1 = chandef->center_freq1;
240 241 242 243 244 245 246 247 248
		break;
	case IEEE80211_VHT_CHANWIDTH_80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80;
		break;
	case IEEE80211_VHT_CHANWIDTH_160MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_160;
		break;
	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
249 250 251 252
		vht_chandef.center_freq2 =
			ieee80211_channel_to_frequency(
				vht_oper->center_freq_seg2_idx,
				channel->band);
253 254
		break;
	default:
255
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
256 257 258
			sdata_info(sdata,
				   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
				   vht_oper->chan_width);
259 260 261 262 263
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
264
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
265 266
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
267 268 269 270 271 272 273 274 275 276
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
277
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
278 279
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
280 281 282 283 284 285 286 287 288
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

311 312 313 314
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

315 316 317 318 319 320 321 322
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
323
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
324 325
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
326 327 328
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
			      IEEE80211_STA_DISABLE_VHT;
329
			break;
330 331
		}

332
		ret |= ieee80211_chandef_downgrade(chandef);
333 334
	}

335
	if (chandef->width != vht_chandef.width && !tracking)
336 337 338 339 340 341 342
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

343 344
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
345
			       const struct ieee80211_ht_cap *ht_cap,
346 347 348
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
			       const u8 *bssid, u32 *changed)
349 350
{
	struct ieee80211_local *local = sdata->local;
351
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
352
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
353
	struct ieee80211_channel *chan;
354
	struct cfg80211_chan_def chandef;
355
	u16 ht_opmode;
356 357 358
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
359

360 361
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
362 363
		return 0;

364 365 366 367 368 369 370
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

371 372 373 374 375 376 377 378 379 380
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

381
	chan = sdata->vif.bss_conf.chandef.chan;
J
Johannes Berg 已提交
382
	sband = local->hw.wiphy->bands[chan->band];
383

384
	/* calculate new channel (type) based on HT/VHT operation IEs */
385 386 387
	flags = ieee80211_determine_chantype(sdata, sband, chan,
					     ht_cap, ht_oper, vht_oper,
					     &chandef, true);
388 389 390 391 392 393 394 395 396 397

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
398
		flags |= ieee80211_chandef_downgrade(&chandef);
399 400
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
401
		flags |= ieee80211_chandef_downgrade(&chandef);
402 403
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
404
		flags |= ieee80211_chandef_downgrade(&chandef);
405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
		   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
		   chandef.center_freq1, chandef.center_freq2);

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
431
	case NL80211_CHAN_WIDTH_40:
432
		new_sta_bw = IEEE80211_STA_RX_BW_40;
433
		break;
434 435 436 437 438 439
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
440
		break;
441 442
	default:
		return -EINVAL;
443
	}
444

445 446
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
447

448 449 450 451 452
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
453

454 455 456 457 458 459 460
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
461

462 463 464 465
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
466
	}
467

468
	return 0;
469 470
}

J
Johannes Berg 已提交
471 472
/* frame sending functions */

J
Johannes Berg 已提交
473
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
474
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

492
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
493 494 495 496 497 498 499 500 501 502 503 504 505 506
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

507 508 509 510 511 512 513 514 515 516
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

542 543 544 545
/* This function determines vht capability flags for the association
 * and builds the IE.
 * Note - the function may set the owner of the MU-MIMO capability
 */
546 547
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
548 549
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
550
{
551
	struct ieee80211_local *local = sdata->local;
552 553 554
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
555
	u32 mask, ap_bf_sts, our_bf_sts;
556 557 558 559

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
560
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
561 562 563 564

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
565
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
566 567 568 569 570 571
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
572 573 574 575
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
576
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
577 578
	}

579 580 581 582 583 584
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612
		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
	else if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

	/*
	 * If some other vif is using the MU-MIMO capablity we cannot associate
	 * using MU-MIMO - this will lead to contradictions in the group-id
	 * mechanism.
	 * Ownership is defined since association request, in order to avoid
	 * simultaneous associations with MU-MIMO.
	 */
	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
		bool disable_mu_mimo = false;
		struct ieee80211_sub_if_data *other;

		list_for_each_entry_rcu(other, &local->interfaces, list) {
			if (other->flags & IEEE80211_SDATA_MU_MIMO_OWNER) {
				disable_mu_mimo = true;
				break;
			}
		}
		if (disable_mu_mimo)
			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
		else
			sdata->flags |= IEEE80211_SDATA_MU_MIMO_OWNER;
	}
613

614 615 616 617 618 619 620 621 622 623
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

624
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
625
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
626 627 628
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

J
Johannes Berg 已提交
629 630 631 632 633 634 635 636 637
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
	u8 *pos, qos_info;
	size_t offset = 0, noffset;
638
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
639 640
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
641 642
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
643
	u32 rate_flags, rates = 0;
J
Johannes Berg 已提交
644

645
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
646

J
Johannes Berg 已提交
647 648 649 650 651 652
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
653
	chan = chanctx_conf->def.chan;
654
	rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
J
Johannes Berg 已提交
655 656
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
657
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
658 659 660 661 662 663 664 665

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
666 667 668 669
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
670 671 672 673 674 675
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
676 677 678 679 680 681 682 683
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			if ((rate_flags & sband->bitrates[i].flags)
			    != rate_flags)
				continue;
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
684 685 686 687 688 689 690 691 692
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
693
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
J
Johannes Berg 已提交
694 695 696 697 698 699 700 701 702 703 704
			assoc_data->ie_len + /* extra IEs */
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

	if (sband->band == IEEE80211_BAND_2GHZ) {
705 706
		capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
J
Johannes Berg 已提交
707 708 709 710 711 712
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
713
	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
J
Johannes Berg 已提交
714 715
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

716 717 718
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

J
Johannes Berg 已提交
719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760
	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(mgmt, 0, 24);
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
761 762 763
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
764 765 766 767 768 769 770 771 772 773 774 775
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
776 777 778 779
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
780 781 782 783
			}
		}
	}

784 785
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
786 787 788 789
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
790 791
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
792
	}
J
Johannes Berg 已提交
793

794
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
J
Johannes Berg 已提交
795 796 797 798 799 800 801 802 803 804 805 806
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

	/* if present, add any custom IEs that go before HT */
807
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
808 809 810 811 812 813 814 815 816 817
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
818 819
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
820 821
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
			/* 60GHz doesn't happen right now */
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
J
Johannes Berg 已提交
842 843 844 845 846
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

J
Johannes Berg 已提交
847 848 849 850
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

851
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
852
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
853
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
854

855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
		};
875 876

		/* RIC already taken above, so no need to handle here anymore */
877 878 879 880 881 882 883 884
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

885
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
886 887
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
888

J
Johannes Berg 已提交
889
	/* if present, add any custom non-vendor IEs that go after HT */
890
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
891 892 893 894 895 896 897 898
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

899 900
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
901 902
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
903 904 905 906 907
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

908
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
909 910 911
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
912
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
913 914 915 916 917
		noffset = assoc_data->ie_len;
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
	}

J
Johannes Berg 已提交
918 919
	drv_mgd_prepare_tx(local, sdata);

J
Johannes Berg 已提交
920
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
921
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
922 923
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
924 925 926
	ieee80211_tx_skb(sdata, skb);
}

927 928 929 930 931 932
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

933 934
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
935 936
		return;

937 938
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
939

940 941
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
942 943
}

944 945 946 947 948
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
			     int powersave)
{
	struct sk_buff *skb;
949
	struct ieee80211_hdr_3addr *nullfunc;
950
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
951

952 953
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
	if (!skb)
954 955
		return;

956
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
957
	if (powersave)
958
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
959

960 961
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
962

963
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
964 965
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

966
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
967 968
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

969
	ieee80211_tx_skb(sdata, skb);
970 971
}

972 973 974 975 976 977 978 979 980 981 982
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
983
	if (!skb)
984
		return;
985

986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001
	skb_reserve(skb, local->hw.extra_tx_headroom);

	nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
	memset(nullfunc, 0, 30);
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

1002 1003 1004 1005 1006
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
1007
	struct ieee80211_local *local = sdata->local;
1008
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1009
	int ret;
1010

1011
	if (!ieee80211_sdata_running(sdata))
1012 1013
		return;

1014
	sdata_lock(sdata);
1015 1016 1017
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

1018 1019
	if (!ifmgd->associated)
		goto out;
1020

1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1055
		sdata_info(sdata,
1056
			   "failed to finalize channel switch, disconnecting\n");
1057 1058 1059 1060
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1061

1062
	/* XXX: shouldn't really modify cfg80211-owned data! */
1063
	ifmgd->associated->channel = sdata->csa_chandef.chan;
1064

1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1085

1086 1087 1088 1089 1090
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1091

1092 1093 1094
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1095 1096 1097 1098 1099 1100
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1101
		return;
1102
	}
1103 1104

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1105 1106
}

1107 1108
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1109 1110
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1111 1112 1113

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1114 1115 1116 1117 1118 1119
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1120 1121 1122 1123
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1124 1125 1126 1127
static void ieee80211_chswitch_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
1128

1129
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1130 1131
}

1132
static void
J
Johannes Berg 已提交
1133
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1134 1135
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1136
				 bool beacon)
1137
{
1138
	struct ieee80211_local *local = sdata->local;
1139
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1140
	struct cfg80211_bss *cbss = ifmgd->associated;
1141
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1142
	struct ieee80211_chanctx *chanctx;
1143
	enum ieee80211_band current_band;
1144
	struct ieee80211_csa_ie csa_ie;
1145
	struct ieee80211_channel_switch ch_switch;
1146
	int res;
1147

1148
	sdata_assert_lock(sdata);
1149

1150
	if (!cbss)
1151 1152
		return;

1153
	if (local->scanning)
1154 1155
		return;

1156
	/* disregard subsequent announcements if we are already processing */
1157
	if (sdata->vif.csa_active)
1158 1159
		return;

1160
	current_band = cbss->channel->band;
1161
	memset(&csa_ie, 0, sizeof(csa_ie));
1162
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1163
					   ifmgd->flags,
1164
					   ifmgd->associated->bssid, &csa_ie);
1165
	if (res	< 0)
1166
		ieee80211_queue_work(&local->hw,
1167
				     &ifmgd->csa_connection_drop_work);
1168
	if (res)
1169
		return;
1170

1171
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1172 1173 1174
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1175
			   ifmgd->associated->bssid,
1176 1177 1178
			   csa_ie.chandef.chan->center_freq,
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
			   csa_ie.chandef.center_freq2);
1179 1180 1181 1182 1183
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194
	if (cfg80211_chandef_identical(&csa_ie.chandef,
				       &sdata->vif.bss_conf.chandef)) {
		if (ifmgd->csa_ignored_same_chan)
			return;
		sdata_info(sdata,
			   "AP %pM tries to chanswitch to same channel, ignore\n",
			   ifmgd->associated->bssid);
		ifmgd->csa_ignored_same_chan = true;
		return;
	}

1195 1196 1197 1198 1199 1200 1201 1202
	/*
	 * Drop all TDLS peers - either we disconnect or move to a different
	 * channel from this point on. There's no telling what our peer will do.
	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
	 * have an incompatible wider chandef.
	 */
	ieee80211_teardown_tdls_peers(sdata);

1203
	mutex_lock(&local->mtx);
1204
	mutex_lock(&local->chanctx_mtx);
1205 1206 1207 1208 1209
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
1210
		goto drop_connection;
1211 1212 1213 1214
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1215
	if (local->use_chanctx &&
1216
	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1217 1218
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
1219
		goto drop_connection;
J
Johannes Berg 已提交
1220 1221
	}

1222 1223 1224 1225 1226 1227 1228 1229 1230
	ch_switch.timestamp = timestamp;
	ch_switch.device_timestamp = device_timestamp;
	ch_switch.block_tx = csa_ie.mode;
	ch_switch.chandef = csa_ie.chandef;
	ch_switch.count = csa_ie.count;

	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
1231
		goto drop_connection;
1232 1233
	}

1234 1235 1236
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1237
		sdata_info(sdata,
1238 1239
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1240
		goto drop_connection;
J
Johannes Berg 已提交
1241
	}
1242
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1243

1244
	sdata->vif.csa_active = true;
1245
	sdata->csa_chandef = csa_ie.chandef;
1246
	sdata->csa_block_tx = csa_ie.mode;
1247
	ifmgd->csa_ignored_same_chan = false;
J
Johannes Berg 已提交
1248

1249
	if (sdata->csa_block_tx)
1250 1251
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1252
	mutex_unlock(&local->mtx);
1253

1254 1255 1256
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1257
	if (local->ops->channel_switch) {
1258
		/* use driver's channel switch callback */
1259
		drv_channel_switch(local, sdata, &ch_switch);
1260 1261 1262 1263
		return;
	}

	/* channel switch handled in software */
1264
	if (csa_ie.count <= 1)
1265
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1266
	else
1267
		mod_timer(&ifmgd->chswitch_timer,
1268 1269
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1270 1271 1272 1273 1274
	return;
 drop_connection:
	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
1275 1276
}

1277 1278 1279 1280 1281 1282
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1283
{
1284 1285
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1286
	int i, chan_increment;
1287
	bool have_chan_pwr = false;
1288

1289 1290
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1291
		return false;
1292

1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
	case IEEE80211_BAND_2GHZ:
	case IEEE80211_BAND_60GHZ:
		chan_increment = 1;
		break;
	case IEEE80211_BAND_5GHZ:
		chan_increment = 4;
		break;
1307
	}
1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1319
				*chan_pwr = triplet->chans.max_power;
1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1331
	if (have_chan_pwr && pwr_constr_elem)
1332
		*pwr_reduction = *pwr_constr_elem;
1333 1334 1335
	else
		*pwr_reduction = 0;

1336 1337 1338
	return have_chan_pwr;
}

1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1353 1354 1355 1356
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1357 1358
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1359
{
1360 1361 1362
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1363
	int new_ap_level;
1364
	__le16 capab = mgmt->u.probe_resp.capab_info;
1365

1366 1367 1368
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1369 1370 1371
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1372 1373 1374 1375 1376 1377 1378 1379
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1380
	}
1381

1382
	if (!has_80211h_pwr && !has_cisco_pwr)
1383
		return 0;
1384

1385 1386 1387 1388 1389
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1390 1391 1392 1393
		sdata_dbg(sdata,
			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			  sdata->u.mgd.bssid);
1394 1395
		new_ap_level = pwr_level_80211h;
	} else {  /* has_cisco_pwr is always true here. */
1396 1397 1398
		sdata_dbg(sdata,
			  "Limiting TX power to %d dBm as advertised by %pM\n",
			  pwr_level_cisco, sdata->u.mgd.bssid);
1399 1400
		new_ap_level = pwr_level_cisco;
	}
1401

1402 1403
	if (sdata->ap_power_level == new_ap_level)
		return 0;
1404

1405 1406 1407 1408
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1409 1410
}

1411 1412 1413 1414 1415 1416
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1417 1418 1419 1420
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1421
	if (local->scanning)
J
Johannes Berg 已提交
1422 1423
		return;

1424
	if (conf->dynamic_ps_timeout > 0 &&
1425
	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1426 1427 1428
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
1429
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1430
			ieee80211_send_nullfunc(local, sdata, 1);
1431

1432 1433
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1434 1435 1436 1437
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1455 1456 1457 1458
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1459
	bool authorized = false;
1460 1461 1462 1463

	if (!mgd->powersave)
		return false;

1464 1465 1466
	if (mgd->broken_ap)
		return false;

1467 1468 1469
	if (!mgd->associated)
		return false;

1470
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1471 1472
		return false;

1473
	if (!mgd->have_beacon)
1474 1475
		return false;

1476 1477 1478
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1479
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1480 1481
	rcu_read_unlock();

J
Johannes Berg 已提交
1482
	return authorized;
1483 1484
}

1485
/* need to hold RTNL or interface lock */
1486
void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1487 1488 1489
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1490
	int timeout;
1491

1492
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1493 1494 1495 1496 1497
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1498
		if (!ieee80211_sdata_running(sdata))
1499
			continue;
1500 1501 1502 1503 1504 1505 1506 1507
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1508 1509 1510 1511 1512 1513
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1514
	if (count == 1 && ieee80211_powersave_allowed(found)) {
1515 1516 1517
		s32 beaconint_us;

		if (latency < 0)
M
Mark Gross 已提交
1518
			latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1519 1520 1521 1522

		beaconint_us = ieee80211_tu_to_usec(
					found->vif.bss_conf.beacon_int);

1523
		timeout = local->dynamic_ps_forced_timeout;
1524 1525
		if (timeout < 0) {
			/*
1526 1527
			 * Go to full PSM if the user configures a very low
			 * latency requirement.
1528 1529 1530
			 * The 2000 second value is there for compatibility
			 * until the PM_QOS_NETWORK_LATENCY is configured
			 * with real values.
1531
			 */
1532 1533
			if (latency > (1900 * USEC_PER_MSEC) &&
			    latency != (2000 * USEC_PER_SEC))
1534
				timeout = 0;
1535 1536
			else
				timeout = 100;
1537
		}
1538
		local->hw.conf.dynamic_ps_timeout = timeout;
1539

1540
		if (beaconint_us > latency) {
1541
			local->ps_sdata = NULL;
1542 1543
		} else {
			int maxslp = 1;
1544
			u8 dtimper = found->u.mgd.dtim_period;
1545 1546 1547 1548 1549

			/* If the TIM IE is invalid, pretend the value is 1 */
			if (!dtimper)
				dtimper = 1;
			else if (dtimper > 1)
1550 1551 1552
				maxslp = min_t(int, dtimper,
						    latency / beaconint_us);

1553
			local->hw.conf.max_sleep_period = maxslp;
1554
			local->hw.conf.ps_dtim_period = dtimper;
1555
			local->ps_sdata = found;
1556
		}
1557
	} else {
1558
		local->ps_sdata = NULL;
1559
	}
1560 1561 1562 1563

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1564 1565 1566 1567 1568 1569 1570 1571 1572 1573
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1586
					IEEE80211_MAX_QUEUE_MAP,
1587 1588
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1589 1590 1591 1592 1593 1594 1595 1596
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1597
	struct ieee80211_if_managed *ifmgd;
1598 1599
	unsigned long flags;
	int q;
1600 1601 1602 1603 1604

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1605 1606
	ifmgd = &sdata->u.mgd;

1607 1608 1609
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1610
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1611 1612
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1613 1614 1615 1616 1617
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1636 1637
	}

1638
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1639
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1640
		if (drv_tx_frames_pending(local)) {
1641 1642 1643
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1644
		} else {
1645 1646
			ieee80211_send_nullfunc(local, sdata, 1);
			/* Flush to get the tx status of nullfunc frame */
1647
			ieee80211_flush_queues(local, sdata, false);
1648
		}
1649 1650
	}

1651 1652
	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1653 1654 1655 1656 1657
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1658 1659 1660 1661 1662 1663
}

void ieee80211_dynamic_ps_timer(unsigned long data)
{
	struct ieee80211_local *local = (void *) data;

1664
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1665 1666
}

1667 1668 1669 1670 1671 1672 1673
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
	struct delayed_work *delayed_work =
		container_of(work, struct delayed_work, work);
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1674
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1675

1676 1677 1678 1679 1680 1681 1682 1683
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1684 1685
}

1686 1687 1688 1689 1690
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1691
	bool ret = false;
1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
			/* The loop will result in using BK even if it requires
			 * admission control, such configuration makes no sense
			 * and we have to transmit somehow - the AC selection
			 * does the same thing.
			 */
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1775
/* MLME */
1776
static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1777
				     struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
1778
				     const u8 *wmm_param, size_t wmm_param_len)
1779 1780
{
	struct ieee80211_tx_queue_params params;
1781
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1782 1783
	size_t left;
	int count;
J
Johannes Berg 已提交
1784 1785
	const u8 *pos;
	u8 uapsd_queues = 0;
1786

1787
	if (!local->ops->conf_tx)
1788
		return false;
1789

J
Johannes Berg 已提交
1790
	if (local->hw.queues < IEEE80211_NUM_ACS)
1791
		return false;
1792 1793

	if (!wmm_param)
1794
		return false;
1795

1796
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1797
		return false;
K
Kalle Valo 已提交
1798 1799

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1800
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
1801

1802
	count = wmm_param[6] & 0x0f;
1803
	if (count == ifmgd->wmm_last_param_set)
1804
		return false;
1805
	ifmgd->wmm_last_param_set = count;
1806 1807 1808 1809 1810 1811

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
1812
	sdata->wmm_acm = 0;
1813 1814 1815
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
1816
		bool uapsd = false;
1817 1818 1819
		int queue;

		switch (aci) {
1820
		case 1: /* AC_BK */
J
Johannes Berg 已提交
1821
			queue = 3;
J
Johannes Berg 已提交
1822
			if (acm)
Y
Yoni Divinsky 已提交
1823
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
1824 1825
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
1826
			break;
1827
		case 2: /* AC_VI */
J
Johannes Berg 已提交
1828
			queue = 1;
J
Johannes Berg 已提交
1829
			if (acm)
Y
Yoni Divinsky 已提交
1830
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
1831 1832
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
1833
			break;
1834
		case 3: /* AC_VO */
J
Johannes Berg 已提交
1835
			queue = 0;
J
Johannes Berg 已提交
1836
			if (acm)
Y
Yoni Divinsky 已提交
1837
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
1838 1839
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
1840
			break;
1841
		case 0: /* AC_BE */
1842
		default:
J
Johannes Berg 已提交
1843
			queue = 2;
J
Johannes Berg 已提交
1844
			if (acm)
Y
Yoni Divinsky 已提交
1845
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
1846 1847
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
1848 1849 1850 1851 1852 1853
			break;
		}

		params.aifs = pos[0] & 0x0f;
		params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params.cw_min = ecw2cw(pos[1] & 0x0f);
1854
		params.txop = get_unaligned_le16(pos + 2);
1855
		params.acm = acm;
K
Kalle Valo 已提交
1856 1857
		params.uapsd = uapsd;

J
Johannes Berg 已提交
1858
		mlme_dbg(sdata,
1859
			 "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
J
Johannes Berg 已提交
1860 1861
			 queue, aci, acm,
			 params.aifs, params.cw_min, params.cw_max,
1862 1863
			 params.txop, params.uapsd,
			 ifmgd->tx_tspec[queue].downgraded);
1864
		sdata->tx_conf[queue] = params;
1865 1866
		if (!ifmgd->tx_tspec[queue].downgraded &&
		    drv_conf_tx(local, sdata, queue, &params))
J
Johannes Berg 已提交
1867 1868 1869
			sdata_err(sdata,
				  "failed to set TX queue parameters for queue %d\n",
				  queue);
1870
	}
1871 1872

	/* enable WMM or activate new settings */
1873
	sdata->vif.bss_conf.qos = true;
1874
	return true;
1875 1876
}

1877 1878 1879 1880
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

1881
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1882 1883 1884 1885 1886 1887 1888 1889 1890 1891
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
1892 1893
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
1894
{
J
Johannes Berg 已提交
1895
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1896
	u32 changed = 0;
J
Johannes Berg 已提交
1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
J
Johannes Berg 已提交
1910
	if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1911
		use_short_slot = true;
1912

1913 1914 1915
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
1916
	}
1917

1918 1919
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
1920
		changed |= BSS_CHANGED_ERP_PREAMBLE;
1921
	}
1922

J
Johannes Berg 已提交
1923 1924 1925
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
1926 1927 1928 1929 1930
	}

	return changed;
}

1931
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1932
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
1933
				     u32 bss_info_changed)
1934
{
1935
	struct ieee80211_bss *bss = (void *)cbss->priv;
1936
	struct ieee80211_local *local = sdata->local;
1937
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1938

J
Johannes Berg 已提交
1939
	bss_info_changed |= BSS_CHANGED_ASSOC;
1940
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1941
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1942

1943
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1944
		beacon_loss_count * bss_conf->beacon_int));
1945

1946 1947
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1948

1949 1950
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

1951
	if (sdata->vif.p2p) {
1952
		const struct cfg80211_bss_ies *ies;
1953

1954 1955 1956 1957 1958 1959 1960 1961
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
1962 1963
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
1964
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
1965 1966
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
1967 1968
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
1969
		}
1970
		rcu_read_unlock();
1971 1972
	}

J
Johannes Berg 已提交
1973
	/* just to be sure */
1974
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
1975

1976
	ieee80211_led_assoc(local, 1);
1977

1978
	if (sdata->u.mgd.have_beacon) {
1979 1980 1981 1982 1983 1984 1985
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1986
		bss_conf->beacon_rate = bss->beacon_rate;
1987
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1988
	} else {
1989
		bss_conf->beacon_rate = NULL;
1990
		bss_conf->dtim_period = 0;
1991
	}
1992

1993
	bss_conf->assoc = 1;
1994

1995
	/* Tell the driver to monitor connection quality (if supported) */
1996
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1997
	    bss_conf->cqm_rssi_thold)
1998 1999
		bss_info_changed |= BSS_CHANGED_CQM;

2000
	/* Enable ARP filtering */
2001
	if (bss_conf->arp_addr_cnt)
2002 2003
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
2004
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
2005

J
Johannes Berg 已提交
2006 2007 2008
	mutex_lock(&local->iflist_mtx);
	ieee80211_recalc_ps(local, -1);
	mutex_unlock(&local->iflist_mtx);
2009

2010
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
2011 2012
	ieee80211_recalc_ps_vif(sdata);

2013
	netif_carrier_on(sdata->dev);
2014 2015
}

2016
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2017 2018
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
2019
{
2020
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2021
	struct ieee80211_local *local = sdata->local;
2022
	u32 changed = 0;
2023

2024
	sdata_assert_lock(sdata);
2025

2026 2027 2028
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
2029 2030 2031
	if (WARN_ON(!ifmgd->associated))
		return;

2032 2033
	ieee80211_stop_poll(sdata);

2034
	ifmgd->associated = NULL;
2035 2036
	netif_carrier_off(sdata->dev);

2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2048 2049 2050
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2051 2052 2053
	/* make sure ongoing transmission finishes */
	synchronize_net();

2054 2055 2056 2057 2058 2059
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2060
	if (tx)
2061
		ieee80211_flush_queues(local, sdata, true);
2062

2063 2064
	/* deauthenticate/disassociate now */
	if (tx || frame_buf)
2065 2066
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
					       reason, tx, frame_buf);
2067

2068
	/* flush out frame - make sure the deauth was actually sent */
2069
	if (tx)
2070
		ieee80211_flush_queues(local, sdata, false);
2071

2072
	/* clear bssid only after building the needed mgmt frames */
2073
	eth_zero_addr(ifmgd->bssid);
2074

2075
	/* remove AP and TDLS peers */
2076
	sta_info_flush(sdata);
2077 2078

	/* finally reset all BSS / config parameters */
2079 2080 2081
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2082 2083
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2084

J
Janusz Dziedzic 已提交
2085 2086 2087
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2088

2089
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2090 2091
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2092 2093
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2094
	sdata->flags &= ~IEEE80211_SDATA_MU_MIMO_OWNER;
2095

2096
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2097

2098 2099 2100
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2101
	/* Disable ARP filtering */
2102
	if (sdata->vif.bss_conf.arp_addr_cnt)
2103 2104
		changed |= BSS_CHANGED_ARP_FILTER;

2105 2106 2107
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2108 2109
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2110
	ieee80211_bss_info_change_notify(sdata, changed);
2111

2112 2113 2114
	/* disassociated - set to defaults now */
	ieee80211_set_wmm_default(sdata, false);

2115 2116 2117 2118
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2119

2120
	sdata->vif.bss_conf.dtim_period = 0;
2121 2122
	sdata->vif.bss_conf.beacon_rate = NULL;

2123
	ifmgd->have_beacon = false;
2124

2125
	ifmgd->flags = 0;
2126
	mutex_lock(&local->mtx);
2127
	ieee80211_vif_release_channel(sdata);
2128 2129

	sdata->vif.csa_active = false;
2130
	ifmgd->csa_waiting_bcn = false;
2131
	ifmgd->csa_ignored_same_chan = false;
2132 2133 2134 2135 2136
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2137
	mutex_unlock(&local->mtx);
2138

2139 2140 2141 2142
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2143
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2144
}
2145

2146 2147 2148 2149 2150 2151 2152 2153
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2154 2155
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2156
	 */
J
Johannes Berg 已提交
2157 2158 2159
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2160
	ieee80211_sta_reset_conn_monitor(sdata);
2161
}
2162

2163 2164 2165
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2166
	struct ieee80211_local *local = sdata->local;
2167

2168
	mutex_lock(&local->mtx);
2169 2170
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2171

2172
	__ieee80211_stop_poll(sdata);
2173 2174 2175 2176

	mutex_lock(&local->iflist_mtx);
	ieee80211_recalc_ps(local, -1);
	mutex_unlock(&local->iflist_mtx);
2177

2178
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2179
		goto out;
2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2191 2192
out:
	mutex_unlock(&local->mtx);
2193 2194
}

2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222 2223 2224 2225 2226 2227 2228 2229
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u16 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2230
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2231
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2232
{
2233 2234
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2235
	if (!ieee80211_is_data(hdr->frame_control))
2236 2237 2238 2239
	    return;

	if (ieee80211_is_nullfunc(hdr->frame_control) &&
	    sdata->u.mgd.probe_send_count > 0) {
2240
		if (ack)
2241
			ieee80211_sta_reset_conn_monitor(sdata);
2242 2243
		else
			sdata->u.mgd.nullfunc_failed = true;
2244
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2245
		return;
2246
	}
2247 2248 2249

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2250 2251
}

2252 2253 2254 2255
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2256
	u8 *dst = ifmgd->associated->bssid;
2257
	u8 unicast_limit = max(1, max_probe_tries - 3);
2258 2259 2260 2261 2262 2263 2264 2265

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2266

2267 2268 2269 2270 2271 2272 2273
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2274 2275
	ifmgd->probe_send_count++;

2276
	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2277
		ifmgd->nullfunc_failed = false;
2278
		ieee80211_send_nullfunc(sdata->local, sdata, 0);
2279
	} else {
2280 2281
		int ssid_len;

2282
		rcu_read_lock();
2283
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2284 2285 2286 2287 2288
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2289
		ieee80211_send_probe_req(sdata, sdata->vif.addr, dst,
2290
					 ssid + 2, ssid_len, NULL,
2291
					 0, (u32) -1, true, 0,
J
Johannes Berg 已提交
2292
					 ifmgd->associated->channel, false);
2293
		rcu_read_unlock();
2294
	}
2295

2296
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2297
	run_again(sdata, ifmgd->probe_timeout);
2298 2299
}

J
Johannes Berg 已提交
2300 2301
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2302 2303
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2304
	bool already = false;
2305

2306
	if (!ieee80211_sdata_running(sdata))
2307 2308
		return;

2309
	sdata_lock(sdata);
2310 2311 2312 2313

	if (!ifmgd->associated)
		goto out;

2314 2315 2316 2317 2318 2319 2320
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2321
	if (beacon) {
J
Johannes Berg 已提交
2322
		mlme_dbg_ratelimited(sdata,
2323 2324
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2325

2326
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2327
	}
2328

J
Johannes Berg 已提交
2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2340
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2341 2342
		already = true;

E
Eliad Peller 已提交
2343 2344
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2345 2346
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2347 2348 2349
	if (already)
		goto out;

2350 2351 2352 2353
	mutex_lock(&sdata->local->iflist_mtx);
	ieee80211_recalc_ps(sdata->local, -1);
	mutex_unlock(&sdata->local->iflist_mtx);

2354 2355
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2356
 out:
2357
	sdata_unlock(sdata);
2358 2359
}

2360 2361 2362 2363 2364
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2365
	struct cfg80211_bss *cbss;
2366 2367
	struct sk_buff *skb;
	const u8 *ssid;
2368
	int ssid_len;
2369 2370 2371 2372

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2373
	sdata_assert_lock(sdata);
2374

2375 2376 2377 2378 2379 2380 2381
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2382 2383
		return NULL;

2384
	rcu_read_lock();
2385
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2386 2387 2388 2389 2390
	if (WARN_ON_ONCE(ssid == NULL))
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2391
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2392
					(u32) -1, cbss->channel,
2393
					ssid + 2, ssid_len,
2394
					NULL, 0, true);
2395
	rcu_read_unlock();
2396 2397 2398 2399 2400

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418
static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
					const u8 *buf, size_t len, bool tx,
					u16 reason)
{
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
		.u.mlme.reason = reason,
	};

	if (tx)
		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
	else
		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);

	drv_event_callback(sdata->local, sdata, &event);
}

2419
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2420
{
2421
	struct ieee80211_local *local = sdata->local;
2422
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2423
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2424

2425
	sdata_lock(sdata);
2426
	if (!ifmgd->associated) {
2427
		sdata_unlock(sdata);
2428 2429 2430
		return;
	}

2431 2432
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2433
			       true, frame_buf);
2434
	mutex_lock(&local->mtx);
2435
	sdata->vif.csa_active = false;
2436
	ifmgd->csa_waiting_bcn = false;
2437 2438 2439 2440 2441
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2442
	mutex_unlock(&local->mtx);
2443

2444 2445 2446
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);

2447
	sdata_unlock(sdata);
2448 2449
}

2450
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2451 2452 2453
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2454
			     u.mgd.beacon_connection_loss_work);
2455 2456 2457 2458
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct sta_info *sta;

	if (ifmgd->associated) {
2459
		rcu_read_lock();
2460 2461 2462
		sta = sta_info_get(sdata, ifmgd->bssid);
		if (sta)
			sta->beacon_loss_count++;
2463
		rcu_read_unlock();
2464
	}
J
Johannes Berg 已提交
2465

2466
	if (ifmgd->connection_loss) {
2467 2468
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2469
		__ieee80211_disconnect(sdata);
2470
	} else {
2471
		ieee80211_mgd_probe_ap(sdata, true);
2472 2473 2474 2475 2476 2477 2478 2479 2480
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2481
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2482 2483
}

2484 2485 2486
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2487
	struct ieee80211_hw *hw = &sdata->local->hw;
2488

J
Johannes Berg 已提交
2489 2490
	trace_api_beacon_loss(sdata);

2491
	sdata->u.mgd.connection_loss = false;
2492
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2493 2494 2495
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2496 2497 2498 2499 2500
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2501 2502
	trace_api_connection_loss(sdata);

2503
	sdata->u.mgd.connection_loss = true;
2504 2505 2506 2507 2508
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2509 2510 2511 2512 2513
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2514
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2515 2516

	if (!assoc) {
2517 2518 2519 2520 2521 2522
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2523 2524
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

2525
		eth_zero_addr(sdata->u.mgd.bssid);
J
Johannes Berg 已提交
2526
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2527
		sdata->u.mgd.flags = 0;
2528
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2529
		ieee80211_vif_release_channel(sdata);
2530
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2531 2532
	}

2533
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2534 2535 2536 2537
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

2538 2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553 2554 2555 2556
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
					 bool assoc)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

	sdata_assert_lock(sdata);

	if (!assoc) {
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		eth_zero_addr(sdata->u.mgd.bssid);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
		sdata->u.mgd.flags = 0;
2557
		sdata->flags &= ~IEEE80211_SDATA_MU_MIMO_OWNER;
2558 2559 2560 2561 2562 2563 2564 2565 2566
		mutex_lock(&sdata->local->mtx);
		ieee80211_vif_release_channel(sdata);
		mutex_unlock(&sdata->local->mtx);
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

J
Johannes Berg 已提交
2567 2568 2569
static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2570
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2571 2572 2573
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2574
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2575 2576

	pos = mgmt->u.auth.variable;
2577
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2578 2579 2580
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
J
Johannes Berg 已提交
2581
	drv_mgd_prepare_tx(sdata->local, sdata);
2582
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2583 2584
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2585
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2586 2587 2588
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2589
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2590 2591
}

2592 2593
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2594 2595 2596 2597 2598
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
	struct sta_info *sta;
2599 2600 2601 2602
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = AUTH_EVENT,
	};
J
Johannes Berg 已提交
2603

2604
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2605 2606

	if (len < 24 + 6)
2607
		return;
J
Johannes Berg 已提交
2608 2609

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2610
		return;
J
Johannes Berg 已提交
2611 2612 2613

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2614
	if (!ether_addr_equal(bssid, mgmt->bssid))
2615
		return;
J
Johannes Berg 已提交
2616 2617 2618 2619 2620 2621

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2622 2623 2624 2625 2626
	    auth_transaction != ifmgd->auth_data->expected_transaction) {
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2627
		return;
2628
	}
J
Johannes Berg 已提交
2629 2630

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
2631 2632
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2633
		ieee80211_destroy_auth_data(sdata, false);
2634
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2635 2636 2637
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
2638
		return;
J
Johannes Berg 已提交
2639 2640 2641 2642 2643 2644
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
2645
	case WLAN_AUTH_SAE:
J
Johannes Berg 已提交
2646 2647 2648 2649 2650
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
2651
			return;
J
Johannes Berg 已提交
2652 2653 2654 2655 2656
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
2657
		return;
J
Johannes Berg 已提交
2658 2659
	}

2660 2661
	event.u.mlme.status = MLME_SUCCESS;
	drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
2662
	sdata_info(sdata, "authenticated\n");
J
Johannes Berg 已提交
2663 2664
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2665
	ifmgd->auth_data->timeout_started = true;
2666
	run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
2667

2668 2669 2670 2671 2672 2673
	if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
	    ifmgd->auth_data->expected_transaction != 2) {
		/*
		 * Report auth frame to user space for processing since another
		 * round of Authentication frames is still needed.
		 */
2674
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2675
		return;
2676 2677
	}

J
Johannes Berg 已提交
2678 2679 2680 2681 2682 2683 2684 2685
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
		goto out_err;
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
J
Johannes Berg 已提交
2686
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
J
Johannes Berg 已提交
2687 2688 2689 2690
		goto out_err;
	}
	mutex_unlock(&sdata->local->sta_mtx);

2691
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2692
	return;
J
Johannes Berg 已提交
2693 2694 2695 2696 2697
 out_err:
	mutex_unlock(&sdata->local->sta_mtx);
	/* ignore frame -- wait for timeout */
}

2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

static const char *ieee80211_get_reason_code_string(u16 reason_code)
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
2754

2755 2756
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
2757
{
2758
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2759
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2760

2761
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2762

2763
	if (len < 24 + 2)
2764
		return;
2765

2766 2767 2768
	if (ifmgd->associated &&
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
		const u8 *bssid = ifmgd->associated->bssid;
2769

2770 2771 2772
		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));
2773

2774
		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2775

2776 2777 2778 2779
		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
					    reason_code);
		return;
	}
2780

2781 2782 2783
	if (ifmgd->assoc_data &&
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
		const u8 *bssid = ifmgd->assoc_data->bss->bssid;
2784

2785 2786 2787 2788 2789 2790 2791 2792 2793 2794
		sdata_info(sdata,
			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));

		ieee80211_destroy_assoc_data(sdata, false);

		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
		return;
	}
2795 2796 2797
}


2798 2799
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
2800
{
2801
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2802 2803
	u16 reason_code;

2804
	sdata_assert_lock(sdata);
2805

J
Johannes Berg 已提交
2806
	if (len < 24 + 2)
2807
		return;
2808

J
Johannes Berg 已提交
2809
	if (!ifmgd->associated ||
2810
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2811
		return;
2812 2813 2814

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

J
Johannes Berg 已提交
2815 2816
	sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
		   mgmt->sa, reason_code);
2817

2818 2819
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

2820
	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
2821 2822
}

2823 2824 2825 2826
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
2827 2828
				int *min_rate, int *min_rate_index,
				int shift, u32 rate_flags)
2829 2830 2831 2832
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
2833
		int rate = supp_rates[i] & 0x7f;
2834 2835
		bool is_basic = !!(supp_rates[i] & 0x80);

2836
		if ((rate * 5 * (1 << shift)) > 110)
2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851
			*have_higher_than_11mbit = true;

		/*
		 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
		 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
		 *
		 * Note: Even through the membership selector and the basic
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
		if (!!(supp_rates[i] & 0x80) &&
		    (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
2852 2853 2854 2855 2856 2857 2858 2859 2860
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];
			if ((rate_flags & br->flags) != rate_flags)
				continue;

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
2861 2862 2863
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
2864 2865
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
2866 2867 2868 2869 2870 2871 2872
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
2873

J
Johannes Berg 已提交
2874 2875
static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2876
				    struct ieee80211_mgmt *mgmt, size_t len)
2877
{
2878
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2879
	struct ieee80211_local *local = sdata->local;
2880
	struct ieee80211_supported_band *sband;
2881
	struct sta_info *sta;
J
Johannes Berg 已提交
2882 2883
	u8 *pos;
	u16 capab_info, aid;
2884
	struct ieee802_11_elems elems;
J
Johannes Berg 已提交
2885
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2886 2887
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
J
Johannes Berg 已提交
2888
	u32 changed = 0;
2889
	int err;
2890
	bool ret;
2891

J
Johannes Berg 已提交
2892
	/* AssocResp and ReassocResp have identical structure */
2893 2894

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
2895
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2896

2897
	if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
J
Johannes Berg 已提交
2898 2899
		sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
			   aid);
2900 2901
	aid &= ~(BIT(15) | BIT(14));

2902 2903 2904
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
2905 2906
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
2907 2908 2909 2910
		aid = 0;
		ifmgd->broken_ap = true;
	}

J
Johannes Berg 已提交
2911
	pos = mgmt->u.assoc_resp.variable;
2912
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2913

2914
	if (!elems.supp_rates) {
J
Johannes Berg 已提交
2915
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
2916
		return false;
2917 2918
	}

2919
	ifmgd->aid = aid;
2920 2921 2922
	ifmgd->tdls_chan_switch_prohibited =
		elems.ext_capab && elems.ext_capab_len >= 5 &&
		(elems.ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
2923

2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968 2969 2970 2971 2972 2973 2974 2975 2976 2977 2978 2979 2980 2981 2982 2983 2984 2985 2986
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
	if ((assoc_data->wmm && !elems.wmm_param) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	     (!elems.ht_cap_elem || !elems.ht_operation)) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	     (!elems.vht_cap_elem || !elems.vht_operation))) {
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
				       false, &bss_elems);
		if (assoc_data->wmm &&
		    !elems.wmm_param && bss_elems.wmm_param) {
			elems.wmm_param = bss_elems.wmm_param;
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
		if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_cap_elem = bss_elems.ht_cap_elem;
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
		if (!elems.ht_operation && bss_elems.ht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_operation = bss_elems.ht_operation;
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
		if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_cap_elem = bss_elems.vht_cap_elem;
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
		if (!elems.vht_operation && bss_elems.vht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_operation = bss_elems.vht_operation;
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

2987 2988 2989 2990 2991 2992 2993
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
		sdata_info(sdata,
2994 2995 2996
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
2997 2998 2999 3000 3001
	}

	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    (!elems.vht_cap_elem || !elems.vht_operation)) {
		sdata_info(sdata,
3002 3003 3004
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
3005 3006
	}

3007 3008 3009 3010 3011
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
3012
	sta = sta_info_get(sdata, cbss->bssid);
3013 3014
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
3015 3016
		ret = false;
		goto out;
3017
	}
3018

J
Johannes Berg 已提交
3019
	sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
3020

3021
	/* Set up internal HT/VHT capabilities */
3022
	if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
3023
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3024
						  elems.ht_cap_elem, sta);
3025

M
Mahesh Palivela 已提交
3026 3027
	if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3028
						    elems.vht_cap_elem, sta);
M
Mahesh Palivela 已提交
3029

3030 3031 3032 3033 3034 3035
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
3036

3037 3038 3039 3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
	if (elems.opmode_notif &&
	    !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
		u8 nss;

		nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

3052
	rate_control_rate_init(sta);
3053

3054
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
J
Johannes Berg 已提交
3055
		set_sta_flag(sta, WLAN_STA_MFP);
3056

3057
	sta->sta.wme = elems.wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3058

3059
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3060 3061 3062
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
3063 3064 3065
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
3066 3067
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
3068 3069
		ret = false;
		goto out;
3070 3071
	}

3072
	mutex_unlock(&sdata->local->sta_mtx);
3073

3074 3075 3076 3077 3078 3079 3080 3081
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;

3082
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) && elems.wmm_param)
3083
		ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
J
Johannes Berg 已提交
3084
					 elems.wmm_param_len);
3085
	else
3086 3087
		ieee80211_set_wmm_default(sdata, false);
	changed |= BSS_CHANGED_QOS;
3088

J
Johannes Berg 已提交
3089 3090 3091 3092
	/* set AID and assoc capability,
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->aid = aid;
	bss_conf->assoc_capability = capab_info;
3093
	ieee80211_set_associated(sdata, cbss, changed);
3094

3095 3096 3097 3098 3099 3100 3101
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3102
	/*
J
Johannes Berg 已提交
3103 3104
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3105
	 */
J
Johannes Berg 已提交
3106
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3107
	ieee80211_sta_reset_beacon_monitor(sdata);
3108

3109 3110 3111 3112
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3113 3114
}

3115 3116 3117
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3118 3119 3120 3121 3122
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3123
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3124 3125
	u8 *pos;
	bool reassoc;
3126
	struct cfg80211_bss *bss;
3127 3128 3129 3130
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = ASSOC_EVENT,
	};
J
Johannes Berg 已提交
3131

3132
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3133 3134

	if (!assoc_data)
3135
		return;
3136
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3137
		return;
J
Johannes Berg 已提交
3138 3139 3140 3141 3142 3143 3144

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3145
		return;
J
Johannes Berg 已提交
3146 3147 3148 3149 3150 3151

	reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3152 3153 3154 3155
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3156 3157

	pos = mgmt->u.assoc_resp.variable;
3158
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
3159 3160

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3161 3162
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3163
		u32 tu, ms;
3164
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3165
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3166 3167 3168
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3169
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3170
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3171
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3172 3173
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3174 3175
	}

3176
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3177 3178

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3179 3180
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
J
Johannes Berg 已提交
3181
		ieee80211_destroy_assoc_data(sdata, false);
3182 3183 3184
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3185
	} else {
3186
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
J
Johannes Berg 已提交
3187
			/* oops -- internal error -- send timeout for now */
3188
			ieee80211_destroy_assoc_data(sdata, false);
3189
			cfg80211_assoc_timeout(sdata->dev, bss);
3190
			return;
J
Johannes Berg 已提交
3191
		}
3192 3193
		event.u.mlme.status = MLME_SUCCESS;
		drv_event_callback(sdata->local, sdata, &event);
3194
		sdata_info(sdata, "associated\n");
3195 3196 3197 3198 3199 3200 3201

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
		ieee80211_destroy_assoc_data(sdata, true);
3202 3203 3204 3205 3206 3207

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
				uapsd_queues |= BIT(ac);
J
Johannes Berg 已提交
3208 3209
	}

3210
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues);
J
Johannes Berg 已提交
3211
}
J
Johannes Berg 已提交
3212

3213
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3214
				  struct ieee80211_mgmt *mgmt, size_t len,
3215
				  struct ieee80211_rx_status *rx_status,
3216
				  struct ieee802_11_elems *elems)
3217 3218
{
	struct ieee80211_local *local = sdata->local;
3219
	struct ieee80211_bss *bss;
3220
	struct ieee80211_channel *channel;
3221

3222
	sdata_assert_lock(sdata);
3223

3224 3225
	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
	if (!channel)
3226 3227 3228
		return;

	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
3229
					channel);
3230 3231
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3232
		ieee80211_rx_bss_put(local, bss);
3233
	}
3234 3235 3236
}


3237
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3238
					 struct sk_buff *skb)
3239
{
J
Johannes Berg 已提交
3240
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3241
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3242 3243
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
	size_t baselen, len = skb->len;
3244 3245
	struct ieee802_11_elems elems;

3246 3247
	ifmgd = &sdata->u.mgd;

3248
	sdata_assert_lock(sdata);
3249

3250
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
3251 3252
		return; /* ignore ProbeResp to foreign address */

3253 3254 3255 3256 3257
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
3258
			       false, &elems);
3259

3260
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3261

3262
	if (ifmgd->associated &&
3263
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3264
		ieee80211_reset_ap_probe(sdata);
3265 3266
}

3267 3268 3269
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3270 3271 3272
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3273 3274 3275 3276 3277 3278 3279 3280 3281 3282
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3283 3284 3285 3286 3287
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3288 3289
	(1ULL << WLAN_EID_HT_OPERATION) |
	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3290

3291 3292 3293
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
3294
{
3295
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3296
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3297 3298
	size_t baselen;
	struct ieee802_11_elems elems;
3299
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
3300 3301
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
3302
	struct sta_info *sta;
3303
	u32 changed = 0;
3304
	bool erp_valid;
J
Johannes Berg 已提交
3305
	u8 erp_value = 0;
3306
	u32 ncrc;
3307
	u8 *bssid;
3308
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
3309

3310
	sdata_assert_lock(sdata);
3311

3312 3313 3314
	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
3315
		return;
3316

J
Johannes Berg 已提交
3317 3318 3319 3320
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
3321
		return;
J
Johannes Berg 已提交
3322 3323
	}

3324
	if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
J
Johannes Berg 已提交
3325
		rcu_read_unlock();
3326
		return;
J
Johannes Berg 已提交
3327
	}
3328
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
3329
	rcu_read_unlock();
3330

3331
	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
3332
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
J
Johannes Berg 已提交
3333
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3334
				       len - baselen, false, &elems);
3335

3336
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3337 3338 3339 3340
		if (elems.tim && !elems.parse_error) {
			const struct ieee80211_tim_ie *tim_ie = elems.tim;
			ifmgd->dtim_period = tim_ie->dtim_period;
		}
3341
		ifmgd->have_beacon = true;
3342
		ifmgd->assoc_data->need_beacon = false;
3343
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
3344 3345 3346 3347 3348 3349 3350 3351 3352 3353
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
			if (elems.tim)
				sdata->vif.bss_conf.sync_dtim_count =
					elems.tim->dtim_count;
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
3354 3355
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
3356
		ifmgd->assoc_data->timeout_started = true;
3357 3358
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3359
	}
3360

J
Johannes Berg 已提交
3361
	if (!ifmgd->associated ||
3362
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3363
		return;
J
Johannes Berg 已提交
3364
	bssid = ifmgd->associated->bssid;
3365

3366 3367 3368
	/* Track average RSSI from the Beacon frames of the current AP */
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3369
		ifmgd->ave_beacon_signal = rx_status->signal * 16;
3370
		ifmgd->last_cqm_event_signal = 0;
3371
		ifmgd->count_beacon_signal = 1;
3372
		ifmgd->last_ave_beacon_signal = 0;
3373 3374 3375 3376 3377
	} else {
		ifmgd->ave_beacon_signal =
			(IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
			 (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
			 ifmgd->ave_beacon_signal) / 16;
3378
		ifmgd->count_beacon_signal++;
3379
	}
3380 3381 3382

	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3383
		int sig = ifmgd->ave_beacon_signal / 16;
3384
		int last_sig = ifmgd->last_ave_beacon_signal;
3385 3386 3387
		struct ieee80211_event event = {
			.type = RSSI_EVENT,
		};
3388 3389 3390 3391 3392 3393 3394 3395

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3396 3397
			event.u.rssi.data = RSSI_EVENT_HIGH;
			drv_event_callback(local, sdata, &event);
3398 3399 3400 3401
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3402 3403
			event.u.rssi.data = RSSI_EVENT_LOW;
			drv_event_callback(local, sdata, &event);
3404 3405 3406
		}
	}

3407
	if (bss_conf->cqm_rssi_thold &&
3408
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3409
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3410 3411 3412 3413 3414 3415 3416 3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 3428 3429 3430
		int sig = ifmgd->ave_beacon_signal / 16;
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				GFP_KERNEL);
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				GFP_KERNEL);
		}
	}

3431
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3432
		mlme_dbg_ratelimited(sdata,
3433
				     "cancelling AP probe due to a received beacon\n");
3434
		ieee80211_reset_ap_probe(sdata);
3435 3436
	}

J
Johannes Berg 已提交
3437 3438 3439 3440
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
3441
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
3442

3443 3444
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3445
					  len - baselen, false, &elems,
3446 3447
					  care_about_ies, ncrc);

3448
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) {
3449 3450 3451
		bool directed_tim = ieee80211_check_tim(elems.tim,
							elems.tim_len,
							ifmgd->aid);
3452
		if (directed_tim) {
3453
			if (local->hw.conf.dynamic_ps_timeout > 0) {
3454 3455 3456 3457 3458
				if (local->hw.conf.flags & IEEE80211_CONF_PS) {
					local->hw.conf.flags &= ~IEEE80211_CONF_PS;
					ieee80211_hw_config(local,
							    IEEE80211_CONF_CHANGE_PS);
				}
3459
				ieee80211_send_nullfunc(local, sdata, 0);
3460
			} else if (!local->pspolling && sdata->u.mgd.powersave) {
3461 3462 3463 3464 3465 3466 3467 3468 3469 3470 3471 3472
				local->pspolling = true;

				/*
				 * Here is assumed that the driver will be
				 * able to send ps-poll frame and receive a
				 * response even though power save mode is
				 * enabled, but some drivers might require
				 * to disable power save here. This needs
				 * to be investigated.
				 */
				ieee80211_send_pspoll(local, sdata);
			}
3473 3474
		}
	}
J
Johannes Berg 已提交
3475

3476
	if (sdata->vif.p2p) {
J
Janusz Dziedzic 已提交
3477
		struct ieee80211_p2p_noa_attr noa = {};
3478 3479 3480 3481 3482
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3483
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
3484 3485 3486 3487 3488 3489 3490 3491 3492 3493 3494 3495 3496 3497 3498 3499
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3500 3501 3502 3503 3504
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

3505 3506 3507
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

3508 3509 3510 3511 3512 3513 3514 3515
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
3516
	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
3517 3518 3519 3520 3521 3522 3523 3524 3525 3526 3527
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
		if (elems.tim)
			sdata->vif.bss_conf.sync_dtim_count =
				elems.tim->dtim_count;
		else
			sdata->vif.bss_conf.sync_dtim_count = 0;
	}

3528
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3529
		return;
3530
	ifmgd->beacon_crc = ncrc;
3531
	ifmgd->beacon_crc_valid = true;
3532

3533
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3534

3535
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
3536
					 rx_status->device_timestamp,
3537 3538
					 &elems, true);

3539 3540
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3541 3542 3543
				     elems.wmm_param_len))
		changed |= BSS_CHANGED_QOS;

3544 3545
	/*
	 * If we haven't had a beacon before, tell the driver about the
3546
	 * DTIM period (and beacon timing if desired) now.
3547
	 */
3548
	if (!ifmgd->have_beacon) {
3549 3550 3551 3552 3553
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
		if (elems.tim)
			bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
		else
			bss_conf->dtim_period = 1;
3554

3555 3556
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
3557 3558 3559 3560 3561

		mutex_lock(&local->iflist_mtx);
		ieee80211_recalc_ps(local, -1);
		mutex_unlock(&local->iflist_mtx);

3562
		ieee80211_recalc_ps_vif(sdata);
3563 3564
	}

3565
	if (elems.erp_info) {
J
Johannes Berg 已提交
3566 3567 3568 3569
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
3570
	}
J
Johannes Berg 已提交
3571 3572 3573
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
3574

3575
	mutex_lock(&local->sta_mtx);
3576 3577
	sta = sta_info_get(sdata, bssid);

3578 3579
	if (ieee80211_config_bw(sdata, sta,
				elems.ht_cap_elem, elems.ht_operation,
3580 3581 3582 3583 3584
				elems.vht_operation, bssid, &changed)) {
		mutex_unlock(&local->sta_mtx);
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
3585 3586 3587
		ieee80211_report_disconnect(sdata, deauth_buf,
					    sizeof(deauth_buf), true,
					    WLAN_REASON_DEAUTH_LEAVING);
3588
		return;
3589
	}
3590 3591 3592 3593

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
					    rx_status->band, true);
3594
	mutex_unlock(&local->sta_mtx);
3595

3596 3597 3598
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
3599 3600
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
3601

3602
	ieee80211_bss_info_change_notify(sdata, changed);
3603 3604
}

3605 3606
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
3607 3608 3609 3610
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
3611 3612
	struct ieee802_11_elems elems;
	int ies_len;
3613 3614 3615 3616 3617

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

3618
	sdata_lock(sdata);
3619

J
Johannes Berg 已提交
3620 3621
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
3622
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
3623 3624 3625 3626 3627
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
3628
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3629 3630
		break;
	case IEEE80211_STYPE_DEAUTH:
3631
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3632 3633
		break;
	case IEEE80211_STYPE_DISASSOC:
3634
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3635 3636 3637
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
3638
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3639 3640
		break;
	case IEEE80211_STYPE_ACTION:
3641
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3642 3643 3644
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
3645 3646 3647 3648 3649 3650

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
3651
				ies_len, true, &elems);
3652 3653 3654 3655

			if (elems.parse_error)
				break;

3656
			ieee80211_sta_process_chanswitch(sdata,
3657 3658 3659
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3660 3661 3662 3663 3664 3665 3666 3667 3668 3669
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
3670
				ies_len, true, &elems);
3671 3672 3673 3674 3675 3676 3677 3678

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
3679
			ieee80211_sta_process_chanswitch(sdata,
3680 3681 3682
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3683
		}
3684
		break;
3685
	}
3686
	sdata_unlock(sdata);
3687 3688
}

J
Johannes Berg 已提交
3689
static void ieee80211_sta_timer(unsigned long data)
3690
{
J
Johannes Berg 已提交
3691 3692
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
3693

3694
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3695 3696
}

3697
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3698
					  u8 *bssid, u8 reason, bool tx)
3699
{
3700
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3701

3702
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3703
			       tx, frame_buf);
3704

3705 3706
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    reason);
3707 3708
}

3709
static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
3710 3711 3712 3713
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3714
	u32 tx_flags = 0;
3715 3716
	u16 trans = 1;
	u16 status = 0;
J
Johannes Berg 已提交
3717

3718
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3719 3720 3721 3722 3723 3724 3725

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
3726 3727
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
3728 3729 3730 3731 3732 3733 3734 3735 3736 3737

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3738 3739
	drv_mgd_prepare_tx(local, sdata);

3740 3741 3742
	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
		   auth_data->bss->bssid, auth_data->tries,
		   IEEE80211_AUTH_MAX_TRIES);
3743

3744
	auth_data->expected_transaction = 2;
3745

3746 3747 3748 3749 3750
	if (auth_data->algorithm == WLAN_AUTH_SAE) {
		trans = auth_data->sae_trans;
		status = auth_data->sae_status;
		auth_data->expected_transaction = trans;
	}
J
Johannes Berg 已提交
3751

3752 3753 3754
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
3755

3756 3757 3758 3759 3760
	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
			    auth_data->data, auth_data->data_len,
			    auth_data->bss->bssid,
			    auth_data->bss->bssid, NULL, 0, 0,
			    tx_flags);
J
Johannes Berg 已提交
3761

3762
	if (tx_flags == 0) {
3763
		auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3764
		auth_data->timeout_started = true;
3765
		run_again(sdata, auth_data->timeout);
3766
	} else {
3767 3768 3769 3770
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
		auth_data->timeout_started = true;
		run_again(sdata, auth_data->timeout);
3771
	}
J
Johannes Berg 已提交
3772 3773 3774 3775 3776 3777 3778 3779 3780

	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

3781
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3782 3783 3784

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
3785 3786
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
3787 3788 3789 3790 3791 3792 3793 3794 3795 3796

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3797 3798 3799
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
3800 3801
	ieee80211_send_assoc(sdata);

3802
	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
3803
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3804
		assoc_data->timeout_started = true;
3805
		run_again(sdata, assoc_data->timeout);
3806
	} else {
3807 3808 3809 3810 3811
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
3812
	}
J
Johannes Berg 已提交
3813 3814 3815 3816

	return 0;
}

3817 3818 3819 3820 3821 3822 3823 3824 3825 3826 3827 3828
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

3829
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
3830 3831
{
	struct ieee80211_local *local = sdata->local;
3832
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3833

3834
	sdata_lock(sdata);
3835

3836 3837 3838 3839 3840
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
3841
		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
3842 3843 3844
			if (status_acked) {
				ifmgd->auth_data->timeout =
					jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3845
				run_again(sdata, ifmgd->auth_data->timeout);
3846 3847 3848
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
3849
			ifmgd->auth_data->timeout_started = true;
3850 3851 3852 3853 3854 3855
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3856
				run_again(sdata, ifmgd->assoc_data->timeout);
3857 3858 3859
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
3860
			ifmgd->assoc_data->timeout_started = true;
3861 3862 3863
		}
	}

3864
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
3865 3866 3867 3868 3869 3870 3871
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
3872
		} else if (ieee80211_auth(sdata)) {
J
Johannes Berg 已提交
3873
			u8 bssid[ETH_ALEN];
3874 3875 3876 3877 3878
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = AUTH_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
3879 3880 3881 3882 3883

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

3884
			cfg80211_auth_timeout(sdata->dev, bssid);
3885
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3886
		}
3887
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3888
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
3889

3890
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
3891
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
3892
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
3893
		    ieee80211_do_assoc(sdata)) {
3894
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
3895 3896 3897 3898 3899
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = ASSOC_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
3900 3901

			ieee80211_destroy_assoc_data(sdata, false);
3902
			cfg80211_assoc_timeout(sdata->dev, bss);
3903
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3904
		}
3905
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3906
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
3907

3908
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
3909
	    ifmgd->associated) {
3910
		u8 bssid[ETH_ALEN];
3911
		int max_tries;
3912

3913
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3914

3915
		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3916
			max_tries = max_nullfunc_tries;
3917
		else
3918
			max_tries = max_probe_tries;
3919

3920 3921 3922
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
3923 3924
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3925 3926 3927 3928
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
3929 3930
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
3931 3932 3933
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
3934
				ieee80211_sta_connection_lost(sdata, bssid,
3935 3936
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
3937 3938
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
3939
			run_again(sdata, ifmgd->probe_timeout);
3940
		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
J
Johannes Berg 已提交
3941 3942 3943
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
3944
			ieee80211_sta_connection_lost(sdata, bssid,
3945
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3946
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3947 3948 3949 3950
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
3951 3952
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
3953 3954 3955 3956
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
3957 3958 3959 3960
			wiphy_debug(local->hw.wiphy,
				    "%s: No probe response from AP %pM"
				    " after %dms, disconnecting.\n",
				    sdata->name,
3961
				    bssid, probe_wait_ms);
3962

3963
			ieee80211_sta_connection_lost(sdata, bssid,
3964
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
3965 3966 3967
		}
	}

3968
	sdata_unlock(sdata);
3969 3970
}

J
Johannes Berg 已提交
3971 3972 3973 3974
static void ieee80211_sta_bcn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
3975
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3976

3977
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3978 3979
		return;

3980
	sdata->u.mgd.connection_loss = false;
3981 3982
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
3983 3984 3985 3986 3987 3988 3989 3990 3991
}

static void ieee80211_sta_conn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

3992
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3993 3994
		return;

3995
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
3996 3997 3998 3999 4000 4001 4002 4003 4004 4005 4006
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
4007 4008
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
4009
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
4010
		__ieee80211_stop_poll(sdata);
4011

J
Johannes Berg 已提交
4012
		/* let's probe the connection once */
4013
		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
4014 4015
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
J
Johannes Berg 已提交
4016
		/* and do all the other regular work too */
J
Johannes Berg 已提交
4017
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
4018
	}
J
Johannes Berg 已提交
4019
}
4020

4021
#ifdef CONFIG_PM
4022 4023 4024 4025 4026 4027 4028
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

4029 4030 4031 4032 4033
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

4034
		/*
4035 4036 4037
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
4038
		 */
4039
		ieee80211_send_deauth_disassoc(sdata, bssid,
4040 4041 4042
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
4043 4044 4045 4046
		if (ifmgd->assoc_data)
			ieee80211_destroy_assoc_data(sdata, false);
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
4047 4048 4049 4050
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

4051 4052 4053 4054 4055 4056 4057 4058 4059 4060 4061 4062 4063 4064 4065 4066 4067 4068 4069 4070 4071 4072 4073 4074 4075 4076 4077 4078
	/* This is a bit of a hack - we should find a better and more generic
	 * solution to this. Normally when suspending, cfg80211 will in fact
	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
	 * auth (not so important) or assoc (this is the problem) process.
	 *
	 * As a consequence, it can happen that we are in the process of both
	 * associating and suspending, and receive an association response
	 * after cfg80211 has checked if it needs to disconnect, but before
	 * we actually set the flag to drop incoming frames. This will then
	 * cause the workqueue flush to process the association response in
	 * the suspend, resulting in a successful association just before it
	 * tries to remove the interface from the driver, which now though
	 * has a channel context assigned ... this results in issues.
	 *
	 * To work around this (for now) simply deauth here again if we're
	 * now connected.
	 */
	if (ifmgd->associated && !sdata->local->wowlan) {
		u8 bssid[ETH_ALEN];
		struct cfg80211_deauth_request req = {
			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
			.bssid = bssid,
		};

		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
		ieee80211_mgd_deauth(sdata, &req);
	}

4079 4080 4081
	sdata_unlock(sdata);
}

4082 4083 4084 4085
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4086
	sdata_lock(sdata);
4087
	if (!ifmgd->associated) {
4088
		sdata_unlock(sdata);
4089 4090 4091 4092 4093 4094 4095 4096 4097 4098
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4099
		sdata_unlock(sdata);
4100 4101
		return;
	}
4102
	sdata_unlock(sdata);
4103 4104 4105
}
#endif

J
Johannes Berg 已提交
4106 4107
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4108
{
4109
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4110

4111
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4112
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4113
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4114 4115
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4116 4117
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4118
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4119 4120
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4121
	setup_timer(&ifmgd->timer, ieee80211_sta_timer,
S
Sujith 已提交
4122
		    (unsigned long) sdata);
J
Johannes Berg 已提交
4123 4124 4125 4126
	setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
		    (unsigned long) sdata);
	setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
		    (unsigned long) sdata);
4127
	setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
J
Johannes Berg 已提交
4128
		    (unsigned long) sdata);
4129 4130
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4131

4132
	ifmgd->flags = 0;
4133
	ifmgd->powersave = sdata->wdev.ps;
4134 4135
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4136
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4137

4138
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4139 4140 4141
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4142 4143 4144 4145 4146

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4147 4148
}

4149 4150
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4151
{
4152
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4153

4154 4155
	/* Restart STA timers */
	rcu_read_lock();
4156 4157 4158 4159
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4160 4161
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4162

4163 4164 4165 4166 4167 4168 4169
int ieee80211_max_network_latency(struct notifier_block *nb,
				  unsigned long data, void *dummy)
{
	s32 latency_usec = (s32) data;
	struct ieee80211_local *local =
		container_of(nb, struct ieee80211_local,
			     network_latency_notifier);
4170

4171 4172 4173
	mutex_lock(&local->iflist_mtx);
	ieee80211_recalc_ps(local, latency_usec);
	mutex_unlock(&local->iflist_mtx);
4174

4175
	return NOTIFY_OK;
J
Johannes Berg 已提交
4176 4177
}

J
Johannes Berg 已提交
4178 4179 4180 4181 4182 4183 4184 4185 4186 4187 4188 4189
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4190
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4191 4192 4193 4194 4195 4196 4197 4198 4199 4200 4201 4202
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4203
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4204 4205 4206 4207 4208 4209 4210 4211 4212 4213 4214 4215 4216 4217 4218 4219 4220 4221
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

4222 4223
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4224 4225 4226
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4227
	const struct ieee80211_ht_cap *ht_cap = NULL;
4228
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4229
	const struct ieee80211_vht_operation *vht_oper = NULL;
4230
	struct ieee80211_supported_band *sband;
4231
	struct cfg80211_chan_def chandef;
J
Johannes Berg 已提交
4232
	int ret;
4233

4234 4235
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4236 4237 4238 4239
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4240 4241
	rcu_read_lock();

J
Johannes Berg 已提交
4242 4243
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    sband->ht_cap.ht_supported) {
4244
		const u8 *ht_oper_ie, *ht_cap_ie;
4245

4246
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4247 4248
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4249

4250 4251 4252 4253 4254
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4255 4256 4257
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4258 4259
	}

J
Johannes Berg 已提交
4260 4261
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    sband->vht_cap.vht_supported) {
4262
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4263

4264 4265
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4266 4267 4268 4269
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4270
			sdata_info(sdata,
J
Johannes Berg 已提交
4271
				   "AP advertised VHT without HT, disabling both\n");
4272 4273
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4274
		}
4275 4276 4277 4278 4279 4280

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4281 4282
	}

J
Johannes Berg 已提交
4283 4284
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
4285
						     ht_cap, ht_oper, vht_oper,
4286
						     &chandef, false);
4287

J
Johannes Berg 已提交
4288 4289
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4290

4291 4292
	rcu_read_unlock();

4293 4294 4295
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4296
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4297 4298 4299 4300 4301 4302 4303
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4304 4305 4306 4307

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4308
		goto out;
4309

4310
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4311
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4312 4313 4314
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4315 4316
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4317
	return ret;
4318 4319 4320
}

static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
4321 4322
				     struct cfg80211_bss *cbss, bool assoc,
				     bool override)
4323 4324 4325 4326 4327
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
4328
	struct ieee80211_supported_band *sband;
4329
	bool have_sta = false;
4330 4331
	int err;

4332 4333
	sband = local->hw.wiphy->bands[cbss->channel->band];

4334 4335 4336 4337 4338 4339 4340 4341 4342 4343 4344 4345 4346 4347
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
4348

4349
	if (new_sta || override) {
4350 4351 4352 4353 4354 4355 4356 4357
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

J
Johannes Berg 已提交
4358
	if (new_sta) {
4359 4360 4361
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
4362
		struct ieee80211_chanctx_conf *chanctx_conf;
J
Johannes Berg 已提交
4363
		const struct cfg80211_bss_ies *ies;
4364
		int shift = ieee80211_vif_get_shift(&sdata->vif);
4365
		u32 rate_flags;
4366

4367 4368 4369 4370
		rcu_read_lock();
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
		if (WARN_ON(!chanctx_conf)) {
			rcu_read_unlock();
E
Eytan Lifshitz 已提交
4371
			sta_info_free(local, new_sta);
4372 4373 4374 4375
			return -EINVAL;
		}
		rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
		rcu_read_unlock();
4376 4377 4378 4379 4380

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
4381 4382
				    &min_rate, &min_rate_index,
				    shift, rate_flags);
4383 4384 4385 4386 4387 4388 4389 4390 4391 4392

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
		 */
		if (!basic_rates && min_rate_index >= 0) {
J
Johannes Berg 已提交
4393 4394
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
4395 4396 4397
			basic_rates = BIT(min_rate_index);
		}

J
Johannes Berg 已提交
4398
		new_sta->sta.supp_rates[cbss->channel->band] = rates;
4399 4400 4401
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
J
Johannes Berg 已提交
4402
		if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
4403 4404 4405 4406 4407 4408 4409
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

4410 4411
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
4412
		rcu_read_lock();
4413 4414 4415 4416 4417 4418 4419 4420 4421 4422 4423 4424 4425
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			const u8 *tim_ie;

			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						  ies->data, ies->len);
			if (tim_ie && tim_ie[1] >= 2)
				sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
4426 4427
		} else if (!ieee80211_hw_check(&sdata->local->hw,
					       TIMING_BEACON_ONLY)) {
4428 4429 4430 4431 4432 4433 4434 4435 4436 4437 4438
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
4439
		rcu_read_unlock();
4440 4441

		/* tell driver about BSSID, basic rates and timing */
4442
		ieee80211_bss_info_change_notify(sdata,
4443 4444
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
4445 4446

		if (assoc)
J
Johannes Berg 已提交
4447
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
4448

J
Johannes Berg 已提交
4449 4450
		err = sta_info_insert(new_sta);
		new_sta = NULL;
4451
		if (err) {
J
Johannes Berg 已提交
4452 4453 4454
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
4455 4456 4457
			return err;
		}
	} else
4458
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4459

4460 4461 4462 4463
	/* Cancel scan to ensure that nothing interferes with connection */
	if (local->scanning)
		ieee80211_scan_cancel(local);

4464 4465 4466
	return 0;
}

4467 4468 4469
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
4470
{
J
Johannes Berg 已提交
4471 4472 4473
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
4474
	u16 auth_alg;
J
Johannes Berg 已提交
4475 4476 4477
	int err;

	/* prepare auth data structure */
J
Johannes Berg 已提交
4478

4479 4480 4481 4482 4483
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
J
Johannes Berg 已提交
4484
		if (IS_ERR(local->wep_tx_tfm))
4485
			return -EOPNOTSUPP;
4486 4487 4488 4489 4490 4491 4492 4493
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
4494 4495 4496
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
4497 4498
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4499
	}
4500

4501 4502
	auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
4503
	if (!auth_data)
J
Johannes Berg 已提交
4504
		return -ENOMEM;
4505

J
Johannes Berg 已提交
4506
	auth_data->bss = req->bss;
4507

4508 4509 4510 4511 4512 4513 4514 4515 4516
	if (req->sae_data_len >= 4) {
		__le16 *pos = (__le16 *) req->sae_data;
		auth_data->sae_trans = le16_to_cpu(pos[0]);
		auth_data->sae_status = le16_to_cpu(pos[1]);
		memcpy(auth_data->data, req->sae_data + 4,
		       req->sae_data_len - 4);
		auth_data->data_len += req->sae_data_len - 4;
	}

4517
	if (req->ie && req->ie_len) {
4518 4519 4520
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
4521
	}
4522

J
Johannes Berg 已提交
4523
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
4524 4525 4526
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
4527 4528
	}

J
Johannes Berg 已提交
4529
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
4530

J
Johannes Berg 已提交
4531
	/* try to authenticate/probe */
4532

J
Johannes Berg 已提交
4533 4534 4535 4536
	if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
	    ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
4537 4538
	}

J
Johannes Berg 已提交
4539 4540
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
4541

J
Johannes Berg 已提交
4542 4543
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
4544

4545 4546 4547 4548 4549 4550 4551
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4552 4553 4554
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
4555
	}
J
Johannes Berg 已提交
4556

J
Johannes Berg 已提交
4557
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4558

4559
	err = ieee80211_prep_connection(sdata, req->bss, false, false);
4560
	if (err)
J
Johannes Berg 已提交
4561
		goto err_clear;
J
Johannes Berg 已提交
4562

4563
	err = ieee80211_auth(sdata);
J
Johannes Berg 已提交
4564 4565 4566 4567 4568 4569
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
4570
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4571
	return 0;
J
Johannes Berg 已提交
4572 4573

 err_clear:
4574
	eth_zero_addr(ifmgd->bssid);
4575
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4576
	ifmgd->auth_data = NULL;
4577 4578 4579
	mutex_lock(&sdata->local->mtx);
	ieee80211_vif_release_channel(sdata);
	mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
4580 4581 4582
 err_free:
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
4583 4584
}

4585 4586 4587 4588 4589 4590 4591 4592 4593 4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604 4605 4606 4607 4608 4609 4610 4611 4612 4613 4614 4615 4616 4617 4618 4619 4620 4621 4622
static bool ieee80211_usable_wmm_params(struct ieee80211_sub_if_data *sdata,
					const u8 *wmm_param, int len)
{
	const u8 *pos;
	size_t left;

	if (len < 8)
		return false;

	if (wmm_param[5] != 1 /* version */)
		return false;

	pos = wmm_param + 8;
	left = len - 8;

	for (; left >= 4; left -= 4, pos += 4) {
		u8 aifsn = pos[0] & 0x0f;
		u8 ecwmin = pos[1] & 0x0f;
		u8 ecwmax = (pos[1] & 0xf0) >> 4;
		int aci = (pos[0] >> 5) & 0x03;

		if (aifsn < 2) {
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), disabling WMM\n",
				   aifsn, aci);
			return false;
		}
		if (ecwmin > ecwmax) {
			sdata_info(sdata,
				   "AP has invalid WMM params (ECWmin/max=%d/%d for ACI %d), disabling WMM\n",
				   ecwmin, ecwmax, aci);
			return false;
		}
	}

	return true;
}

4623 4624
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
4625
{
J
Johannes Berg 已提交
4626
	struct ieee80211_local *local = sdata->local;
4627
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4628
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
4629
	struct ieee80211_mgd_assoc_data *assoc_data;
4630
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
4631
	struct ieee80211_supported_band *sband;
4632
	const u8 *ssidie, *ht_ie, *vht_ie;
4633
	int i, err;
4634
	bool override = false;
4635

J
Johannes Berg 已提交
4636 4637 4638 4639
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

4640 4641 4642 4643 4644 4645 4646 4647 4648 4649 4650
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
	if (!ssidie) {
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

4651 4652 4653 4654 4655 4656 4657
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4658 4659 4660
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
4661
	}
J
Johannes Berg 已提交
4662 4663 4664 4665

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
4666
	}
4667

J
Johannes Berg 已提交
4668 4669 4670 4671
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
4672

J
Johannes Berg 已提交
4673 4674 4675 4676
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
4677
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
4678
		ieee80211_destroy_auth_data(sdata, match);
4679 4680
	}

J
Johannes Berg 已提交
4681
	/* prepare assoc data */
4682

4683 4684
	ifmgd->beacon_crc_valid = false;

4685 4686 4687 4688 4689 4690 4691 4692 4693 4694 4695 4696 4697 4698 4699 4700 4701 4702 4703 4704 4705 4706 4707 4708 4709 4710 4711 4712 4713 4714 4715 4716 4717 4718 4719 4720
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);
	if (assoc_data->wmm) {
		/* try to check validity of WMM params IE */
		const struct cfg80211_bss_ies *ies;
		const u8 *wp, *start, *end;

		rcu_read_lock();
		ies = rcu_dereference(req->bss->ies);
		start = ies->data;
		end = start + ies->len;

		while (true) {
			wp = cfg80211_find_vendor_ie(
				WLAN_OUI_MICROSOFT,
				WLAN_OUI_TYPE_MICROSOFT_WMM,
				start, end - start);
			if (!wp)
				break;
			start = wp + wp[1] + 2;
			/* if this IE is too short, try the next */
			if (wp[1] <= 4)
				continue;
			/* if this IE is WMM params, we found what we wanted */
			if (wp[6] == 1)
				break;
		}

		if (!wp || !ieee80211_usable_wmm_params(sdata, wp + 2,
							wp[1] - 2)) {
			assoc_data->wmm = false;
			ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
		}
		rcu_read_unlock();
	}

J
Johannes Berg 已提交
4721 4722 4723 4724 4725 4726 4727
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
4728
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4729 4730
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4731
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4732
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4733
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4734
			netdev_info(sdata->dev,
4735
				    "disabling HT/VHT due to WEP/TKIP use\n");
4736 4737
		}
	}
4738

J
Johannes Berg 已提交
4739 4740 4741
	/* Also disable HT if we don't support it or the AP doesn't use WMM */
	sband = local->hw.wiphy->bands[req->bss->channel->band];
	if (!sband->ht_cap.ht_supported ||
4742 4743
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4744
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4745 4746
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4747 4748
			netdev_info(sdata->dev,
				    "disabling HT as WMM/QoS is not supported by the AP\n");
4749
	}
J
Johannes Berg 已提交
4750

4751 4752
	/* disable VHT if we don't support it or the AP doesn't use WMM */
	if (!sband->vht_cap.vht_supported ||
4753 4754
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4755
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4756 4757
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4758 4759
			netdev_info(sdata->dev,
				    "disabling VHT as WMM/QoS is not supported by the AP\n");
4760 4761
	}

B
Ben Greear 已提交
4762 4763 4764 4765
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

4766 4767 4768 4769
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

4770
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
4771 4772 4773
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
4774

J
Johannes Berg 已提交
4775
	assoc_data->bss = req->bss;
4776

J
Johannes Berg 已提交
4777 4778
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
4779
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
4780
		else
4781
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
4782
	} else
4783
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
4784

J
Johannes Berg 已提交
4785 4786 4787
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
4788

4789
	rcu_read_lock();
4790 4791 4792 4793 4794
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
	else
4795
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4796 4797 4798 4799 4800 4801
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
	else
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4802
	rcu_read_unlock();
4803

4804
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
4805
		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
4806 4807 4808
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
4809
	if (bss->wmm_used && bss->uapsd_supported &&
4810
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
4811
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
4812 4813
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
4814
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
4815 4816 4817
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

4818
	if (req->prev_bssid)
J
Johannes Berg 已提交
4819
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4820 4821 4822 4823 4824 4825 4826 4827 4828

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

4829 4830 4831 4832 4833
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

4834 4835 4836 4837 4838
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

4839 4840
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4841 4842
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
4843

J
Johannes Berg 已提交
4844 4845 4846
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
4847
	ifmgd->dtim_period = 0;
4848
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
4849

4850 4851 4852 4853 4854 4855 4856 4857 4858 4859 4860 4861 4862 4863 4864 4865 4866 4867 4868 4869 4870 4871 4872 4873 4874 4875 4876 4877 4878 4879
	/* override HT/VHT configuration only if the AP and we support it */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
		struct ieee80211_sta_ht_cap sta_ht_cap;

		if (req->flags & ASSOC_REQ_DISABLE_HT)
			override = true;

		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

		/* check for 40 MHz disable override */
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
		    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
		    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
			override = true;

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
		    req->flags & ASSOC_REQ_DISABLE_VHT)
			override = true;
	}

	if (req->flags & ASSOC_REQ_DISABLE_HT) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
	}

	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	err = ieee80211_prep_connection(sdata, req->bss, true, override);
4880 4881
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
4882

4883 4884
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
4885

4886
	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
4887 4888 4889 4890 4891 4892 4893 4894
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4895
		assoc_data->timeout_started = true;
4896 4897 4898 4899 4900
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
		const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						    beacon_ies->data,
						    beacon_ies->len);
4901 4902
		u8 dtim_count = 0;

4903 4904 4905 4906
		if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
			const struct ieee80211_tim_ie *tim;
			tim = (void *)(tim_ie + 2);
			ifmgd->dtim_period = tim->dtim_period;
4907
			dtim_count = tim->dtim_count;
4908
		}
4909
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
4910
		assoc_data->timeout = jiffies;
4911
		assoc_data->timeout_started = true;
4912

4913
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4914 4915 4916 4917 4918
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
4919 4920
	} else {
		assoc_data->timeout = jiffies;
4921
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
4922
	}
4923 4924
	rcu_read_unlock();

4925
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
4926

P
Paul Stewart 已提交
4927 4928 4929 4930 4931 4932 4933 4934 4935 4936
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
4937 4938
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
4939 4940
	}

4941
	return 0;
J
Johannes Berg 已提交
4942
 err_clear:
4943
	eth_zero_addr(ifmgd->bssid);
4944
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4945 4946 4947 4948
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
4949 4950
}

4951
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4952
			 struct cfg80211_deauth_request *req)
4953
{
4954
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4955
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4956
	bool tx = !req->local_state_change;
4957

4958 4959 4960 4961 4962 4963
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
4964

4965
		drv_mgd_prepare_tx(sdata->local, sdata);
4966 4967
		ieee80211_send_deauth_disassoc(sdata, req->bssid,
					       IEEE80211_STYPE_DEAUTH,
4968
					       req->reason_code, tx,
4969
					       frame_buf);
4970
		ieee80211_destroy_auth_data(sdata, false);
4971 4972 4973
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
4974

4975
		return 0;
4976 4977
	}

4978 4979
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4980 4981 4982 4983 4984
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

4985 4986
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
4987 4988 4989
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
4990 4991
		return 0;
	}
4992

4993
	return -ENOTCONN;
4994
}
4995

4996
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4997
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
4998
{
4999
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5000
	u8 bssid[ETH_ALEN];
5001
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
5002

J
Johannes Berg 已提交
5003 5004 5005 5006 5007 5008
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
5009
	if (ifmgd->associated != req->bss)
5010 5011
		return -ENOLINK;

J
Johannes Berg 已提交
5012
	sdata_info(sdata,
5013 5014
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
5015

5016
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
5017 5018 5019
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
5020

5021 5022
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    req->reason_code);
5023

5024 5025
	return 0;
}
5026

5027
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
5028 5029 5030
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

5031 5032 5033 5034 5035 5036 5037 5038 5039 5040
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
5041
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5042

5043
	sdata_lock(sdata);
5044 5045
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5046
		ieee80211_destroy_assoc_data(sdata, false);
5047 5048
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
5049 5050
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
5051 5052 5053 5054 5055 5056 5057
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
	spin_unlock_bh(&ifmgd->teardown_lock);
5058
	del_timer_sync(&ifmgd->timer);
5059
	sdata_unlock(sdata);
5060 5061
}

5062 5063 5064 5065 5066 5067
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

J
Johannes Berg 已提交
5068 5069
	trace_api_cqm_rssi_notify(sdata, rssi_event);

5070 5071 5072
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
5073 5074 5075 5076 5077 5078 5079 5080 5081 5082

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);