mlme.c 140.4 KB
Newer Older
1 2
/*
 * BSS client mode implementation
3
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4 5 6 7
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8
 * Copyright 2013-2014  Intel Mobile Communications GmbH
9 10 11 12 13 14
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

15
#include <linux/delay.h>
16 17 18 19
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
20
#include <linux/moduleparam.h>
21
#include <linux/rtnetlink.h>
22
#include <linux/pm_qos.h>
23
#include <linux/crc32.h>
24
#include <linux/slab.h>
25
#include <linux/export.h>
26
#include <net/mac80211.h>
27
#include <asm/unaligned.h>
J
Johannes Berg 已提交
28

29
#include "ieee80211_i.h"
30
#include "driver-ops.h"
J
Johannes Berg 已提交
31 32
#include "rate.h"
#include "led.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36 37 38 39
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
40
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
41 42
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
43

44 45 46 47 48 49 50 51 52
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
53 54

/*
55 56 57 58 59 60
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
61
 */
62 63 64 65
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
66

J
Johannes Berg 已提交
67 68 69 70
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
71
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
72 73 74 75 76
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
77 78 79 80 81
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
82

83 84 85 86 87 88 89
/*
 * Weight given to the latest Beacon frame when calculating average signal
 * strength for Beacon frames received in the current BSS. This must be
 * between 1 and 15.
 */
#define IEEE80211_SIGNAL_AVE_WEIGHT	3

90 91 92 93 94 95
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
96 97 98 99 100 101 102 103 104 105
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
106 107
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
108
{
109
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
110

111 112 113
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
114 115
}

116
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
117
{
118
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
119 120
		return;

121 122 123
	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
		return;

J
Johannes Berg 已提交
124
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
125
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
126 127
}

128 129
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
130 131
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

132 133 134
	if (unlikely(!sdata->u.mgd.associated))
		return;

135 136
	ifmgd->probe_send_count = 0;

137 138 139 140 141 142 143
	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
		return;

	mod_timer(&sdata->u.mgd.conn_mon_timer,
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

144
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
145
{
146
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
147 148
}

149 150 151 152
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
153
			     const struct ieee80211_ht_cap *ht_cap,
154 155
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
156
			     struct cfg80211_chan_def *chandef, bool tracking)
157
{
158
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
159
	struct cfg80211_chan_def vht_chandef;
160
	struct ieee80211_sta_ht_cap sta_ht_cap;
161 162
	u32 ht_cfreq, ret;

163 164 165
	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

166 167 168 169 170
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
	chandef->center_freq2 = 0;

171
	if (!ht_cap || !ht_oper || !sta_ht_cap.ht_supported) {
172 173 174 175 176 177
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

178 179
	if (!(ht_cap->cap_info &
	      cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
180
		ret = IEEE80211_STA_DISABLE_40MHZ;
181
		vht_chandef = *chandef;
182 183 184
		goto out;
	}

185 186 187
	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
188
	if (!tracking && channel->center_freq != ht_cfreq) {
189 190 191 192 193 194 195
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
196 197 198 199
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
200 201 202 203 204
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	/* check 40 MHz support, if we have it */
205
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
206 207 208 209 210 211 212 213 214 215 216 217 218
		switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
		case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 += 10;
			break;
		case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 -= 10;
			break;
		}
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
219 220
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	vht_chandef.chan = channel;
	vht_chandef.center_freq1 =
		ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
					       channel->band);
	vht_chandef.center_freq2 = 0;

	switch (vht_oper->chan_width) {
	case IEEE80211_VHT_CHANWIDTH_USE_HT:
		vht_chandef.width = chandef->width;
238
		vht_chandef.center_freq1 = chandef->center_freq1;
239 240 241 242 243 244 245 246 247
		break;
	case IEEE80211_VHT_CHANWIDTH_80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80;
		break;
	case IEEE80211_VHT_CHANWIDTH_160MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_160;
		break;
	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
248 249 250 251
		vht_chandef.center_freq2 =
			ieee80211_channel_to_frequency(
				vht_oper->center_freq_seg2_idx,
				channel->band);
252 253
		break;
	default:
254
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
255 256 257
			sdata_info(sdata,
				   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
				   vht_oper->chan_width);
258 259 260 261 262
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
263
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
264 265
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
266 267 268 269 270 271 272 273 274 275
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
276
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
277 278
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
279 280 281 282 283 284 285 286 287
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

310 311 312 313
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

314 315 316 317 318 319 320 321
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
322
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
323 324
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
325 326 327
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
			      IEEE80211_STA_DISABLE_VHT;
328
			break;
329 330
		}

331
		ret |= ieee80211_chandef_downgrade(chandef);
332 333
	}

334
	if (chandef->width != vht_chandef.width && !tracking)
335 336 337 338 339 340 341
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

342 343
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
344
			       const struct ieee80211_ht_cap *ht_cap,
345 346 347
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
			       const u8 *bssid, u32 *changed)
348 349
{
	struct ieee80211_local *local = sdata->local;
350
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
351
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
352
	struct ieee80211_channel *chan;
353
	struct cfg80211_chan_def chandef;
354
	u16 ht_opmode;
355 356 357
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
358

359 360
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
361 362
		return 0;

363 364 365 366 367 368 369
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

370 371 372 373 374 375 376 377 378 379
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

380
	chan = sdata->vif.bss_conf.chandef.chan;
J
Johannes Berg 已提交
381
	sband = local->hw.wiphy->bands[chan->band];
382

383
	/* calculate new channel (type) based on HT/VHT operation IEs */
384 385 386
	flags = ieee80211_determine_chantype(sdata, sband, chan,
					     ht_cap, ht_oper, vht_oper,
					     &chandef, true);
387 388 389 390 391 392 393 394 395 396

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
397
		flags |= ieee80211_chandef_downgrade(&chandef);
398 399
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
400
		flags |= ieee80211_chandef_downgrade(&chandef);
401 402
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
403
		flags |= ieee80211_chandef_downgrade(&chandef);
404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
		   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
		   chandef.center_freq1, chandef.center_freq2);

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
430
	case NL80211_CHAN_WIDTH_40:
431
		new_sta_bw = IEEE80211_STA_RX_BW_40;
432
		break;
433 434 435 436 437 438
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
439
		break;
440 441
	default:
		return -EINVAL;
442
	}
443

444 445
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
446

447 448 449 450 451
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
452

453 454 455 456 457 458 459
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
460

461 462 463 464
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
465
	}
466

467
	return 0;
468 469
}

J
Johannes Berg 已提交
470 471
/* frame sending functions */

J
Johannes Berg 已提交
472
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
473
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

491
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
492 493 494 495 496 497 498 499 500 501 502 503 504 505
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

506 507 508 509 510 511 512 513 514 515
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

541 542
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
543 544
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
545 546 547 548
{
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
549
	u32 mask, ap_bf_sts, our_bf_sts;
550 551 552 553

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
554
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
555 556 557 558

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
559
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
560 561 562 563 564 565
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
566 567 568 569
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
570
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
571 572
	}

573 574 575 576 577 578 579 580
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;

581 582 583 584 585 586 587 588 589 590
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

591
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
592
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
593 594 595
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

J
Johannes Berg 已提交
596 597 598 599 600 601 602 603 604
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
	u8 *pos, qos_info;
	size_t offset = 0, noffset;
605
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
606 607
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
608 609
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
610
	u32 rate_flags, rates = 0;
J
Johannes Berg 已提交
611

612
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
613

J
Johannes Berg 已提交
614 615 616 617 618 619
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
620
	chan = chanctx_conf->def.chan;
621
	rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
J
Johannes Berg 已提交
622 623
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
624
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
625 626 627 628 629 630 631 632

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
633 634 635 636
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
637 638 639 640 641 642
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
643 644 645 646 647 648 649 650
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			if ((rate_flags & sband->bitrates[i].flags)
			    != rate_flags)
				continue;
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
651 652 653 654 655 656 657 658 659
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
660
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
J
Johannes Berg 已提交
661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684
			assoc_data->ie_len + /* extra IEs */
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

	if (sband->band == IEEE80211_BAND_2GHZ) {
		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
			capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
			capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
	    (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

685 686 687
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

J
Johannes Berg 已提交
688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729
	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(mgmt, 0, 24);
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
730 731 732
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
733 734 735 736 737 738 739 740 741 742 743 744
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
745 746 747 748
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
749 750 751 752
			}
		}
	}

753 754
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
755 756 757 758
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
759 760
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
761
	}
J
Johannes Berg 已提交
762

763
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
J
Johannes Berg 已提交
764 765 766 767 768 769 770 771 772 773 774 775
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

	/* if present, add any custom IEs that go before HT */
776
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
777 778 779 780 781 782 783 784 785 786
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
787 788
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
789 790
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
			/* 60GHz doesn't happen right now */
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
J
Johannes Berg 已提交
811 812 813 814 815
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

J
Johannes Berg 已提交
816 817 818 819
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

820
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
821
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
822
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
823

824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
		};
844 845

		/* RIC already taken above, so no need to handle here anymore */
846 847 848 849 850 851 852 853
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

854
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
855 856
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
857

J
Johannes Berg 已提交
858
	/* if present, add any custom non-vendor IEs that go after HT */
859
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
860 861 862 863 864 865 866 867
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

868 869
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
870 871
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
872 873 874 875 876
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

877
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
878 879 880
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
881
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
882 883 884 885 886
		noffset = assoc_data->ie_len;
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
	}

J
Johannes Berg 已提交
887 888
	drv_mgd_prepare_tx(local, sdata);

J
Johannes Berg 已提交
889
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
890 891 892
	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
893 894 895
	ieee80211_tx_skb(sdata, skb);
}

896 897 898 899 900 901
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

902 903
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
904 905
		return;

906 907
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
908

909 910
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
911 912
}

913 914 915 916 917
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
			     int powersave)
{
	struct sk_buff *skb;
918
	struct ieee80211_hdr_3addr *nullfunc;
919
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
920

921 922
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
	if (!skb)
923 924
		return;

925
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
926
	if (powersave)
927
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
928

929 930
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
931 932 933 934

	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

935
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
936 937
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

938
	ieee80211_tx_skb(sdata, skb);
939 940
}

941 942 943 944 945 946 947 948 949 950 951
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
952
	if (!skb)
953
		return;
954

955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970
	skb_reserve(skb, local->hw.extra_tx_headroom);

	nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
	memset(nullfunc, 0, 30);
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

971 972 973 974 975
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
976
	struct ieee80211_local *local = sdata->local;
977
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
978
	int ret;
979

980
	if (!ieee80211_sdata_running(sdata))
981 982
		return;

983
	sdata_lock(sdata);
984 985 986
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

987 988
	if (!ifmgd->associated)
		goto out;
989

990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1024
		sdata_info(sdata,
1025
			   "failed to finalize channel switch, disconnecting\n");
1026 1027 1028 1029
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1030

1031
	/* XXX: shouldn't really modify cfg80211-owned data! */
1032
	ifmgd->associated->channel = sdata->csa_chandef.chan;
1033

1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1054

1055 1056 1057 1058 1059
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1060

1061 1062 1063
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1064 1065 1066 1067 1068 1069
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1070
		return;
1071
	}
1072 1073

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1074 1075
}

1076 1077
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1078 1079
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1080 1081 1082

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1083 1084 1085 1086 1087 1088
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1089 1090 1091 1092
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1093 1094 1095 1096
static void ieee80211_chswitch_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
1097

1098
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1099 1100
}

1101
static void
J
Johannes Berg 已提交
1102
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1103 1104
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1105
				 bool beacon)
1106
{
1107
	struct ieee80211_local *local = sdata->local;
1108
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1109
	struct cfg80211_bss *cbss = ifmgd->associated;
1110
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1111
	struct ieee80211_chanctx *chanctx;
1112
	enum ieee80211_band current_band;
1113
	struct ieee80211_csa_ie csa_ie;
1114
	struct ieee80211_channel_switch ch_switch;
1115
	int res;
1116

1117
	sdata_assert_lock(sdata);
1118

1119
	if (!cbss)
1120 1121
		return;

1122
	if (local->scanning)
1123 1124
		return;

1125
	/* disregard subsequent announcements if we are already processing */
1126
	if (sdata->vif.csa_active)
1127 1128
		return;

1129
	current_band = cbss->channel->band;
1130
	memset(&csa_ie, 0, sizeof(csa_ie));
1131
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1132
					   ifmgd->flags,
1133
					   ifmgd->associated->bssid, &csa_ie);
1134
	if (res	< 0)
1135
		ieee80211_queue_work(&local->hw,
1136
				     &ifmgd->csa_connection_drop_work);
1137
	if (res)
1138
		return;
1139

1140
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1141 1142 1143
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1144
			   ifmgd->associated->bssid,
1145 1146 1147
			   csa_ie.chandef.chan->center_freq,
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
			   csa_ie.chandef.center_freq2);
1148 1149 1150 1151 1152
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1153
	mutex_lock(&local->mtx);
1154
	mutex_lock(&local->chanctx_mtx);
1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		mutex_unlock(&local->chanctx_mtx);
		mutex_unlock(&local->mtx);
		return;
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1169 1170 1171 1172 1173 1174 1175 1176 1177
	if (local->use_chanctx &&
	    !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		mutex_unlock(&local->chanctx_mtx);
		mutex_unlock(&local->mtx);
		return;
J
Johannes Berg 已提交
1178 1179
	}

1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195
	ch_switch.timestamp = timestamp;
	ch_switch.device_timestamp = device_timestamp;
	ch_switch.block_tx = csa_ie.mode;
	ch_switch.chandef = csa_ie.chandef;
	ch_switch.count = csa_ie.count;

	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		mutex_unlock(&local->chanctx_mtx);
		mutex_unlock(&local->mtx);
		return;
	}

1196 1197 1198
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1199
		sdata_info(sdata,
1200 1201
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1202
		ieee80211_queue_work(&local->hw,
J
Johannes Berg 已提交
1203
				     &ifmgd->csa_connection_drop_work);
1204
		mutex_unlock(&local->chanctx_mtx);
1205
		mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
1206 1207
		return;
	}
1208
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1209

1210
	sdata->vif.csa_active = true;
1211
	sdata->csa_chandef = csa_ie.chandef;
1212
	sdata->csa_block_tx = csa_ie.mode;
J
Johannes Berg 已提交
1213

1214
	if (sdata->csa_block_tx)
1215 1216
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1217
	mutex_unlock(&local->mtx);
1218

1219 1220 1221
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1222
	if (local->ops->channel_switch) {
1223
		/* use driver's channel switch callback */
1224
		drv_channel_switch(local, sdata, &ch_switch);
1225 1226 1227 1228
		return;
	}

	/* channel switch handled in software */
1229
	if (csa_ie.count <= 1)
1230
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1231
	else
1232
		mod_timer(&ifmgd->chswitch_timer,
1233 1234
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1235 1236
}

1237 1238 1239 1240 1241 1242
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1243
{
1244 1245
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1246
	int i, chan_increment;
1247
	bool have_chan_pwr = false;
1248

1249 1250
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1251
		return false;
1252

1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
	case IEEE80211_BAND_2GHZ:
	case IEEE80211_BAND_60GHZ:
		chan_increment = 1;
		break;
	case IEEE80211_BAND_5GHZ:
		chan_increment = 4;
		break;
1267
	}
1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1279
				*chan_pwr = triplet->chans.max_power;
1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1291
	if (have_chan_pwr && pwr_constr_elem)
1292
		*pwr_reduction = *pwr_constr_elem;
1293 1294 1295
	else
		*pwr_reduction = 0;

1296 1297 1298
	return have_chan_pwr;
}

1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1313 1314 1315 1316
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1317 1318
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1319
{
1320 1321 1322
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1323
	int new_ap_level;
1324
	__le16 capab = mgmt->u.probe_resp.capab_info;
1325

1326 1327 1328
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1329 1330 1331
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1332 1333 1334 1335 1336 1337 1338 1339
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1340
	}
1341

1342
	if (!has_80211h_pwr && !has_cisco_pwr)
1343
		return 0;
1344

1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
		sdata_info(sdata,
			   "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			   pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			   sdata->u.mgd.bssid);
		new_ap_level = pwr_level_80211h;
	} else {  /* has_cisco_pwr is always true here. */
		sdata_info(sdata,
			   "Limiting TX power to %d dBm as advertised by %pM\n",
			   pwr_level_cisco, sdata->u.mgd.bssid);
		new_ap_level = pwr_level_cisco;
	}
1361

1362 1363
	if (sdata->ap_power_level == new_ap_level)
		return 0;
1364

1365 1366 1367 1368
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1369 1370
}

1371 1372 1373 1374 1375 1376
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1377 1378 1379 1380
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1381
	if (local->scanning)
J
Johannes Berg 已提交
1382 1383
		return;

1384 1385 1386 1387 1388 1389 1390
	if (conf->dynamic_ps_timeout > 0 &&
	    !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
		if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
			ieee80211_send_nullfunc(local, sdata, 1);
1391

1392 1393 1394 1395 1396 1397
		if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
		    (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1415 1416 1417 1418
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1419
	bool authorized = false;
1420 1421 1422 1423

	if (!mgd->powersave)
		return false;

1424 1425 1426
	if (mgd->broken_ap)
		return false;

1427 1428 1429
	if (!mgd->associated)
		return false;

1430
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1431 1432
		return false;

1433
	if (!mgd->have_beacon)
1434 1435
		return false;

1436 1437 1438
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1439
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1440 1441
	rcu_read_unlock();

J
Johannes Berg 已提交
1442
	return authorized;
1443 1444
}

1445
/* need to hold RTNL or interface lock */
1446
void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1447 1448 1449
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1450
	int timeout;
1451 1452 1453 1454 1455 1456 1457

	if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1458
		if (!ieee80211_sdata_running(sdata))
1459
			continue;
1460 1461 1462 1463 1464 1465 1466 1467
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1468 1469 1470 1471 1472 1473
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1474
	if (count == 1 && ieee80211_powersave_allowed(found)) {
1475 1476 1477
		s32 beaconint_us;

		if (latency < 0)
M
Mark Gross 已提交
1478
			latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1479 1480 1481 1482

		beaconint_us = ieee80211_tu_to_usec(
					found->vif.bss_conf.beacon_int);

1483
		timeout = local->dynamic_ps_forced_timeout;
1484 1485
		if (timeout < 0) {
			/*
1486 1487
			 * Go to full PSM if the user configures a very low
			 * latency requirement.
1488 1489 1490
			 * The 2000 second value is there for compatibility
			 * until the PM_QOS_NETWORK_LATENCY is configured
			 * with real values.
1491
			 */
1492 1493
			if (latency > (1900 * USEC_PER_MSEC) &&
			    latency != (2000 * USEC_PER_SEC))
1494
				timeout = 0;
1495 1496
			else
				timeout = 100;
1497
		}
1498
		local->hw.conf.dynamic_ps_timeout = timeout;
1499

1500
		if (beaconint_us > latency) {
1501
			local->ps_sdata = NULL;
1502 1503
		} else {
			int maxslp = 1;
1504
			u8 dtimper = found->u.mgd.dtim_period;
1505 1506 1507 1508 1509

			/* If the TIM IE is invalid, pretend the value is 1 */
			if (!dtimper)
				dtimper = 1;
			else if (dtimper > 1)
1510 1511 1512
				maxslp = min_t(int, dtimper,
						    latency / beaconint_us);

1513
			local->hw.conf.max_sleep_period = maxslp;
1514
			local->hw.conf.ps_dtim_period = dtimper;
1515
			local->ps_sdata = found;
1516
		}
1517
	} else {
1518
		local->ps_sdata = NULL;
1519
	}
1520 1521 1522 1523

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1524 1525 1526 1527 1528 1529 1530 1531 1532 1533
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1546
					IEEE80211_MAX_QUEUE_MAP,
1547 1548
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1549 1550 1551 1552 1553 1554 1555 1556
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1557
	struct ieee80211_if_managed *ifmgd;
1558 1559
	unsigned long flags;
	int q;
1560 1561 1562 1563 1564

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1565 1566
	ifmgd = &sdata->u.mgd;

1567 1568 1569
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1570
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1571 1572
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1573 1574 1575 1576 1577
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1596 1597
	}

1598
	if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1599
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1600
		if (drv_tx_frames_pending(local)) {
1601 1602 1603
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1604
		} else {
1605 1606
			ieee80211_send_nullfunc(local, sdata, 1);
			/* Flush to get the tx status of nullfunc frame */
1607
			ieee80211_flush_queues(local, sdata, false);
1608
		}
1609 1610
	}

1611 1612
	if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
	      (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
1613 1614 1615 1616 1617
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1618 1619 1620 1621 1622 1623
}

void ieee80211_dynamic_ps_timer(unsigned long data)
{
	struct ieee80211_local *local = (void *) data;

1624
	if (local->quiescing || local->suspended)
1625 1626
		return;

1627
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1628 1629
}

1630 1631 1632 1633 1634 1635 1636
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
	struct delayed_work *delayed_work =
		container_of(work, struct delayed_work, work);
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1637
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1638

1639 1640 1641 1642 1643 1644 1645 1646
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1647 1648
}

1649 1650 1651 1652 1653
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1654
	bool ret = false;
1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
			/* The loop will result in using BK even if it requires
			 * admission control, such configuration makes no sense
			 * and we have to transmit somehow - the AC selection
			 * does the same thing.
			 */
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1738
/* MLME */
1739
static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1740
				     struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
1741
				     const u8 *wmm_param, size_t wmm_param_len)
1742 1743
{
	struct ieee80211_tx_queue_params params;
1744
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1745 1746
	size_t left;
	int count;
J
Johannes Berg 已提交
1747 1748
	const u8 *pos;
	u8 uapsd_queues = 0;
1749

1750
	if (!local->ops->conf_tx)
1751
		return false;
1752

J
Johannes Berg 已提交
1753
	if (local->hw.queues < IEEE80211_NUM_ACS)
1754
		return false;
1755 1756

	if (!wmm_param)
1757
		return false;
1758

1759
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1760
		return false;
K
Kalle Valo 已提交
1761 1762

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1763
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
1764

1765
	count = wmm_param[6] & 0x0f;
1766
	if (count == ifmgd->wmm_last_param_set)
1767
		return false;
1768
	ifmgd->wmm_last_param_set = count;
1769 1770 1771 1772 1773 1774

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
1775
	sdata->wmm_acm = 0;
1776 1777 1778
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
1779
		bool uapsd = false;
1780 1781 1782
		int queue;

		switch (aci) {
1783
		case 1: /* AC_BK */
J
Johannes Berg 已提交
1784
			queue = 3;
J
Johannes Berg 已提交
1785
			if (acm)
Y
Yoni Divinsky 已提交
1786
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
1787 1788
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
1789
			break;
1790
		case 2: /* AC_VI */
J
Johannes Berg 已提交
1791
			queue = 1;
J
Johannes Berg 已提交
1792
			if (acm)
Y
Yoni Divinsky 已提交
1793
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
1794 1795
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
1796
			break;
1797
		case 3: /* AC_VO */
J
Johannes Berg 已提交
1798
			queue = 0;
J
Johannes Berg 已提交
1799
			if (acm)
Y
Yoni Divinsky 已提交
1800
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
1801 1802
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
1803
			break;
1804
		case 0: /* AC_BE */
1805
		default:
J
Johannes Berg 已提交
1806
			queue = 2;
J
Johannes Berg 已提交
1807
			if (acm)
Y
Yoni Divinsky 已提交
1808
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
1809 1810
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
1811 1812 1813 1814 1815 1816
			break;
		}

		params.aifs = pos[0] & 0x0f;
		params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params.cw_min = ecw2cw(pos[1] & 0x0f);
1817
		params.txop = get_unaligned_le16(pos + 2);
1818
		params.acm = acm;
K
Kalle Valo 已提交
1819 1820
		params.uapsd = uapsd;

J
Johannes Berg 已提交
1821
		mlme_dbg(sdata,
1822
			 "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
J
Johannes Berg 已提交
1823 1824
			 queue, aci, acm,
			 params.aifs, params.cw_min, params.cw_max,
1825 1826
			 params.txop, params.uapsd,
			 ifmgd->tx_tspec[queue].downgraded);
1827
		sdata->tx_conf[queue] = params;
1828 1829
		if (!ifmgd->tx_tspec[queue].downgraded &&
		    drv_conf_tx(local, sdata, queue, &params))
J
Johannes Berg 已提交
1830 1831 1832
			sdata_err(sdata,
				  "failed to set TX queue parameters for queue %d\n",
				  queue);
1833
	}
1834 1835

	/* enable WMM or activate new settings */
1836
	sdata->vif.bss_conf.qos = true;
1837
	return true;
1838 1839
}

1840 1841 1842 1843
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

1844
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1845 1846 1847 1848 1849 1850 1851 1852 1853 1854
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
1855 1856
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
1857
{
J
Johannes Berg 已提交
1858
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1859
	u32 changed = 0;
J
Johannes Berg 已提交
1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
J
Johannes Berg 已提交
1873
	if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1874
		use_short_slot = true;
1875

1876 1877 1878
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
1879
	}
1880

1881 1882
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
1883
		changed |= BSS_CHANGED_ERP_PREAMBLE;
1884
	}
1885

J
Johannes Berg 已提交
1886 1887 1888
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
1889 1890 1891 1892 1893
	}

	return changed;
}

1894
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1895
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
1896
				     u32 bss_info_changed)
1897
{
1898
	struct ieee80211_bss *bss = (void *)cbss->priv;
1899
	struct ieee80211_local *local = sdata->local;
1900
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1901

J
Johannes Berg 已提交
1902
	bss_info_changed |= BSS_CHANGED_ASSOC;
1903
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1904
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1905

1906
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1907
		beacon_loss_count * bss_conf->beacon_int));
1908

1909 1910
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1911

1912 1913
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

1914
	if (sdata->vif.p2p) {
1915
		const struct cfg80211_bss_ies *ies;
1916

1917 1918 1919 1920 1921 1922 1923 1924
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
1925 1926
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
1927
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
1928 1929
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
1930 1931
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
1932
		}
1933
		rcu_read_unlock();
1934 1935
	}

J
Johannes Berg 已提交
1936
	/* just to be sure */
1937
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
1938

1939
	ieee80211_led_assoc(local, 1);
1940

1941
	if (sdata->u.mgd.have_beacon) {
1942 1943 1944 1945 1946 1947 1948
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1949
		bss_conf->beacon_rate = bss->beacon_rate;
1950
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1951
	} else {
1952
		bss_conf->beacon_rate = NULL;
1953
		bss_conf->dtim_period = 0;
1954
	}
1955

1956
	bss_conf->assoc = 1;
1957

1958
	/* Tell the driver to monitor connection quality (if supported) */
1959
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1960
	    bss_conf->cqm_rssi_thold)
1961 1962
		bss_info_changed |= BSS_CHANGED_CQM;

1963
	/* Enable ARP filtering */
1964
	if (bss_conf->arp_addr_cnt)
1965 1966
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
1967
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1968

J
Johannes Berg 已提交
1969 1970 1971
	mutex_lock(&local->iflist_mtx);
	ieee80211_recalc_ps(local, -1);
	mutex_unlock(&local->iflist_mtx);
1972

1973
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
1974 1975
	ieee80211_recalc_ps_vif(sdata);

1976
	netif_carrier_on(sdata->dev);
1977 1978
}

1979
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1980 1981
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
1982
{
1983
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1984
	struct ieee80211_local *local = sdata->local;
1985
	u32 changed = 0;
1986

1987
	sdata_assert_lock(sdata);
1988

1989 1990 1991
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
1992 1993 1994
	if (WARN_ON(!ifmgd->associated))
		return;

1995 1996
	ieee80211_stop_poll(sdata);

1997
	ifmgd->associated = NULL;
1998 1999
	netif_carrier_off(sdata->dev);

2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2011 2012 2013
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2014 2015 2016
	/* make sure ongoing transmission finishes */
	synchronize_net();

2017 2018 2019 2020 2021 2022
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2023
	if (tx)
2024
		ieee80211_flush_queues(local, sdata, true);
2025

2026 2027
	/* deauthenticate/disassociate now */
	if (tx || frame_buf)
2028 2029
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
					       reason, tx, frame_buf);
2030

2031
	/* flush out frame - make sure the deauth was actually sent */
2032
	if (tx)
2033
		ieee80211_flush_queues(local, sdata, false);
2034

2035 2036 2037
	/* clear bssid only after building the needed mgmt frames */
	memset(ifmgd->bssid, 0, ETH_ALEN);

2038
	/* remove AP and TDLS peers */
2039
	sta_info_flush(sdata);
2040 2041

	/* finally reset all BSS / config parameters */
2042 2043 2044
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2045 2046
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2047

J
Janusz Dziedzic 已提交
2048 2049 2050
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2051

2052
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2053 2054
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2055 2056
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2057

2058
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2059

2060 2061 2062
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2063
	/* Disable ARP filtering */
2064
	if (sdata->vif.bss_conf.arp_addr_cnt)
2065 2066
		changed |= BSS_CHANGED_ARP_FILTER;

2067 2068 2069
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2070 2071
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2072
	ieee80211_bss_info_change_notify(sdata, changed);
2073

2074 2075 2076
	/* disassociated - set to defaults now */
	ieee80211_set_wmm_default(sdata, false);

2077 2078 2079 2080
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2081

2082
	sdata->vif.bss_conf.dtim_period = 0;
2083 2084
	sdata->vif.bss_conf.beacon_rate = NULL;

2085
	ifmgd->have_beacon = false;
2086

2087
	ifmgd->flags = 0;
2088
	mutex_lock(&local->mtx);
2089
	ieee80211_vif_release_channel(sdata);
2090 2091

	sdata->vif.csa_active = false;
2092
	ifmgd->csa_waiting_bcn = false;
2093 2094 2095 2096 2097
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2098
	mutex_unlock(&local->mtx);
2099

2100 2101 2102 2103
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2104
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2105
}
2106

2107 2108 2109 2110 2111 2112 2113 2114
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2115 2116
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2117
	 */
J
Johannes Berg 已提交
2118 2119 2120
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2121
	ieee80211_sta_reset_conn_monitor(sdata);
2122
}
2123

2124 2125 2126
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2127
	struct ieee80211_local *local = sdata->local;
2128

2129
	mutex_lock(&local->mtx);
2130 2131
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2132

2133
	__ieee80211_stop_poll(sdata);
2134 2135 2136 2137

	mutex_lock(&local->iflist_mtx);
	ieee80211_recalc_ps(local, -1);
	mutex_unlock(&local->iflist_mtx);
2138 2139

	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
2140
		goto out;
2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2152 2153
out:
	mutex_unlock(&local->mtx);
2154 2155
}

2156 2157 2158 2159 2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u16 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2191
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2192
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2193
{
2194 2195
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2196
	if (!ieee80211_is_data(hdr->frame_control))
2197 2198 2199 2200
	    return;

	if (ieee80211_is_nullfunc(hdr->frame_control) &&
	    sdata->u.mgd.probe_send_count > 0) {
2201
		if (ack)
2202
			ieee80211_sta_reset_conn_monitor(sdata);
2203 2204
		else
			sdata->u.mgd.nullfunc_failed = true;
2205
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2206
		return;
2207
	}
2208 2209 2210

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2211 2212
}

2213 2214 2215 2216
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2217
	u8 *dst = ifmgd->associated->bssid;
2218
	u8 unicast_limit = max(1, max_probe_tries - 3);
2219 2220 2221 2222 2223 2224 2225 2226

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2227

2228 2229 2230 2231 2232 2233 2234
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2235 2236
	ifmgd->probe_send_count++;

2237 2238
	if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
		ifmgd->nullfunc_failed = false;
2239
		ieee80211_send_nullfunc(sdata->local, sdata, 0);
2240
	} else {
2241 2242
		int ssid_len;

2243
		rcu_read_lock();
2244
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2245 2246 2247 2248 2249
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2250 2251
		ieee80211_send_probe_req(sdata, sdata->vif.addr, NULL,
					 ssid + 2, ssid_len, NULL,
2252
					 0, (u32) -1, true, 0,
J
Johannes Berg 已提交
2253
					 ifmgd->associated->channel, false);
2254
		rcu_read_unlock();
2255
	}
2256

2257
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2258
	run_again(sdata, ifmgd->probe_timeout);
2259 2260
}

J
Johannes Berg 已提交
2261 2262
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2263 2264
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2265
	bool already = false;
2266

2267
	if (!ieee80211_sdata_running(sdata))
2268 2269
		return;

2270
	sdata_lock(sdata);
2271 2272 2273 2274

	if (!ifmgd->associated)
		goto out;

2275 2276 2277 2278 2279 2280 2281
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2282
	if (beacon) {
J
Johannes Berg 已提交
2283
		mlme_dbg_ratelimited(sdata,
2284 2285
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2286

2287
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2288
	}
2289

J
Johannes Berg 已提交
2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2301
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2302 2303
		already = true;

E
Eliad Peller 已提交
2304 2305
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2306 2307
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2308 2309 2310
	if (already)
		goto out;

2311 2312 2313 2314
	mutex_lock(&sdata->local->iflist_mtx);
	ieee80211_recalc_ps(sdata->local, -1);
	mutex_unlock(&sdata->local->iflist_mtx);

2315 2316
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2317
 out:
2318
	sdata_unlock(sdata);
2319 2320
}

2321 2322 2323 2324 2325
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2326
	struct cfg80211_bss *cbss;
2327 2328
	struct sk_buff *skb;
	const u8 *ssid;
2329
	int ssid_len;
2330 2331 2332 2333

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2334
	sdata_assert_lock(sdata);
2335

2336 2337 2338 2339 2340 2341 2342
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2343 2344
		return NULL;

2345
	rcu_read_lock();
2346
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2347 2348 2349 2350 2351
	if (WARN_ON_ONCE(ssid == NULL))
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2352
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2353
					(u32) -1, cbss->channel,
2354
					ssid + 2, ssid_len,
2355
					NULL, 0, true);
2356
	rcu_read_unlock();
2357 2358 2359 2360 2361

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2362
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2363
{
2364
	struct ieee80211_local *local = sdata->local;
2365
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2366
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2367

2368
	sdata_lock(sdata);
2369
	if (!ifmgd->associated) {
2370
		sdata_unlock(sdata);
2371 2372 2373
		return;
	}

2374 2375
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2376
			       true, frame_buf);
2377
	mutex_lock(&local->mtx);
2378
	sdata->vif.csa_active = false;
2379
	ifmgd->csa_waiting_bcn = false;
2380 2381 2382 2383 2384
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2385
	mutex_unlock(&local->mtx);
2386

2387 2388
	cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
			      IEEE80211_DEAUTH_FRAME_LEN);
2389
	sdata_unlock(sdata);
2390 2391
}

2392
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2393 2394 2395
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2396
			     u.mgd.beacon_connection_loss_work);
2397 2398 2399 2400
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct sta_info *sta;

	if (ifmgd->associated) {
2401
		rcu_read_lock();
2402 2403 2404
		sta = sta_info_get(sdata, ifmgd->bssid);
		if (sta)
			sta->beacon_loss_count++;
2405
		rcu_read_unlock();
2406
	}
J
Johannes Berg 已提交
2407

2408
	if (ifmgd->connection_loss) {
2409 2410
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2411
		__ieee80211_disconnect(sdata);
2412
	} else {
2413
		ieee80211_mgd_probe_ap(sdata, true);
2414 2415 2416 2417 2418 2419 2420 2421 2422
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2423
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2424 2425
}

2426 2427 2428
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2429
	struct ieee80211_hw *hw = &sdata->local->hw;
2430

J
Johannes Berg 已提交
2431 2432
	trace_api_beacon_loss(sdata);

2433
	sdata->u.mgd.connection_loss = false;
2434
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2435 2436 2437
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2438 2439 2440 2441 2442
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2443 2444
	trace_api_connection_loss(sdata);

2445
	sdata->u.mgd.connection_loss = true;
2446 2447 2448 2449 2450
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2451 2452 2453 2454 2455
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2456
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2457 2458

	if (!assoc) {
2459 2460 2461 2462 2463 2464
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2465 2466 2467 2468
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

		memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2469
		sdata->u.mgd.flags = 0;
2470
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2471
		ieee80211_vif_release_channel(sdata);
2472
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2473 2474
	}

2475
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2476 2477 2478 2479 2480 2481 2482
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2483
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2484 2485 2486
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2487
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2488 2489

	pos = mgmt->u.auth.variable;
2490
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2491 2492 2493
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
J
Johannes Berg 已提交
2494
	drv_mgd_prepare_tx(sdata->local, sdata);
2495 2496 2497
	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2498
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2499 2500 2501
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2502
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2503 2504
}

2505 2506
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2507 2508 2509 2510 2511 2512
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
	struct sta_info *sta;

2513
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2514 2515

	if (len < 24 + 6)
2516
		return;
J
Johannes Berg 已提交
2517 2518

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2519
		return;
J
Johannes Berg 已提交
2520 2521 2522

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2523
	if (!ether_addr_equal(bssid, mgmt->bssid))
2524
		return;
J
Johannes Berg 已提交
2525 2526 2527 2528 2529 2530

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2531 2532 2533 2534 2535
	    auth_transaction != ifmgd->auth_data->expected_transaction) {
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2536
		return;
2537
	}
J
Johannes Berg 已提交
2538 2539

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
2540 2541
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2542
		ieee80211_destroy_auth_data(sdata, false);
2543
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2544
		return;
J
Johannes Berg 已提交
2545 2546 2547 2548 2549 2550
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
2551
	case WLAN_AUTH_SAE:
J
Johannes Berg 已提交
2552 2553 2554 2555 2556
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
2557
			return;
J
Johannes Berg 已提交
2558 2559 2560 2561 2562
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
2563
		return;
J
Johannes Berg 已提交
2564 2565
	}

J
Johannes Berg 已提交
2566
	sdata_info(sdata, "authenticated\n");
J
Johannes Berg 已提交
2567 2568
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2569
	ifmgd->auth_data->timeout_started = true;
2570
	run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
2571

2572 2573 2574 2575 2576 2577
	if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
	    ifmgd->auth_data->expected_transaction != 2) {
		/*
		 * Report auth frame to user space for processing since another
		 * round of Authentication frames is still needed.
		 */
2578
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2579
		return;
2580 2581
	}

J
Johannes Berg 已提交
2582 2583 2584 2585 2586 2587 2588 2589
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
		goto out_err;
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
J
Johannes Berg 已提交
2590
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
J
Johannes Berg 已提交
2591 2592 2593 2594
		goto out_err;
	}
	mutex_unlock(&sdata->local->sta_mtx);

2595
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2596
	return;
J
Johannes Berg 已提交
2597 2598 2599 2600 2601
 out_err:
	mutex_unlock(&sdata->local->sta_mtx);
	/* ignore frame -- wait for timeout */
}

2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

static const char *ieee80211_get_reason_code_string(u16 reason_code)
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
2658

2659 2660
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
2661
{
2662
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2663
	const u8 *bssid = NULL;
2664 2665
	u16 reason_code;

2666
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2667

2668
	if (len < 24 + 2)
2669
		return;
2670

J
Johannes Berg 已提交
2671
	if (!ifmgd->associated ||
2672
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2673
		return;
2674

2675
	bssid = ifmgd->associated->bssid;
2676 2677 2678

	reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);

2679 2680
	sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
		   bssid, reason_code, ieee80211_get_reason_code_string(reason_code));
2681

2682 2683
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

2684
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2685 2686 2687
}


2688 2689
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
2690
{
2691
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2692 2693
	u16 reason_code;

2694
	sdata_assert_lock(sdata);
2695

J
Johannes Berg 已提交
2696
	if (len < 24 + 2)
2697
		return;
2698

J
Johannes Berg 已提交
2699
	if (!ifmgd->associated ||
2700
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2701
		return;
2702 2703 2704

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

J
Johannes Berg 已提交
2705 2706
	sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
		   mgmt->sa, reason_code);
2707

2708 2709
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

2710
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2711 2712
}

2713 2714 2715 2716
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
2717 2718
				int *min_rate, int *min_rate_index,
				int shift, u32 rate_flags)
2719 2720 2721 2722
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
2723
		int rate = supp_rates[i] & 0x7f;
2724 2725
		bool is_basic = !!(supp_rates[i] & 0x80);

2726
		if ((rate * 5 * (1 << shift)) > 110)
2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741
			*have_higher_than_11mbit = true;

		/*
		 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
		 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
		 *
		 * Note: Even through the membership selector and the basic
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
		if (!!(supp_rates[i] & 0x80) &&
		    (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
2742 2743 2744 2745 2746 2747 2748 2749 2750
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];
			if ((rate_flags & br->flags) != rate_flags)
				continue;

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
2751 2752 2753
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
2754 2755
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
2756 2757 2758 2759 2760 2761 2762
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
2763

J
Johannes Berg 已提交
2764 2765 2766 2767 2768
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
					 bool assoc)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

2769
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2770 2771

	if (!assoc) {
2772 2773 2774 2775 2776 2777
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2778 2779 2780 2781
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2782
		sdata->u.mgd.flags = 0;
2783
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2784
		ieee80211_vif_release_channel(sdata);
2785
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2786 2787 2788 2789 2790 2791 2792 2793
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2794
				    struct ieee80211_mgmt *mgmt, size_t len)
2795
{
2796
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2797
	struct ieee80211_local *local = sdata->local;
2798
	struct ieee80211_supported_band *sband;
2799
	struct sta_info *sta;
J
Johannes Berg 已提交
2800 2801
	u8 *pos;
	u16 capab_info, aid;
2802
	struct ieee802_11_elems elems;
J
Johannes Berg 已提交
2803
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2804 2805
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
J
Johannes Berg 已提交
2806
	u32 changed = 0;
2807
	int err;
2808
	bool ret;
2809

J
Johannes Berg 已提交
2810
	/* AssocResp and ReassocResp have identical structure */
2811 2812

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
2813
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2814

2815
	if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
J
Johannes Berg 已提交
2816 2817
		sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
			   aid);
2818 2819
	aid &= ~(BIT(15) | BIT(14));

2820 2821 2822
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
2823 2824
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
2825 2826 2827 2828
		aid = 0;
		ifmgd->broken_ap = true;
	}

J
Johannes Berg 已提交
2829
	pos = mgmt->u.assoc_resp.variable;
2830
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2831

2832
	if (!elems.supp_rates) {
J
Johannes Berg 已提交
2833
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
2834
		return false;
2835 2836
	}

2837
	ifmgd->aid = aid;
2838 2839 2840
	ifmgd->tdls_chan_switch_prohibited =
		elems.ext_capab && elems.ext_capab_len >= 5 &&
		(elems.ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
2841

2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864 2865 2866 2867 2868 2869 2870 2871 2872 2873 2874 2875 2876 2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
	if ((assoc_data->wmm && !elems.wmm_param) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	     (!elems.ht_cap_elem || !elems.ht_operation)) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	     (!elems.vht_cap_elem || !elems.vht_operation))) {
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
				       false, &bss_elems);
		if (assoc_data->wmm &&
		    !elems.wmm_param && bss_elems.wmm_param) {
			elems.wmm_param = bss_elems.wmm_param;
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
		if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_cap_elem = bss_elems.ht_cap_elem;
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
		if (!elems.ht_operation && bss_elems.ht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_operation = bss_elems.ht_operation;
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
		if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_cap_elem = bss_elems.vht_cap_elem;
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
		if (!elems.vht_operation && bss_elems.vht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_operation = bss_elems.vht_operation;
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

2905 2906 2907 2908 2909 2910 2911
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
		sdata_info(sdata,
2912 2913 2914
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
2915 2916 2917 2918 2919
	}

	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    (!elems.vht_cap_elem || !elems.vht_operation)) {
		sdata_info(sdata,
2920 2921 2922
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
2923 2924
	}

2925 2926 2927 2928 2929
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
2930
	sta = sta_info_get(sdata, cbss->bssid);
2931 2932
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
2933 2934
		ret = false;
		goto out;
2935
	}
2936

J
Johannes Berg 已提交
2937
	sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2938

2939
	/* Set up internal HT/VHT capabilities */
2940
	if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
2941
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2942
						  elems.ht_cap_elem, sta);
2943

M
Mahesh Palivela 已提交
2944 2945
	if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2946
						    elems.vht_cap_elem, sta);
M
Mahesh Palivela 已提交
2947

2948 2949 2950 2951 2952 2953
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
2954

2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968 2969
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
	if (elems.opmode_notif &&
	    !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
		u8 nss;

		nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

2970
	rate_control_rate_init(sta);
2971

2972
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
J
Johannes Berg 已提交
2973
		set_sta_flag(sta, WLAN_STA_MFP);
2974

2975
	sta->sta.wme = elems.wmm_param;
2976

2977
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
2978 2979 2980
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
2981 2982 2983
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
2984 2985
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
2986 2987
		ret = false;
		goto out;
2988 2989
	}

2990
	mutex_unlock(&sdata->local->sta_mtx);
2991

2992 2993 2994 2995 2996 2997 2998 2999
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;

3000
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) && elems.wmm_param)
3001
		ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
J
Johannes Berg 已提交
3002
					 elems.wmm_param_len);
3003
	else
3004 3005
		ieee80211_set_wmm_default(sdata, false);
	changed |= BSS_CHANGED_QOS;
3006

J
Johannes Berg 已提交
3007 3008 3009 3010
	/* set AID and assoc capability,
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->aid = aid;
	bss_conf->assoc_capability = capab_info;
3011
	ieee80211_set_associated(sdata, cbss, changed);
3012

3013 3014 3015 3016 3017 3018 3019
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3020
	/*
J
Johannes Berg 已提交
3021 3022
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3023
	 */
J
Johannes Berg 已提交
3024
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3025
	ieee80211_sta_reset_beacon_monitor(sdata);
3026

3027 3028 3029 3030
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3031 3032
}

3033 3034 3035
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3036 3037 3038 3039 3040
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3041
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3042 3043
	u8 *pos;
	bool reassoc;
3044
	struct cfg80211_bss *bss;
J
Johannes Berg 已提交
3045

3046
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3047 3048

	if (!assoc_data)
3049
		return;
3050
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3051
		return;
J
Johannes Berg 已提交
3052 3053 3054 3055 3056 3057 3058

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3059
		return;
J
Johannes Berg 已提交
3060 3061 3062 3063 3064 3065

	reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3066 3067 3068 3069
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3070 3071

	pos = mgmt->u.assoc_resp.variable;
3072
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
3073 3074

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3075 3076
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3077
		u32 tu, ms;
3078
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3079
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3080 3081 3082
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3083
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3084
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3085
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3086 3087
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3088 3089
	}

3090
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3091 3092

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3093 3094
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
J
Johannes Berg 已提交
3095 3096
		ieee80211_destroy_assoc_data(sdata, false);
	} else {
3097
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
J
Johannes Berg 已提交
3098
			/* oops -- internal error -- send timeout for now */
3099
			ieee80211_destroy_assoc_data(sdata, false);
3100
			cfg80211_assoc_timeout(sdata->dev, bss);
3101
			return;
J
Johannes Berg 已提交
3102
		}
3103
		sdata_info(sdata, "associated\n");
3104 3105 3106 3107 3108 3109 3110

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
		ieee80211_destroy_assoc_data(sdata, true);
3111 3112 3113 3114 3115 3116

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
				uapsd_queues |= BIT(ac);
J
Johannes Berg 已提交
3117 3118
	}

3119
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues);
J
Johannes Berg 已提交
3120
}
J
Johannes Berg 已提交
3121

3122
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3123
				  struct ieee80211_mgmt *mgmt, size_t len,
3124
				  struct ieee80211_rx_status *rx_status,
3125
				  struct ieee802_11_elems *elems)
3126 3127
{
	struct ieee80211_local *local = sdata->local;
3128
	struct ieee80211_bss *bss;
3129
	struct ieee80211_channel *channel;
3130

3131
	sdata_assert_lock(sdata);
3132

3133 3134
	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
	if (!channel)
3135 3136 3137
		return;

	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
3138
					channel);
3139 3140
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3141
		ieee80211_rx_bss_put(local, bss);
3142
	}
3143 3144 3145
}


3146
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3147
					 struct sk_buff *skb)
3148
{
J
Johannes Berg 已提交
3149
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3150
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3151 3152
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
	size_t baselen, len = skb->len;
3153 3154
	struct ieee802_11_elems elems;

3155 3156
	ifmgd = &sdata->u.mgd;

3157
	sdata_assert_lock(sdata);
3158

3159
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
3160 3161
		return; /* ignore ProbeResp to foreign address */

3162 3163 3164 3165 3166
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
3167
			       false, &elems);
3168

3169
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3170

3171
	if (ifmgd->associated &&
3172
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3173
		ieee80211_reset_ap_probe(sdata);
J
Johannes Berg 已提交
3174 3175

	if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
3176
	    ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
J
Johannes Berg 已提交
3177
		/* got probe response, continue with auth */
J
Johannes Berg 已提交
3178
		sdata_info(sdata, "direct probe responded\n");
J
Johannes Berg 已提交
3179 3180
		ifmgd->auth_data->tries = 0;
		ifmgd->auth_data->timeout = jiffies;
3181
		ifmgd->auth_data->timeout_started = true;
3182
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
3183
	}
3184 3185
}

3186 3187 3188
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3189 3190 3191
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3192 3193 3194 3195 3196 3197 3198 3199 3200 3201
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3202 3203 3204 3205 3206
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3207
	(1ULL << WLAN_EID_HT_OPERATION);
3208

3209 3210 3211
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
3212
{
3213
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3214
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3215 3216
	size_t baselen;
	struct ieee802_11_elems elems;
3217
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
3218 3219
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
3220
	struct sta_info *sta;
3221
	u32 changed = 0;
3222
	bool erp_valid;
J
Johannes Berg 已提交
3223
	u8 erp_value = 0;
3224
	u32 ncrc;
3225
	u8 *bssid;
3226
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
3227

3228
	sdata_assert_lock(sdata);
3229

3230 3231 3232
	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
3233
		return;
3234

J
Johannes Berg 已提交
3235 3236 3237 3238
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
3239
		return;
J
Johannes Berg 已提交
3240 3241
	}

3242
	if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
J
Johannes Berg 已提交
3243
		rcu_read_unlock();
3244
		return;
J
Johannes Berg 已提交
3245
	}
3246
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
3247
	rcu_read_unlock();
3248

3249
	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
3250
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
J
Johannes Berg 已提交
3251
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3252
				       len - baselen, false, &elems);
3253

3254
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3255 3256 3257 3258
		if (elems.tim && !elems.parse_error) {
			const struct ieee80211_tim_ie *tim_ie = elems.tim;
			ifmgd->dtim_period = tim_ie->dtim_period;
		}
3259
		ifmgd->have_beacon = true;
3260
		ifmgd->assoc_data->need_beacon = false;
3261 3262 3263 3264 3265 3266 3267 3268 3269 3270 3271
		if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
			if (elems.tim)
				sdata->vif.bss_conf.sync_dtim_count =
					elems.tim->dtim_count;
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
3272 3273
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
3274
		ifmgd->assoc_data->timeout_started = true;
3275 3276
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3277
	}
3278

J
Johannes Berg 已提交
3279
	if (!ifmgd->associated ||
3280
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3281
		return;
J
Johannes Berg 已提交
3282
	bssid = ifmgd->associated->bssid;
3283

3284 3285 3286 3287
	/* Track average RSSI from the Beacon frames of the current AP */
	ifmgd->last_beacon_signal = rx_status->signal;
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3288
		ifmgd->ave_beacon_signal = rx_status->signal * 16;
3289
		ifmgd->last_cqm_event_signal = 0;
3290
		ifmgd->count_beacon_signal = 1;
3291
		ifmgd->last_ave_beacon_signal = 0;
3292 3293 3294 3295 3296
	} else {
		ifmgd->ave_beacon_signal =
			(IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
			 (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
			 ifmgd->ave_beacon_signal) / 16;
3297
		ifmgd->count_beacon_signal++;
3298
	}
3299 3300 3301 3302 3303 3304 3305 3306 3307 3308 3309 3310 3311

	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
		int sig = ifmgd->ave_beacon_signal;
		int last_sig = ifmgd->last_ave_beacon_signal;

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3312
			drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
3313 3314 3315 3316
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3317
			drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
3318 3319 3320
		}
	}

3321
	if (bss_conf->cqm_rssi_thold &&
3322
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3323
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3324 3325 3326 3327 3328 3329 3330 3331 3332 3333 3334 3335 3336 3337 3338 3339 3340 3341 3342 3343 3344
		int sig = ifmgd->ave_beacon_signal / 16;
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				GFP_KERNEL);
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				GFP_KERNEL);
		}
	}

3345
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3346
		mlme_dbg_ratelimited(sdata,
3347
				     "cancelling AP probe due to a received beacon\n");
3348
		ieee80211_reset_ap_probe(sdata);
3349 3350
	}

J
Johannes Berg 已提交
3351 3352 3353 3354
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
3355
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
3356

3357 3358
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3359
					  len - baselen, false, &elems,
3360 3361
					  care_about_ies, ncrc);

3362
	if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
3363 3364 3365
		bool directed_tim = ieee80211_check_tim(elems.tim,
							elems.tim_len,
							ifmgd->aid);
3366
		if (directed_tim) {
3367
			if (local->hw.conf.dynamic_ps_timeout > 0) {
3368 3369 3370 3371 3372
				if (local->hw.conf.flags & IEEE80211_CONF_PS) {
					local->hw.conf.flags &= ~IEEE80211_CONF_PS;
					ieee80211_hw_config(local,
							    IEEE80211_CONF_CHANGE_PS);
				}
3373
				ieee80211_send_nullfunc(local, sdata, 0);
3374
			} else if (!local->pspolling && sdata->u.mgd.powersave) {
3375 3376 3377 3378 3379 3380 3381 3382 3383 3384 3385 3386
				local->pspolling = true;

				/*
				 * Here is assumed that the driver will be
				 * able to send ps-poll frame and receive a
				 * response even though power save mode is
				 * enabled, but some drivers might require
				 * to disable power save here. This needs
				 * to be investigated.
				 */
				ieee80211_send_pspoll(local, sdata);
			}
3387 3388
		}
	}
J
Johannes Berg 已提交
3389

3390
	if (sdata->vif.p2p) {
J
Janusz Dziedzic 已提交
3391
		struct ieee80211_p2p_noa_attr noa = {};
3392 3393 3394 3395 3396
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3397
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
3398 3399 3400 3401 3402 3403 3404 3405 3406 3407 3408 3409 3410 3411 3412 3413
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3414 3415 3416 3417 3418
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

3419 3420 3421
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

3422 3423 3424 3425 3426 3427 3428 3429 3430 3431 3432 3433 3434 3435 3436 3437 3438 3439 3440 3441
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
	if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
		if (elems.tim)
			sdata->vif.bss_conf.sync_dtim_count =
				elems.tim->dtim_count;
		else
			sdata->vif.bss_conf.sync_dtim_count = 0;
	}

3442
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3443
		return;
3444
	ifmgd->beacon_crc = ncrc;
3445
	ifmgd->beacon_crc_valid = true;
3446

3447
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3448

3449
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
3450
					 rx_status->device_timestamp,
3451 3452
					 &elems, true);

3453 3454
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3455 3456 3457
				     elems.wmm_param_len))
		changed |= BSS_CHANGED_QOS;

3458 3459
	/*
	 * If we haven't had a beacon before, tell the driver about the
3460
	 * DTIM period (and beacon timing if desired) now.
3461
	 */
3462
	if (!ifmgd->have_beacon) {
3463 3464 3465 3466 3467
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
		if (elems.tim)
			bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
		else
			bss_conf->dtim_period = 1;
3468

3469 3470
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
3471 3472 3473 3474 3475

		mutex_lock(&local->iflist_mtx);
		ieee80211_recalc_ps(local, -1);
		mutex_unlock(&local->iflist_mtx);

3476
		ieee80211_recalc_ps_vif(sdata);
3477 3478
	}

3479
	if (elems.erp_info) {
J
Johannes Berg 已提交
3480 3481 3482 3483
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
3484
	}
J
Johannes Berg 已提交
3485 3486 3487
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
3488

3489
	mutex_lock(&local->sta_mtx);
3490 3491
	sta = sta_info_get(sdata, bssid);

3492 3493
	if (ieee80211_config_bw(sdata, sta,
				elems.ht_cap_elem, elems.ht_operation,
3494 3495 3496 3497 3498
				elems.vht_operation, bssid, &changed)) {
		mutex_unlock(&local->sta_mtx);
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
3499 3500
		cfg80211_tx_mlme_mgmt(sdata->dev, deauth_buf,
				      sizeof(deauth_buf));
3501
		return;
3502
	}
3503 3504 3505 3506

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
					    rx_status->band, true);
3507
	mutex_unlock(&local->sta_mtx);
3508

3509 3510 3511
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
3512 3513
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
3514

3515
	ieee80211_bss_info_change_notify(sdata, changed);
3516 3517
}

3518 3519
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
3520 3521 3522 3523
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
3524 3525
	struct ieee802_11_elems elems;
	int ies_len;
3526 3527 3528 3529 3530

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

3531
	sdata_lock(sdata);
3532

J
Johannes Berg 已提交
3533 3534
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
3535
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
3536 3537 3538 3539 3540
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
3541
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3542 3543
		break;
	case IEEE80211_STYPE_DEAUTH:
3544
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3545 3546
		break;
	case IEEE80211_STYPE_DISASSOC:
3547
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3548 3549 3550
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
3551
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3552 3553
		break;
	case IEEE80211_STYPE_ACTION:
3554
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3555 3556 3557
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
3558 3559 3560 3561 3562 3563

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
3564
				ies_len, true, &elems);
3565 3566 3567 3568

			if (elems.parse_error)
				break;

3569
			ieee80211_sta_process_chanswitch(sdata,
3570 3571 3572
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3573 3574 3575 3576 3577 3578 3579 3580 3581 3582
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
3583
				ies_len, true, &elems);
3584 3585 3586 3587 3588 3589 3590 3591

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
3592
			ieee80211_sta_process_chanswitch(sdata,
3593 3594 3595
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3596
		}
3597
		break;
3598
	}
3599
	sdata_unlock(sdata);
3600 3601
}

J
Johannes Berg 已提交
3602
static void ieee80211_sta_timer(unsigned long data)
3603
{
J
Johannes Berg 已提交
3604 3605
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
3606

3607
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3608 3609
}

3610
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3611
					  u8 *bssid, u8 reason, bool tx)
3612
{
3613
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3614

3615
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3616
			       tx, frame_buf);
3617

3618 3619
	cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
			      IEEE80211_DEAUTH_FRAME_LEN);
3620 3621
}

J
Johannes Berg 已提交
3622 3623 3624 3625 3626
static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3627
	u32 tx_flags = 0;
J
Johannes Berg 已提交
3628

3629
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3630 3631 3632 3633 3634 3635 3636

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
3637 3638
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
3639 3640 3641 3642 3643 3644 3645 3646 3647 3648

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3649 3650
	drv_mgd_prepare_tx(local, sdata);

J
Johannes Berg 已提交
3651
	if (auth_data->bss->proberesp_ies) {
3652 3653 3654
		u16 trans = 1;
		u16 status = 0;

J
Johannes Berg 已提交
3655 3656 3657
		sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
			   auth_data->bss->bssid, auth_data->tries,
			   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
3658 3659

		auth_data->expected_transaction = 2;
3660 3661 3662 3663 3664 3665 3666

		if (auth_data->algorithm == WLAN_AUTH_SAE) {
			trans = auth_data->sae_trans;
			status = auth_data->sae_status;
			auth_data->expected_transaction = trans;
		}

3667 3668 3669 3670
		if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
			tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
				   IEEE80211_TX_INTFL_MLME_CONN_TX;

3671 3672
		ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
				    auth_data->data, auth_data->data_len,
J
Johannes Berg 已提交
3673
				    auth_data->bss->bssid,
3674 3675
				    auth_data->bss->bssid, NULL, 0, 0,
				    tx_flags);
J
Johannes Berg 已提交
3676 3677 3678
	} else {
		const u8 *ssidie;

J
Johannes Berg 已提交
3679 3680 3681
		sdata_info(sdata, "direct probe to %pM (try %d/%i)\n",
			   auth_data->bss->bssid, auth_data->tries,
			   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
3682

3683
		rcu_read_lock();
J
Johannes Berg 已提交
3684
		ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
3685 3686
		if (!ssidie) {
			rcu_read_unlock();
J
Johannes Berg 已提交
3687
			return -EINVAL;
3688
		}
J
Johannes Berg 已提交
3689 3690 3691 3692
		/*
		 * Direct probe is sent to broadcast address as some APs
		 * will not answer to direct packet in unassociated state.
		 */
3693 3694
		ieee80211_send_probe_req(sdata, sdata->vif.addr, NULL,
					 ssidie + 2, ssidie[1],
3695
					 NULL, 0, (u32) -1, true, 0,
J
Johannes Berg 已提交
3696
					 auth_data->bss->channel, false);
3697
		rcu_read_unlock();
J
Johannes Berg 已提交
3698 3699
	}

3700
	if (tx_flags == 0) {
3701
		auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3702
		auth_data->timeout_started = true;
3703
		run_again(sdata, auth_data->timeout);
3704
	} else {
3705 3706 3707 3708
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
		auth_data->timeout_started = true;
		run_again(sdata, auth_data->timeout);
3709
	}
J
Johannes Berg 已提交
3710 3711 3712 3713 3714 3715 3716 3717 3718

	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

3719
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3720 3721 3722

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
3723 3724
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
3725 3726 3727 3728 3729 3730 3731 3732 3733 3734

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3735 3736 3737
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
3738 3739
	ieee80211_send_assoc(sdata);

3740 3741
	if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3742
		assoc_data->timeout_started = true;
3743
		run_again(sdata, assoc_data->timeout);
3744
	} else {
3745 3746 3747 3748 3749
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
3750
	}
J
Johannes Berg 已提交
3751 3752 3753 3754

	return 0;
}

3755 3756 3757 3758 3759 3760 3761 3762 3763 3764 3765 3766
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

3767
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
3768 3769
{
	struct ieee80211_local *local = sdata->local;
3770
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3771

3772
	sdata_lock(sdata);
3773

3774 3775 3776 3777 3778 3779 3780 3781 3782 3783
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
		if (ifmgd->auth_data &&
		    (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
			if (status_acked) {
				ifmgd->auth_data->timeout =
					jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3784
				run_again(sdata, ifmgd->auth_data->timeout);
3785 3786 3787
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
3788
			ifmgd->auth_data->timeout_started = true;
3789 3790 3791 3792 3793 3794
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3795
				run_again(sdata, ifmgd->assoc_data->timeout);
3796 3797 3798
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
3799
			ifmgd->assoc_data->timeout_started = true;
3800 3801 3802
		}
	}

3803
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
3804 3805 3806 3807 3808 3809 3810 3811 3812 3813 3814 3815 3816 3817
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
		} else if (ieee80211_probe_auth(sdata)) {
			u8 bssid[ETH_ALEN];

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

3818
			cfg80211_auth_timeout(sdata->dev, bssid);
J
Johannes Berg 已提交
3819
		}
3820
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3821
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
3822

3823
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
3824
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
3825
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
3826
		    ieee80211_do_assoc(sdata)) {
3827
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
J
Johannes Berg 已提交
3828 3829

			ieee80211_destroy_assoc_data(sdata, false);
3830
			cfg80211_assoc_timeout(sdata->dev, bss);
J
Johannes Berg 已提交
3831
		}
3832
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3833
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
3834

3835
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
3836
	    ifmgd->associated) {
3837
		u8 bssid[ETH_ALEN];
3838
		int max_tries;
3839

3840
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3841

3842
		if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3843
			max_tries = max_nullfunc_tries;
3844
		else
3845
			max_tries = max_probe_tries;
3846

3847 3848 3849
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
3850 3851
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3852 3853 3854 3855
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
3856 3857
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
3858 3859 3860
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
3861
				ieee80211_sta_connection_lost(sdata, bssid,
3862 3863
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
3864 3865
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
3866
			run_again(sdata, ifmgd->probe_timeout);
3867
		else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
J
Johannes Berg 已提交
3868 3869 3870
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
3871
			ieee80211_sta_connection_lost(sdata, bssid,
3872
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3873
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3874 3875 3876 3877
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
3878 3879
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
3880 3881 3882 3883
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
3884 3885 3886 3887
			wiphy_debug(local->hw.wiphy,
				    "%s: No probe response from AP %pM"
				    " after %dms, disconnecting.\n",
				    sdata->name,
3888
				    bssid, probe_wait_ms);
3889

3890
			ieee80211_sta_connection_lost(sdata, bssid,
3891
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
3892 3893 3894
		}
	}

3895
	sdata_unlock(sdata);
3896 3897
}

J
Johannes Berg 已提交
3898 3899 3900 3901 3902
static void ieee80211_sta_bcn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
	struct ieee80211_local *local = sdata->local;
3903
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3904 3905 3906 3907

	if (local->quiescing)
		return;

3908
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3909 3910
		return;

3911
	sdata->u.mgd.connection_loss = false;
3912 3913
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925
}

static void ieee80211_sta_conn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

	if (local->quiescing)
		return;

3926
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3927 3928
		return;

3929
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
3941 3942
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
3943 3944
	u32 flags;

3945
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3946
		__ieee80211_stop_poll(sdata);
3947

J
Johannes Berg 已提交
3948
		/* let's probe the connection once */
3949 3950 3951 3952
		flags = sdata->local->hw.flags;
		if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
J
Johannes Berg 已提交
3953
		/* and do all the other regular work too */
J
Johannes Berg 已提交
3954
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3955
	}
J
Johannes Berg 已提交
3956
}
3957

3958
#ifdef CONFIG_PM
3959 3960 3961 3962 3963 3964 3965
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

3966 3967 3968 3969 3970
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

3971
		/*
3972 3973 3974
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
3975
		 */
3976
		ieee80211_send_deauth_disassoc(sdata, bssid,
3977 3978 3979
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
3980 3981 3982 3983
		if (ifmgd->assoc_data)
			ieee80211_destroy_assoc_data(sdata, false);
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
3984 3985 3986 3987 3988 3989 3990
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

	sdata_unlock(sdata);
}

3991 3992 3993 3994
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

3995
	sdata_lock(sdata);
3996
	if (!ifmgd->associated) {
3997
		sdata_unlock(sdata);
3998 3999 4000 4001 4002 4003 4004 4005 4006 4007
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4008
		sdata_unlock(sdata);
4009 4010
		return;
	}
4011
	sdata_unlock(sdata);
4012 4013 4014
}
#endif

J
Johannes Berg 已提交
4015 4016
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4017
{
4018
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4019

4020
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4021
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4022
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4023 4024
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4025 4026
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4027
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4028 4029
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4030
	setup_timer(&ifmgd->timer, ieee80211_sta_timer,
S
Sujith 已提交
4031
		    (unsigned long) sdata);
J
Johannes Berg 已提交
4032 4033 4034 4035
	setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
		    (unsigned long) sdata);
	setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
		    (unsigned long) sdata);
4036
	setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
J
Johannes Berg 已提交
4037
		    (unsigned long) sdata);
4038 4039
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4040

4041
	ifmgd->flags = 0;
4042
	ifmgd->powersave = sdata->wdev.ps;
4043 4044
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4045
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4046

4047
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4048 4049 4050
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4051 4052 4053 4054 4055

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4056 4057
}

4058 4059
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4060
{
4061
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4062

4063 4064
	/* Restart STA timers */
	rcu_read_lock();
4065 4066 4067 4068
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4069 4070
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4071

4072 4073 4074 4075 4076 4077 4078
int ieee80211_max_network_latency(struct notifier_block *nb,
				  unsigned long data, void *dummy)
{
	s32 latency_usec = (s32) data;
	struct ieee80211_local *local =
		container_of(nb, struct ieee80211_local,
			     network_latency_notifier);
4079

4080 4081 4082
	mutex_lock(&local->iflist_mtx);
	ieee80211_recalc_ps(local, latency_usec);
	mutex_unlock(&local->iflist_mtx);
4083

4084
	return NOTIFY_OK;
J
Johannes Berg 已提交
4085 4086
}

J
Johannes Berg 已提交
4087 4088 4089 4090 4091 4092 4093 4094 4095 4096 4097 4098
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4099
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4100 4101 4102 4103 4104 4105 4106 4107 4108 4109 4110 4111
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4112
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4113 4114 4115 4116 4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

4131 4132
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4133 4134 4135
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4136
	const struct ieee80211_ht_cap *ht_cap = NULL;
4137
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4138
	const struct ieee80211_vht_operation *vht_oper = NULL;
4139
	struct ieee80211_supported_band *sband;
4140
	struct cfg80211_chan_def chandef;
J
Johannes Berg 已提交
4141
	int ret;
4142

4143 4144
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4145 4146 4147 4148
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4149 4150
	rcu_read_lock();

J
Johannes Berg 已提交
4151 4152
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    sband->ht_cap.ht_supported) {
4153
		const u8 *ht_oper_ie, *ht_cap_ie;
4154

4155
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4156 4157
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4158

4159 4160 4161 4162 4163
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4164 4165 4166
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4167 4168
	}

J
Johannes Berg 已提交
4169 4170
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    sband->vht_cap.vht_supported) {
4171
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4172

4173 4174
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4175 4176 4177 4178
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4179
			sdata_info(sdata,
J
Johannes Berg 已提交
4180
				   "AP advertised VHT without HT, disabling both\n");
4181 4182
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4183
		}
4184 4185 4186 4187 4188 4189

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4190 4191
	}

J
Johannes Berg 已提交
4192 4193
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
4194
						     ht_cap, ht_oper, vht_oper,
4195
						     &chandef, false);
4196

J
Johannes Berg 已提交
4197 4198
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4199

4200 4201
	rcu_read_unlock();

4202 4203 4204
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4205
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4206 4207 4208 4209 4210 4211 4212
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4213 4214 4215 4216

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4217
		goto out;
4218

4219
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4220
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4221 4222 4223
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4224 4225
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4226
	return ret;
4227 4228 4229 4230 4231 4232 4233 4234 4235
}

static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss, bool assoc)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
4236 4237 4238
	struct ieee80211_supported_band *sband;
	struct ieee80211_sta_ht_cap sta_ht_cap;
	bool have_sta = false, is_override = false;
4239 4240
	int err;

4241 4242
	sband = local->hw.wiphy->bands[cbss->channel->band];

4243 4244 4245 4246 4247 4248 4249 4250 4251 4252 4253 4254 4255 4256
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
4257 4258 4259 4260 4261 4262 4263 4264 4265 4266 4267 4268 4269 4270 4271 4272 4273

	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

	is_override = (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) !=
		      (sband->ht_cap.cap &
		       IEEE80211_HT_CAP_SUP_WIDTH_20_40);

	if (new_sta || is_override) {
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

J
Johannes Berg 已提交
4274
	if (new_sta) {
4275 4276 4277
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
4278
		struct ieee80211_chanctx_conf *chanctx_conf;
J
Johannes Berg 已提交
4279
		const struct cfg80211_bss_ies *ies;
4280
		int shift = ieee80211_vif_get_shift(&sdata->vif);
4281
		u32 rate_flags;
4282

4283 4284 4285 4286
		rcu_read_lock();
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
		if (WARN_ON(!chanctx_conf)) {
			rcu_read_unlock();
E
Eytan Lifshitz 已提交
4287
			sta_info_free(local, new_sta);
4288 4289 4290 4291
			return -EINVAL;
		}
		rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
		rcu_read_unlock();
4292 4293 4294 4295 4296

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
4297 4298
				    &min_rate, &min_rate_index,
				    shift, rate_flags);
4299 4300 4301 4302 4303 4304 4305 4306 4307 4308

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
		 */
		if (!basic_rates && min_rate_index >= 0) {
J
Johannes Berg 已提交
4309 4310
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
4311 4312 4313
			basic_rates = BIT(min_rate_index);
		}

J
Johannes Berg 已提交
4314
		new_sta->sta.supp_rates[cbss->channel->band] = rates;
4315 4316 4317
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
J
Johannes Berg 已提交
4318
		if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
4319 4320 4321 4322 4323 4324 4325
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

4326 4327
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
4328
		rcu_read_lock();
4329 4330 4331 4332 4333 4334 4335 4336 4337 4338 4339 4340 4341 4342 4343 4344 4345 4346 4347 4348 4349 4350 4351 4352 4353 4354
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			const u8 *tim_ie;

			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						  ies->data, ies->len);
			if (tim_ie && tim_ie[1] >= 2)
				sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
		} else if (!(local->hw.flags &
					IEEE80211_HW_TIMING_BEACON_ONLY)) {
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
4355
		rcu_read_unlock();
4356 4357

		/* tell driver about BSSID, basic rates and timing */
4358
		ieee80211_bss_info_change_notify(sdata,
4359 4360
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
4361 4362

		if (assoc)
J
Johannes Berg 已提交
4363
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
4364

J
Johannes Berg 已提交
4365 4366
		err = sta_info_insert(new_sta);
		new_sta = NULL;
4367
		if (err) {
J
Johannes Berg 已提交
4368 4369 4370
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
4371 4372 4373
			return err;
		}
	} else
4374
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4375 4376 4377 4378

	return 0;
}

4379 4380 4381
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
4382
{
J
Johannes Berg 已提交
4383 4384 4385
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
4386
	u16 auth_alg;
J
Johannes Berg 已提交
4387 4388 4389
	int err;

	/* prepare auth data structure */
J
Johannes Berg 已提交
4390

4391 4392 4393 4394 4395
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
J
Johannes Berg 已提交
4396
		if (IS_ERR(local->wep_tx_tfm))
4397
			return -EOPNOTSUPP;
4398 4399 4400 4401 4402 4403 4404 4405
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
4406 4407 4408
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
4409 4410
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4411
	}
4412

4413 4414
	auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
4415
	if (!auth_data)
J
Johannes Berg 已提交
4416
		return -ENOMEM;
4417

J
Johannes Berg 已提交
4418
	auth_data->bss = req->bss;
4419

4420 4421 4422 4423 4424 4425 4426 4427 4428
	if (req->sae_data_len >= 4) {
		__le16 *pos = (__le16 *) req->sae_data;
		auth_data->sae_trans = le16_to_cpu(pos[0]);
		auth_data->sae_status = le16_to_cpu(pos[1]);
		memcpy(auth_data->data, req->sae_data + 4,
		       req->sae_data_len - 4);
		auth_data->data_len += req->sae_data_len - 4;
	}

4429
	if (req->ie && req->ie_len) {
4430 4431 4432
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
4433
	}
4434

J
Johannes Berg 已提交
4435
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
4436 4437 4438
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
4439 4440
	}

J
Johannes Berg 已提交
4441
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
4442

J
Johannes Berg 已提交
4443
	/* try to authenticate/probe */
4444

J
Johannes Berg 已提交
4445 4446 4447 4448
	if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
	    ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
4449 4450
	}

J
Johannes Berg 已提交
4451 4452
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
4453

J
Johannes Berg 已提交
4454 4455
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
4456

4457 4458 4459 4460 4461 4462 4463
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4464 4465
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      sizeof(frame_buf));
4466
	}
J
Johannes Berg 已提交
4467

J
Johannes Berg 已提交
4468
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4469

4470 4471
	err = ieee80211_prep_connection(sdata, req->bss, false);
	if (err)
J
Johannes Berg 已提交
4472
		goto err_clear;
J
Johannes Berg 已提交
4473

J
Johannes Berg 已提交
4474 4475 4476 4477 4478 4479 4480
	err = ieee80211_probe_auth(sdata);
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
4481
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4482
	return 0;
J
Johannes Berg 已提交
4483 4484

 err_clear:
4485 4486
	memset(ifmgd->bssid, 0, ETH_ALEN);
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4487 4488 4489 4490
	ifmgd->auth_data = NULL;
 err_free:
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
4491 4492
}

4493 4494 4495 4496 4497 4498 4499 4500 4501 4502 4503 4504 4505 4506 4507 4508 4509 4510 4511 4512 4513 4514 4515 4516 4517 4518 4519 4520 4521 4522 4523 4524 4525 4526 4527 4528 4529 4530
static bool ieee80211_usable_wmm_params(struct ieee80211_sub_if_data *sdata,
					const u8 *wmm_param, int len)
{
	const u8 *pos;
	size_t left;

	if (len < 8)
		return false;

	if (wmm_param[5] != 1 /* version */)
		return false;

	pos = wmm_param + 8;
	left = len - 8;

	for (; left >= 4; left -= 4, pos += 4) {
		u8 aifsn = pos[0] & 0x0f;
		u8 ecwmin = pos[1] & 0x0f;
		u8 ecwmax = (pos[1] & 0xf0) >> 4;
		int aci = (pos[0] >> 5) & 0x03;

		if (aifsn < 2) {
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), disabling WMM\n",
				   aifsn, aci);
			return false;
		}
		if (ecwmin > ecwmax) {
			sdata_info(sdata,
				   "AP has invalid WMM params (ECWmin/max=%d/%d for ACI %d), disabling WMM\n",
				   ecwmin, ecwmax, aci);
			return false;
		}
	}

	return true;
}

4531 4532
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
4533
{
J
Johannes Berg 已提交
4534
	struct ieee80211_local *local = sdata->local;
4535
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4536
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
4537
	struct ieee80211_mgd_assoc_data *assoc_data;
4538
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
4539
	struct ieee80211_supported_band *sband;
4540
	const u8 *ssidie, *ht_ie, *vht_ie;
4541
	int i, err;
4542

J
Johannes Berg 已提交
4543 4544 4545 4546
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

4547 4548 4549 4550 4551 4552 4553 4554 4555 4556 4557
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
	if (!ssidie) {
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

4558 4559 4560 4561 4562 4563 4564
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4565 4566
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      sizeof(frame_buf));
4567
	}
J
Johannes Berg 已提交
4568 4569 4570 4571

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
4572
	}
4573

J
Johannes Berg 已提交
4574 4575 4576 4577
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
4578

J
Johannes Berg 已提交
4579 4580 4581 4582
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
4583
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
4584
		ieee80211_destroy_auth_data(sdata, match);
4585 4586
	}

J
Johannes Berg 已提交
4587
	/* prepare assoc data */
4588

4589 4590
	ifmgd->beacon_crc_valid = false;

4591 4592 4593 4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604 4605 4606 4607 4608 4609 4610 4611 4612 4613 4614 4615 4616 4617 4618 4619 4620 4621 4622 4623 4624 4625 4626
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);
	if (assoc_data->wmm) {
		/* try to check validity of WMM params IE */
		const struct cfg80211_bss_ies *ies;
		const u8 *wp, *start, *end;

		rcu_read_lock();
		ies = rcu_dereference(req->bss->ies);
		start = ies->data;
		end = start + ies->len;

		while (true) {
			wp = cfg80211_find_vendor_ie(
				WLAN_OUI_MICROSOFT,
				WLAN_OUI_TYPE_MICROSOFT_WMM,
				start, end - start);
			if (!wp)
				break;
			start = wp + wp[1] + 2;
			/* if this IE is too short, try the next */
			if (wp[1] <= 4)
				continue;
			/* if this IE is WMM params, we found what we wanted */
			if (wp[6] == 1)
				break;
		}

		if (!wp || !ieee80211_usable_wmm_params(sdata, wp + 2,
							wp[1] - 2)) {
			assoc_data->wmm = false;
			ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
		}
		rcu_read_unlock();
	}

J
Johannes Berg 已提交
4627 4628 4629 4630 4631 4632 4633
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
4634
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4635 4636
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4637
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4638
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4639
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4640
			netdev_info(sdata->dev,
4641
				    "disabling HT/VHT due to WEP/TKIP use\n");
4642 4643
		}
	}
4644

4645
	if (req->flags & ASSOC_REQ_DISABLE_HT) {
4646
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4647 4648
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
	}
B
Ben Greear 已提交
4649

4650 4651 4652
	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4653 4654 4655
	/* Also disable HT if we don't support it or the AP doesn't use WMM */
	sband = local->hw.wiphy->bands[req->bss->channel->band];
	if (!sband->ht_cap.ht_supported ||
4656 4657
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4658
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4659 4660
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4661 4662
			netdev_info(sdata->dev,
				    "disabling HT as WMM/QoS is not supported by the AP\n");
4663
	}
J
Johannes Berg 已提交
4664

4665 4666
	/* disable VHT if we don't support it or the AP doesn't use WMM */
	if (!sband->vht_cap.vht_supported ||
4667 4668
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4669
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4670 4671
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4672 4673
			netdev_info(sdata->dev,
				    "disabling VHT as WMM/QoS is not supported by the AP\n");
4674 4675
	}

B
Ben Greear 已提交
4676 4677 4678 4679
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

4680 4681 4682 4683
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

4684
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
4685 4686 4687
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
4688

J
Johannes Berg 已提交
4689
	assoc_data->bss = req->bss;
4690

J
Johannes Berg 已提交
4691 4692
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
4693
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
4694
		else
4695
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
4696
	} else
4697
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
4698

J
Johannes Berg 已提交
4699 4700 4701
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
4702

4703
	rcu_read_lock();
4704 4705 4706 4707 4708
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
	else
4709
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4710 4711 4712 4713 4714 4715
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
	else
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4716
	rcu_read_unlock();
4717

4718 4719 4720 4721 4722
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
		 (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK),
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
4723
	if (bss->wmm_used && bss->uapsd_supported &&
4724
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
4725
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
4726 4727
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
4728
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
4729 4730 4731
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

4732
	if (req->prev_bssid)
J
Johannes Berg 已提交
4733
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4734 4735 4736 4737 4738 4739 4740 4741 4742

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

4743 4744 4745 4746 4747
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

4748 4749 4750 4751 4752
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

4753 4754
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4755 4756
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
4757

J
Johannes Berg 已提交
4758 4759 4760
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
4761
	ifmgd->dtim_period = 0;
4762
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
4763

4764 4765 4766
	err = ieee80211_prep_connection(sdata, req->bss, true);
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
4767

4768 4769
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
4770

4771 4772 4773 4774 4775 4776 4777 4778 4779
	if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC &&
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4780
		assoc_data->timeout_started = true;
4781 4782 4783 4784 4785
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
		const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						    beacon_ies->data,
						    beacon_ies->len);
4786 4787
		u8 dtim_count = 0;

4788 4789 4790 4791
		if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
			const struct ieee80211_tim_ie *tim;
			tim = (void *)(tim_ie + 2);
			ifmgd->dtim_period = tim->dtim_period;
4792
			dtim_count = tim->dtim_count;
4793
		}
4794
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
4795
		assoc_data->timeout = jiffies;
4796
		assoc_data->timeout_started = true;
4797 4798 4799 4800 4801 4802 4803

		if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
4804 4805
	} else {
		assoc_data->timeout = jiffies;
4806
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
4807
	}
4808 4809
	rcu_read_unlock();

4810
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
4811

P
Paul Stewart 已提交
4812 4813 4814 4815 4816 4817 4818 4819 4820 4821
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
4822 4823
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
4824 4825
	}

4826
	return 0;
J
Johannes Berg 已提交
4827
 err_clear:
4828 4829
	memset(ifmgd->bssid, 0, ETH_ALEN);
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4830 4831 4832 4833
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
4834 4835
}

4836
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4837
			 struct cfg80211_deauth_request *req)
4838
{
4839
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4840
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4841
	bool tx = !req->local_state_change;
4842

4843 4844 4845 4846 4847 4848
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
4849

4850
		drv_mgd_prepare_tx(sdata->local, sdata);
4851 4852
		ieee80211_send_deauth_disassoc(sdata, req->bssid,
					       IEEE80211_STYPE_DEAUTH,
4853
					       req->reason_code, tx,
4854
					       frame_buf);
4855
		ieee80211_destroy_auth_data(sdata, false);
4856 4857
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
4858

4859
		return 0;
4860 4861
	}

4862 4863
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4864 4865 4866 4867 4868
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

4869 4870
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
4871 4872
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
4873 4874
		return 0;
	}
4875

4876
	return -ENOTCONN;
4877
}
4878

4879
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4880
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
4881
{
4882
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4883
	u8 bssid[ETH_ALEN];
4884
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
4885

J
Johannes Berg 已提交
4886 4887 4888 4889 4890 4891
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
4892
	if (ifmgd->associated != req->bss)
4893 4894
		return -ENOLINK;

J
Johannes Berg 已提交
4895
	sdata_info(sdata,
4896 4897
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
4898

4899
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
4900 4901 4902
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
4903

4904 4905
	cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
			      IEEE80211_DEAUTH_FRAME_LEN);
4906

4907 4908
	return 0;
}
4909

4910
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4911 4912 4913
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4914 4915 4916 4917 4918 4919 4920 4921 4922 4923
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
4924
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
4925

4926
	sdata_lock(sdata);
4927 4928
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4929
		ieee80211_destroy_assoc_data(sdata, false);
4930 4931
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
4932 4933
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
4934 4935 4936 4937 4938 4939 4940
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
	spin_unlock_bh(&ifmgd->teardown_lock);
4941
	del_timer_sync(&ifmgd->timer);
4942
	sdata_unlock(sdata);
4943 4944
}

4945 4946 4947 4948 4949 4950
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

J
Johannes Berg 已提交
4951 4952
	trace_api_cqm_rssi_notify(sdata, rssi_event);

4953 4954 4955
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
4956 4957 4958 4959 4960 4961 4962 4963 4964 4965

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);