?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
mac80211: fix ieee80211_sta_process_chanswitch for 5/10 MHz channels
[linux-2.6/btrfs-unstable.git] / net / mac80211 / mlme.c
blob45a87ee3f1241f419c389e5b0e8167659692dfd3
1 /*
2 * BSS client mode implementation
3 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4 * Copyright 2004, Instant802 Networks, Inc.
5 * Copyright 2005, Devicescape Software, Inc.
6 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
7 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
12 */
13
14 #include <linux/delay.h>
15 #include <linux/if_ether.h>
16 #include <linux/skbuff.h>
17 #include <linux/if_arp.h>
18 #include <linux/etherdevice.h>
19 #include <linux/moduleparam.h>
20 #include <linux/rtnetlink.h>
21 #include <linux/pm_qos.h>
22 #include <linux/crc32.h>
23 #include <linux/slab.h>
24 #include <linux/export.h>
25 #include <net/mac80211.h>
26 #include <asm/unaligned.h>
27
28 #include "ieee80211_i.h"
29 #include "driver-ops.h"
30 #include "rate.h"
31 #include "led.h"
32
33 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
34 #define IEEE80211_AUTH_TIMEOUT_SHORT (HZ / 10)
35 #define IEEE80211_AUTH_MAX_TRIES 3
36 #define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5)
37 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
38 #define IEEE80211_ASSOC_TIMEOUT_SHORT (HZ / 10)
39 #define IEEE80211_ASSOC_MAX_TRIES 3
40
41 static int max_nullfunc_tries = 2;
42 module_param(max_nullfunc_tries, int, 0644);
43 MODULE_PARM_DESC(max_nullfunc_tries,
44 "Maximum nullfunc tx tries before disconnecting (reason 4).");
45
46 static int max_probe_tries = 5;
47 module_param(max_probe_tries, int, 0644);
48 MODULE_PARM_DESC(max_probe_tries,
49 "Maximum probe tries before disconnecting (reason 4).");
50
51 /*
52 * Beacon loss timeout is calculated as N frames times the
53 * advertised beacon interval. This may need to be somewhat
54 * higher than what hardware might detect to account for
55 * delays in the host processing frames. But since we also
56 * probe on beacon miss before declaring the connection lost
57 * default to what we want.
58 */
59 static int beacon_loss_count = 7;
60 module_param(beacon_loss_count, int, 0644);
61 MODULE_PARM_DESC(beacon_loss_count,
62 "Number of beacon intervals before we decide beacon was lost.");
63
64 /*
65 * Time the connection can be idle before we probe
66 * it to see if we can still talk to the AP.
67 */
68 #define IEEE80211_CONNECTION_IDLE_TIME (30 * HZ)
69 /*
70 * Time we wait for a probe response after sending
71 * a probe request because of beacon loss or for
72 * checking the connection still works.
73 */
74 static int probe_wait_ms = 500;
75 module_param(probe_wait_ms, int, 0644);
76 MODULE_PARM_DESC(probe_wait_ms,
77 "Maximum time(ms) to wait for probe response"
78 " before disconnecting (reason 4).");
79
80 /*
81 * Weight given to the latest Beacon frame when calculating average signal
82 * strength for Beacon frames received in the current BSS. This must be
83 * between 1 and 15.
84 */
85 #define IEEE80211_SIGNAL_AVE_WEIGHT 3
86
87 /*
88 * How many Beacon frames need to have been used in average signal strength
89 * before starting to indicate signal change events.
90 */
91 #define IEEE80211_SIGNAL_AVE_MIN_COUNT 4
92
93 /*
94 * We can have multiple work items (and connection probing)
95 * scheduling this timer, but we need to take care to only
96 * reschedule it when it should fire _earlier_ than it was
97 * asked for before, or if it's not pending right now. This
98 * function ensures that. Note that it then is required to
99 * run this function for all timeouts after the first one
100 * has happened -- the work that runs from this timer will
101 * do that.
102 */
103 static void run_again(struct ieee80211_sub_if_data *sdata,
104 unsigned long timeout)
105 {
106 sdata_assert_lock(sdata);
107
108 if (!timer_pending(&sdata->u.mgd.timer) ||
109 time_before(timeout, sdata->u.mgd.timer.expires))
110 mod_timer(&sdata->u.mgd.timer, timeout);
111 }
112
113 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
114 {
115 if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
116 return;
117
118 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
119 return;
120
121 mod_timer(&sdata->u.mgd.bcn_mon_timer,
122 round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
123 }
124
125 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
126 {
127 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
128
129 if (unlikely(!sdata->u.mgd.associated))
130 return;
131
132 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
133 return;
134
135 mod_timer(&sdata->u.mgd.conn_mon_timer,
136 round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
137
138 ifmgd->probe_send_count = 0;
139 }
140
141 static int ecw2cw(int ecw)
142 {
143 return (1 << ecw) - 1;
144 }
145
146 static u32 chandef_downgrade(struct cfg80211_chan_def *c)
147 {
148 u32 ret;
149 int tmp;
150
151 switch (c->width) {
152 case NL80211_CHAN_WIDTH_20:
153 c->width = NL80211_CHAN_WIDTH_20_NOHT;
154 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
155 break;
156 case NL80211_CHAN_WIDTH_40:
157 c->width = NL80211_CHAN_WIDTH_20;
158 c->center_freq1 = c->chan->center_freq;
159 ret = IEEE80211_STA_DISABLE_40MHZ |
160 IEEE80211_STA_DISABLE_VHT;
161 break;
162 case NL80211_CHAN_WIDTH_80:
163 tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
164 /* n_P40 */
165 tmp /= 2;
166 /* freq_P40 */
167 c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
168 c->width = NL80211_CHAN_WIDTH_40;
169 ret = IEEE80211_STA_DISABLE_VHT;
170 break;
171 case NL80211_CHAN_WIDTH_80P80:
172 c->center_freq2 = 0;
173 c->width = NL80211_CHAN_WIDTH_80;
174 ret = IEEE80211_STA_DISABLE_80P80MHZ |
175 IEEE80211_STA_DISABLE_160MHZ;
176 break;
177 case NL80211_CHAN_WIDTH_160:
178 /* n_P20 */
179 tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
180 /* n_P80 */
181 tmp /= 4;
182 c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
183 c->width = NL80211_CHAN_WIDTH_80;
184 ret = IEEE80211_STA_DISABLE_80P80MHZ |
185 IEEE80211_STA_DISABLE_160MHZ;
186 break;
187 default:
188 case NL80211_CHAN_WIDTH_20_NOHT:
189 WARN_ON_ONCE(1);
190 c->width = NL80211_CHAN_WIDTH_20_NOHT;
191 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
192 break;
193 case NL80211_CHAN_WIDTH_5:
194 case NL80211_CHAN_WIDTH_10:
195 WARN_ON_ONCE(1);
196 /* keep c->width */
197 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
198 break;
199 }
200
201 WARN_ON_ONCE(!cfg80211_chandef_valid(c));
202
203 return ret;
204 }
205
206 static u32
207 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
208 struct ieee80211_supported_band *sband,
209 struct ieee80211_channel *channel,
210 const struct ieee80211_ht_operation *ht_oper,
211 const struct ieee80211_vht_operation *vht_oper,
212 struct cfg80211_chan_def *chandef, bool verbose)
213 {
214 struct cfg80211_chan_def vht_chandef;
215 u32 ht_cfreq, ret;
216
217 chandef->chan = channel;
218 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
219 chandef->center_freq1 = channel->center_freq;
220 chandef->center_freq2 = 0;
221
222 if (!ht_oper || !sband->ht_cap.ht_supported) {
223 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
224 goto out;
225 }
226
227 chandef->width = NL80211_CHAN_WIDTH_20;
228
229 ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
230 channel->band);
231 /* check that channel matches the right operating channel */
232 if (channel->center_freq != ht_cfreq) {
233 /*
234 * It's possible that some APs are confused here;
235 * Netgear WNDR3700 sometimes reports 4 higher than
236 * the actual channel in association responses, but
237 * since we look at probe response/beacon data here
238 * it should be OK.
239 */
240 if (verbose)
241 sdata_info(sdata,
242 "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
243 channel->center_freq, ht_cfreq,
244 ht_oper->primary_chan, channel->band);
245 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
246 goto out;
247 }
248
249 /* check 40 MHz support, if we have it */
250 if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
251 switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
252 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
253 chandef->width = NL80211_CHAN_WIDTH_40;
254 chandef->center_freq1 += 10;
255 break;
256 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
257 chandef->width = NL80211_CHAN_WIDTH_40;
258 chandef->center_freq1 -= 10;
259 break;
260 }
261 } else {
262 /* 40 MHz (and 80 MHz) must be supported for VHT */
263 ret = IEEE80211_STA_DISABLE_VHT;
264 /* also mark 40 MHz disabled */
265 ret |= IEEE80211_STA_DISABLE_40MHZ;
266 goto out;
267 }
268
269 if (!vht_oper || !sband->vht_cap.vht_supported) {
270 ret = IEEE80211_STA_DISABLE_VHT;
271 goto out;
272 }
273
274 vht_chandef.chan = channel;
275 vht_chandef.center_freq1 =
276 ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
277 channel->band);
278 vht_chandef.center_freq2 = 0;
279
280 switch (vht_oper->chan_width) {
281 case IEEE80211_VHT_CHANWIDTH_USE_HT:
282 vht_chandef.width = chandef->width;
283 break;
284 case IEEE80211_VHT_CHANWIDTH_80MHZ:
285 vht_chandef.width = NL80211_CHAN_WIDTH_80;
286 break;
287 case IEEE80211_VHT_CHANWIDTH_160MHZ:
288 vht_chandef.width = NL80211_CHAN_WIDTH_160;
289 break;
290 case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
291 vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
292 vht_chandef.center_freq2 =
293 ieee80211_channel_to_frequency(
294 vht_oper->center_freq_seg2_idx,
295 channel->band);
296 break;
297 default:
298 if (verbose)
299 sdata_info(sdata,
300 "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
301 vht_oper->chan_width);
302 ret = IEEE80211_STA_DISABLE_VHT;
303 goto out;
304 }
305
306 if (!cfg80211_chandef_valid(&vht_chandef)) {
307 if (verbose)
308 sdata_info(sdata,
309 "AP VHT information is invalid, disable VHT\n");
310 ret = IEEE80211_STA_DISABLE_VHT;
311 goto out;
312 }
313
314 if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
315 ret = 0;
316 goto out;
317 }
318
319 if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
320 if (verbose)
321 sdata_info(sdata,
322 "AP VHT information doesn't match HT, disable VHT\n");
323 ret = IEEE80211_STA_DISABLE_VHT;
324 goto out;
325 }
326
327 *chandef = vht_chandef;
328
329 ret = 0;
330
331 out:
332 /* don't print the message below for VHT mismatch if VHT is disabled */
333 if (ret & IEEE80211_STA_DISABLE_VHT)
334 vht_chandef = *chandef;
335
336 while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
337 IEEE80211_CHAN_DISABLED)) {
338 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
339 ret = IEEE80211_STA_DISABLE_HT |
340 IEEE80211_STA_DISABLE_VHT;
341 goto out;
342 }
343
344 ret |= chandef_downgrade(chandef);
345 }
346
347 if (chandef->width != vht_chandef.width && verbose)
348 sdata_info(sdata,
349 "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
350
351 WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
352 return ret;
353 }
354
355 static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
356 struct sta_info *sta,
357 const struct ieee80211_ht_operation *ht_oper,
358 const struct ieee80211_vht_operation *vht_oper,
359 const u8 *bssid, u32 *changed)
360 {
361 struct ieee80211_local *local = sdata->local;
362 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
363 struct ieee80211_supported_band *sband;
364 struct ieee80211_channel *chan;
365 struct cfg80211_chan_def chandef;
366 u16 ht_opmode;
367 u32 flags;
368 enum ieee80211_sta_rx_bandwidth new_sta_bw;
369 int ret;
370
371 /* if HT was/is disabled, don't track any bandwidth changes */
372 if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
373 return 0;
374
375 /* don't check VHT if we associated as non-VHT station */
376 if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
377 vht_oper = NULL;
378
379 if (WARN_ON_ONCE(!sta))
380 return -EINVAL;
381
382 chan = sdata->vif.bss_conf.chandef.chan;
383 sband = local->hw.wiphy->bands[chan->band];
384
385 /* calculate new channel (type) based on HT/VHT operation IEs */
386 flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
387 vht_oper, &chandef, false);
388
389 /*
390 * Downgrade the new channel if we associated with restricted
391 * capabilities. For example, if we associated as a 20 MHz STA
392 * to a 40 MHz AP (due to regulatory, capabilities or config
393 * reasons) then switching to a 40 MHz channel now won't do us
394 * any good -- we couldn't use it with the AP.
395 */
396 if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
397 chandef.width == NL80211_CHAN_WIDTH_80P80)
398 flags |= chandef_downgrade(&chandef);
399 if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
400 chandef.width == NL80211_CHAN_WIDTH_160)
401 flags |= chandef_downgrade(&chandef);
402 if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
403 chandef.width > NL80211_CHAN_WIDTH_20)
404 flags |= chandef_downgrade(&chandef);
405
406 if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
407 return 0;
408
409 sdata_info(sdata,
410 "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
411 ifmgd->bssid, chandef.chan->center_freq, chandef.width,
412 chandef.center_freq1, chandef.center_freq2);
413
414 if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
415 IEEE80211_STA_DISABLE_VHT |
416 IEEE80211_STA_DISABLE_40MHZ |
417 IEEE80211_STA_DISABLE_80P80MHZ |
418 IEEE80211_STA_DISABLE_160MHZ)) ||
419 !cfg80211_chandef_valid(&chandef)) {
420 sdata_info(sdata,
421 "AP %pM changed bandwidth in a way we can't support - disconnect\n",
422 ifmgd->bssid);
423 return -EINVAL;
424 }
425
426 switch (chandef.width) {
427 case NL80211_CHAN_WIDTH_20_NOHT:
428 case NL80211_CHAN_WIDTH_20:
429 new_sta_bw = IEEE80211_STA_RX_BW_20;
430 break;
431 case NL80211_CHAN_WIDTH_40:
432 new_sta_bw = IEEE80211_STA_RX_BW_40;
433 break;
434 case NL80211_CHAN_WIDTH_80:
435 new_sta_bw = IEEE80211_STA_RX_BW_80;
436 break;
437 case NL80211_CHAN_WIDTH_80P80:
438 case NL80211_CHAN_WIDTH_160:
439 new_sta_bw = IEEE80211_STA_RX_BW_160;
440 break;
441 default:
442 return -EINVAL;
443 }
444
445 if (new_sta_bw > sta->cur_max_bandwidth)
446 new_sta_bw = sta->cur_max_bandwidth;
447
448 if (new_sta_bw < sta->sta.bandwidth) {
449 sta->sta.bandwidth = new_sta_bw;
450 rate_control_rate_update(local, sband, sta,
451 IEEE80211_RC_BW_CHANGED);
452 }
453
454 ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
455 if (ret) {
456 sdata_info(sdata,
457 "AP %pM changed bandwidth to incompatible one - disconnect\n",
458 ifmgd->bssid);
459 return ret;
460 }
461
462 if (new_sta_bw > sta->sta.bandwidth) {
463 sta->sta.bandwidth = new_sta_bw;
464 rate_control_rate_update(local, sband, sta,
465 IEEE80211_RC_BW_CHANGED);
466 }
467
468 ht_opmode = le16_to_cpu(ht_oper->operation_mode);
469
470 /* if bss configuration changed store the new one */
471 if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
472 *changed |= BSS_CHANGED_HT;
473 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
474 }
475
476 return 0;
477 }
478
479 /* frame sending functions */
480
481 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
482 struct sk_buff *skb, u8 ap_ht_param,
483 struct ieee80211_supported_band *sband,
484 struct ieee80211_channel *channel,
485 enum ieee80211_smps_mode smps)
486 {
487 u8 *pos;
488 u32 flags = channel->flags;
489 u16 cap;
490 struct ieee80211_sta_ht_cap ht_cap;
491
492 BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
493
494 memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
495 ieee80211_apply_htcap_overrides(sdata, &ht_cap);
496
497 /* determine capability flags */
498 cap = ht_cap.cap;
499
500 switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
501 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
502 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
503 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
504 cap &= ~IEEE80211_HT_CAP_SGI_40;
505 }
506 break;
507 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
508 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
509 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
510 cap &= ~IEEE80211_HT_CAP_SGI_40;
511 }
512 break;
513 }
514
515 /*
516 * If 40 MHz was disabled associate as though we weren't
517 * capable of 40 MHz -- some broken APs will never fall
518 * back to trying to transmit in 20 MHz.
519 */
520 if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
521 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
522 cap &= ~IEEE80211_HT_CAP_SGI_40;
523 }
524
525 /* set SM PS mode properly */
526 cap &= ~IEEE80211_HT_CAP_SM_PS;
527 switch (smps) {
528 case IEEE80211_SMPS_AUTOMATIC:
529 case IEEE80211_SMPS_NUM_MODES:
530 WARN_ON(1);
531 case IEEE80211_SMPS_OFF:
532 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
533 IEEE80211_HT_CAP_SM_PS_SHIFT;
534 break;
535 case IEEE80211_SMPS_STATIC:
536 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
537 IEEE80211_HT_CAP_SM_PS_SHIFT;
538 break;
539 case IEEE80211_SMPS_DYNAMIC:
540 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
541 IEEE80211_HT_CAP_SM_PS_SHIFT;
542 break;
543 }
544
545 /* reserve and fill IE */
546 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
547 ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
548 }
549
550 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
551 struct sk_buff *skb,
552 struct ieee80211_supported_band *sband,
553 struct ieee80211_vht_cap *ap_vht_cap)
554 {
555 u8 *pos;
556 u32 cap;
557 struct ieee80211_sta_vht_cap vht_cap;
558
559 BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
560
561 memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
562 ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
563
564 /* determine capability flags */
565 cap = vht_cap.cap;
566
567 if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
568 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
569 cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
570 }
571
572 if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
573 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
574 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
575 }
576
577 /*
578 * Some APs apparently get confused if our capabilities are better
579 * than theirs, so restrict what we advertise in the assoc request.
580 */
581 if (!(ap_vht_cap->vht_cap_info &
582 cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
583 cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
584
585 /* reserve and fill IE */
586 pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
587 ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
588 }
589
590 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
591 {
592 struct ieee80211_local *local = sdata->local;
593 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
594 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
595 struct sk_buff *skb;
596 struct ieee80211_mgmt *mgmt;
597 u8 *pos, qos_info;
598 size_t offset = 0, noffset;
599 int i, count, rates_len, supp_rates_len, shift;
600 u16 capab;
601 struct ieee80211_supported_band *sband;
602 struct ieee80211_chanctx_conf *chanctx_conf;
603 struct ieee80211_channel *chan;
604 u32 rate_flags, rates = 0;
605
606 sdata_assert_lock(sdata);
607
608 rcu_read_lock();
609 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
610 if (WARN_ON(!chanctx_conf)) {
611 rcu_read_unlock();
612 return;
613 }
614 chan = chanctx_conf->def.chan;
615 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
616 rcu_read_unlock();
617 sband = local->hw.wiphy->bands[chan->band];
618 shift = ieee80211_vif_get_shift(&sdata->vif);
619
620 if (assoc_data->supp_rates_len) {
621 /*
622 * Get all rates supported by the device and the AP as
623 * some APs don't like getting a superset of their rates
624 * in the association request (e.g. D-Link DAP 1353 in
625 * b-only mode)...
626 */
627 rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
628 assoc_data->supp_rates,
629 assoc_data->supp_rates_len,
630 &rates);
631 } else {
632 /*
633 * In case AP not provide any supported rates information
634 * before association, we send information element(s) with
635 * all rates that we support.
636 */
637 rates_len = 0;
638 for (i = 0; i < sband->n_bitrates; i++) {
639 if ((rate_flags & sband->bitrates[i].flags)
640 != rate_flags)
641 continue;
642 rates |= BIT(i);
643 rates_len++;
644 }
645 }
646
647 skb = alloc_skb(local->hw.extra_tx_headroom +
648 sizeof(*mgmt) + /* bit too much but doesn't matter */
649 2 + assoc_data->ssid_len + /* SSID */
650 4 + rates_len + /* (extended) rates */
651 4 + /* power capability */
652 2 + 2 * sband->n_channels + /* supported channels */
653 2 + sizeof(struct ieee80211_ht_cap) + /* HT */
654 2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
655 assoc_data->ie_len + /* extra IEs */
656 9, /* WMM */
657 GFP_KERNEL);
658 if (!skb)
659 return;
660
661 skb_reserve(skb, local->hw.extra_tx_headroom);
662
663 capab = WLAN_CAPABILITY_ESS;
664
665 if (sband->band == IEEE80211_BAND_2GHZ) {
666 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
667 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
668 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
669 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
670 }
671
672 if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
673 capab |= WLAN_CAPABILITY_PRIVACY;
674
675 if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
676 (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
677 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
678
679 mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
680 memset(mgmt, 0, 24);
681 memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
682 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
683 memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
684
685 if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
686 skb_put(skb, 10);
687 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
688 IEEE80211_STYPE_REASSOC_REQ);
689 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
690 mgmt->u.reassoc_req.listen_interval =
691 cpu_to_le16(local->hw.conf.listen_interval);
692 memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
693 ETH_ALEN);
694 } else {
695 skb_put(skb, 4);
696 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
697 IEEE80211_STYPE_ASSOC_REQ);
698 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
699 mgmt->u.assoc_req.listen_interval =
700 cpu_to_le16(local->hw.conf.listen_interval);
701 }
702
703 /* SSID */
704 pos = skb_put(skb, 2 + assoc_data->ssid_len);
705 *pos++ = WLAN_EID_SSID;
706 *pos++ = assoc_data->ssid_len;
707 memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
708
709 /* add all rates which were marked to be used above */
710 supp_rates_len = rates_len;
711 if (supp_rates_len > 8)
712 supp_rates_len = 8;
713
714 pos = skb_put(skb, supp_rates_len + 2);
715 *pos++ = WLAN_EID_SUPP_RATES;
716 *pos++ = supp_rates_len;
717
718 count = 0;
719 for (i = 0; i < sband->n_bitrates; i++) {
720 if (BIT(i) & rates) {
721 int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
722 5 * (1 << shift));
723 *pos++ = (u8) rate;
724 if (++count == 8)
725 break;
726 }
727 }
728
729 if (rates_len > count) {
730 pos = skb_put(skb, rates_len - count + 2);
731 *pos++ = WLAN_EID_EXT_SUPP_RATES;
732 *pos++ = rates_len - count;
733
734 for (i++; i < sband->n_bitrates; i++) {
735 if (BIT(i) & rates) {
736 int rate;
737 rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
738 5 * (1 << shift));
739 *pos++ = (u8) rate;
740 }
741 }
742 }
743
744 if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
745 /* 1. power capabilities */
746 pos = skb_put(skb, 4);
747 *pos++ = WLAN_EID_PWR_CAPABILITY;
748 *pos++ = 2;
749 *pos++ = 0; /* min tx power */
750 /* max tx power */
751 *pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
752
753 /* 2. supported channels */
754 /* TODO: get this in reg domain format */
755 pos = skb_put(skb, 2 * sband->n_channels + 2);
756 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
757 *pos++ = 2 * sband->n_channels;
758 for (i = 0; i < sband->n_channels; i++) {
759 *pos++ = ieee80211_frequency_to_channel(
760 sband->channels[i].center_freq);
761 *pos++ = 1; /* one channel in the subband*/
762 }
763 }
764
765 /* if present, add any custom IEs that go before HT */
766 if (assoc_data->ie_len && assoc_data->ie) {
767 static const u8 before_ht[] = {
768 WLAN_EID_SSID,
769 WLAN_EID_SUPP_RATES,
770 WLAN_EID_EXT_SUPP_RATES,
771 WLAN_EID_PWR_CAPABILITY,
772 WLAN_EID_SUPPORTED_CHANNELS,
773 WLAN_EID_RSN,
774 WLAN_EID_QOS_CAPA,
775 WLAN_EID_RRM_ENABLED_CAPABILITIES,
776 WLAN_EID_MOBILITY_DOMAIN,
777 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
778 };
779 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
780 before_ht, ARRAY_SIZE(before_ht),
781 offset);
782 pos = skb_put(skb, noffset - offset);
783 memcpy(pos, assoc_data->ie + offset, noffset - offset);
784 offset = noffset;
785 }
786
787 if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
788 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
789 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
790
791 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
792 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
793 sband, chan, sdata->smps_mode);
794
795 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
796 ieee80211_add_vht_ie(sdata, skb, sband,
797 &assoc_data->ap_vht_cap);
798
799 /* if present, add any custom non-vendor IEs that go after HT */
800 if (assoc_data->ie_len && assoc_data->ie) {
801 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
802 assoc_data->ie_len,
803 offset);
804 pos = skb_put(skb, noffset - offset);
805 memcpy(pos, assoc_data->ie + offset, noffset - offset);
806 offset = noffset;
807 }
808
809 if (assoc_data->wmm) {
810 if (assoc_data->uapsd) {
811 qos_info = ifmgd->uapsd_queues;
812 qos_info |= (ifmgd->uapsd_max_sp_len <<
813 IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
814 } else {
815 qos_info = 0;
816 }
817
818 pos = skb_put(skb, 9);
819 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
820 *pos++ = 7; /* len */
821 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
822 *pos++ = 0x50;
823 *pos++ = 0xf2;
824 *pos++ = 2; /* WME */
825 *pos++ = 0; /* WME info */
826 *pos++ = 1; /* WME ver */
827 *pos++ = qos_info;
828 }
829
830 /* add any remaining custom (i.e. vendor specific here) IEs */
831 if (assoc_data->ie_len && assoc_data->ie) {
832 noffset = assoc_data->ie_len;
833 pos = skb_put(skb, noffset - offset);
834 memcpy(pos, assoc_data->ie + offset, noffset - offset);
835 }
836
837 drv_mgd_prepare_tx(local, sdata);
838
839 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
840 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
841 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
842 IEEE80211_TX_INTFL_MLME_CONN_TX;
843 ieee80211_tx_skb(sdata, skb);
844 }
845
846 void ieee80211_send_pspoll(struct ieee80211_local *local,
847 struct ieee80211_sub_if_data *sdata)
848 {
849 struct ieee80211_pspoll *pspoll;
850 struct sk_buff *skb;
851
852 skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
853 if (!skb)
854 return;
855
856 pspoll = (struct ieee80211_pspoll *) skb->data;
857 pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
858
859 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
860 ieee80211_tx_skb(sdata, skb);
861 }
862
863 void ieee80211_send_nullfunc(struct ieee80211_local *local,
864 struct ieee80211_sub_if_data *sdata,
865 int powersave)
866 {
867 struct sk_buff *skb;
868 struct ieee80211_hdr_3addr *nullfunc;
869 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
870
871 skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
872 if (!skb)
873 return;
874
875 nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
876 if (powersave)
877 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
878
879 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
880 IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
881
882 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
883 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
884
885 if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
886 IEEE80211_STA_CONNECTION_POLL))
887 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
888
889 ieee80211_tx_skb(sdata, skb);
890 }
891
892 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
893 struct ieee80211_sub_if_data *sdata)
894 {
895 struct sk_buff *skb;
896 struct ieee80211_hdr *nullfunc;
897 __le16 fc;
898
899 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
900 return;
901
902 skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
903 if (!skb)
904 return;
905
906 skb_reserve(skb, local->hw.extra_tx_headroom);
907
908 nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
909 memset(nullfunc, 0, 30);
910 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
911 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
912 nullfunc->frame_control = fc;
913 memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
914 memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
915 memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
916 memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
917
918 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
919 ieee80211_tx_skb(sdata, skb);
920 }
921
922 /* spectrum management related things */
923 static void ieee80211_chswitch_work(struct work_struct *work)
924 {
925 struct ieee80211_sub_if_data *sdata =
926 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
927 struct ieee80211_local *local = sdata->local;
928 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
929
930 if (!ieee80211_sdata_running(sdata))
931 return;
932
933 sdata_lock(sdata);
934 if (!ifmgd->associated)
935 goto out;
936
937 local->_oper_chandef = local->csa_chandef;
938
939 if (!local->ops->channel_switch) {
940 /* call "hw_config" only if doing sw channel switch */
941 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
942 } else {
943 /* update the device channel directly */
944 local->hw.conf.chandef = local->_oper_chandef;
945 }
946
947 /* XXX: shouldn't really modify cfg80211-owned data! */
948 ifmgd->associated->channel = local->_oper_chandef.chan;
949
950 /* XXX: wait for a beacon first? */
951 ieee80211_wake_queues_by_reason(&local->hw,
952 IEEE80211_MAX_QUEUE_MAP,
953 IEEE80211_QUEUE_STOP_REASON_CSA);
954 out:
955 ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
956 sdata_unlock(sdata);
957 }
958
959 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
960 {
961 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
962 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
963
964 trace_api_chswitch_done(sdata, success);
965 if (!success) {
966 sdata_info(sdata,
967 "driver channel switch failed, disconnecting\n");
968 ieee80211_queue_work(&sdata->local->hw,
969 &ifmgd->csa_connection_drop_work);
970 } else {
971 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
972 }
973 }
974 EXPORT_SYMBOL(ieee80211_chswitch_done);
975
976 static void ieee80211_chswitch_timer(unsigned long data)
977 {
978 struct ieee80211_sub_if_data *sdata =
979 (struct ieee80211_sub_if_data *) data;
980
981 ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
982 }
983
984 static void
985 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
986 u64 timestamp, struct ieee802_11_elems *elems,
987 bool beacon)
988 {
989 struct ieee80211_local *local = sdata->local;
990 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
991 struct cfg80211_bss *cbss = ifmgd->associated;
992 struct ieee80211_bss *bss;
993 struct ieee80211_chanctx *chanctx;
994 enum ieee80211_band new_band;
995 int new_freq;
996 u8 new_chan_no;
997 u8 count;
998 u8 mode;
999 struct ieee80211_channel *new_chan;
1000 struct cfg80211_chan_def new_chandef = {};
1001 struct cfg80211_chan_def new_vht_chandef = {};
1002 const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
1003 const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
1004 const struct ieee80211_ht_operation *ht_oper;
1005 int secondary_channel_offset = -1;
1006
1007 sdata_assert_lock(sdata);
1008
1009 if (!cbss)
1010 return;
1011
1012 if (local->scanning)
1013 return;
1014
1015 /* disregard subsequent announcements if we are already processing */
1016 if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
1017 return;
1018
1019 sec_chan_offs = elems->sec_chan_offs;
1020 wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
1021 ht_oper = elems->ht_operation;
1022
1023 if (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
1024 IEEE80211_STA_DISABLE_40MHZ)) {
1025 sec_chan_offs = NULL;
1026 wide_bw_chansw_ie = NULL;
1027 /* only used for bandwidth here */
1028 ht_oper = NULL;
1029 }
1030
1031 if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
1032 wide_bw_chansw_ie = NULL;
1033
1034 if (elems->ext_chansw_ie) {
1035 if (!ieee80211_operating_class_to_band(
1036 elems->ext_chansw_ie->new_operating_class,
1037 &new_band)) {
1038 sdata_info(sdata,
1039 "cannot understand ECSA IE operating class %d, disconnecting\n",
1040 elems->ext_chansw_ie->new_operating_class);
1041 ieee80211_queue_work(&local->hw,
1042 &ifmgd->csa_connection_drop_work);
1043 }
1044 new_chan_no = elems->ext_chansw_ie->new_ch_num;
1045 count = elems->ext_chansw_ie->count;
1046 mode = elems->ext_chansw_ie->mode;
1047 } else if (elems->ch_switch_ie) {
1048 new_band = cbss->channel->band;
1049 new_chan_no = elems->ch_switch_ie->new_ch_num;
1050 count = elems->ch_switch_ie->count;
1051 mode = elems->ch_switch_ie->mode;
1052 } else {
1053 /* nothing here we understand */
1054 return;
1055 }
1056
1057 bss = (void *)cbss->priv;
1058
1059 new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
1060 new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
1061 if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
1062 sdata_info(sdata,
1063 "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
1064 ifmgd->associated->bssid, new_freq);
1065 ieee80211_queue_work(&local->hw,
1066 &ifmgd->csa_connection_drop_work);
1067 return;
1068 }
1069
1070 if (!beacon && sec_chan_offs) {
1071 secondary_channel_offset = sec_chan_offs->sec_chan_offs;
1072 } else if (beacon && ht_oper) {
1073 secondary_channel_offset =
1074 ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
1075 } else if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
1076 /*
1077 * If it's not a beacon, HT is enabled and the IE not present,
1078 * it's 20 MHz, 802.11-2012 8.5.2.6:
1079 * This element [the Secondary Channel Offset Element] is
1080 * present when switching to a 40 MHz channel. It may be
1081 * present when switching to a 20 MHz channel (in which
1082 * case the secondary channel offset is set to SCN).
1083 */
1084 secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
1085 }
1086
1087 switch (secondary_channel_offset) {
1088 default:
1089 /* secondary_channel_offset was present but is invalid */
1090 case IEEE80211_HT_PARAM_CHA_SEC_NONE:
1091 cfg80211_chandef_create(&new_chandef, new_chan,
1092 NL80211_CHAN_HT20);
1093 break;
1094 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
1095 cfg80211_chandef_create(&new_chandef, new_chan,
1096 NL80211_CHAN_HT40PLUS);
1097 break;
1098 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
1099 cfg80211_chandef_create(&new_chandef, new_chan,
1100 NL80211_CHAN_HT40MINUS);
1101 break;
1102 case -1:
1103 cfg80211_chandef_create(&new_chandef, new_chan,
1104 NL80211_CHAN_NO_HT);
1105 /* keep width for 5/10 MHz channels */
1106 switch (sdata->vif.bss_conf.chandef.width) {
1107 case NL80211_CHAN_WIDTH_5:
1108 case NL80211_CHAN_WIDTH_10:
1109 new_chandef.width = sdata->vif.bss_conf.chandef.width;
1110 break;
1111 default:
1112 break;
1113 }
1114 break;
1115 }
1116
1117 if (wide_bw_chansw_ie) {
1118 new_vht_chandef.chan = new_chan;
1119 new_vht_chandef.center_freq1 =
1120 ieee80211_channel_to_frequency(
1121 wide_bw_chansw_ie->new_center_freq_seg0,
1122 new_band);
1123
1124 switch (wide_bw_chansw_ie->new_channel_width) {
1125 default:
1126 /* hmmm, ignore VHT and use HT if present */
1127 case IEEE80211_VHT_CHANWIDTH_USE_HT:
1128 new_vht_chandef.chan = NULL;
1129 break;
1130 case IEEE80211_VHT_CHANWIDTH_80MHZ:
1131 new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
1132 break;
1133 case IEEE80211_VHT_CHANWIDTH_160MHZ:
1134 new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
1135 break;
1136 case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
1137 /* field is otherwise reserved */
1138 new_vht_chandef.center_freq2 =
1139 ieee80211_channel_to_frequency(
1140 wide_bw_chansw_ie->new_center_freq_seg1,
1141 new_band);
1142 new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
1143 break;
1144 }
1145 if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
1146 new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
1147 chandef_downgrade(&new_vht_chandef);
1148 if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
1149 new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
1150 chandef_downgrade(&new_vht_chandef);
1151 if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
1152 new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
1153 chandef_downgrade(&new_vht_chandef);
1154 }
1155
1156 /* if VHT data is there validate & use it */
1157 if (new_vht_chandef.chan) {
1158 if (!cfg80211_chandef_compatible(&new_vht_chandef,
1159 &new_chandef)) {
1160 sdata_info(sdata,
1161 "AP %pM CSA has inconsistent channel data, disconnecting\n",
1162 ifmgd->associated->bssid);
1163 ieee80211_queue_work(&local->hw,
1164 &ifmgd->csa_connection_drop_work);
1165 return;
1166 }
1167 new_chandef = new_vht_chandef;
1168 }
1169
1170 if (!cfg80211_chandef_usable(local->hw.wiphy, &new_chandef,
1171 IEEE80211_CHAN_DISABLED)) {
1172 sdata_info(sdata,
1173 "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1174 ifmgd->associated->bssid, new_freq,
1175 new_chandef.width, new_chandef.center_freq1,
1176 new_chandef.center_freq2);
1177 ieee80211_queue_work(&local->hw,
1178 &ifmgd->csa_connection_drop_work);
1179 return;
1180 }
1181
1182 ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
1183
1184 if (local->use_chanctx) {
1185 sdata_info(sdata,
1186 "not handling channel switch with channel contexts\n");
1187 ieee80211_queue_work(&local->hw,
1188 &ifmgd->csa_connection_drop_work);
1189 return;
1190 }
1191
1192 mutex_lock(&local->chanctx_mtx);
1193 if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
1194 mutex_unlock(&local->chanctx_mtx);
1195 return;
1196 }
1197 chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
1198 struct ieee80211_chanctx, conf);
1199 if (chanctx->refcount > 1) {
1200 sdata_info(sdata,
1201 "channel switch with multiple interfaces on the same channel, disconnecting\n");
1202 ieee80211_queue_work(&local->hw,
1203 &ifmgd->csa_connection_drop_work);
1204 mutex_unlock(&local->chanctx_mtx);
1205 return;
1206 }
1207 mutex_unlock(&local->chanctx_mtx);
1208
1209 local->csa_chandef = new_chandef;
1210
1211 if (mode)
1212 ieee80211_stop_queues_by_reason(&local->hw,
1213 IEEE80211_MAX_QUEUE_MAP,
1214 IEEE80211_QUEUE_STOP_REASON_CSA);
1215
1216 if (local->ops->channel_switch) {
1217 /* use driver's channel switch callback */
1218 struct ieee80211_channel_switch ch_switch = {
1219 .timestamp = timestamp,
1220 .block_tx = mode,
1221 .chandef = new_chandef,
1222 .count = count,
1223 };
1224
1225 drv_channel_switch(local, &ch_switch);
1226 return;
1227 }
1228
1229 /* channel switch handled in software */
1230 if (count <= 1)
1231 ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1232 else
1233 mod_timer(&ifmgd->chswitch_timer,
1234 TU_TO_EXP_TIME(count * cbss->beacon_interval));
1235 }
1236
1237 static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
1238 struct ieee80211_channel *channel,
1239 const u8 *country_ie, u8 country_ie_len,
1240 const u8 *pwr_constr_elem)
1241 {
1242 struct ieee80211_country_ie_triplet *triplet;
1243 int chan = ieee80211_frequency_to_channel(channel->center_freq);
1244 int i, chan_pwr, chan_increment, new_ap_level;
1245 bool have_chan_pwr = false;
1246
1247 /* Invalid IE */
1248 if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1249 return 0;
1250
1251 triplet = (void *)(country_ie + 3);
1252 country_ie_len -= 3;
1253
1254 switch (channel->band) {
1255 default:
1256 WARN_ON_ONCE(1);
1257 /* fall through */
1258 case IEEE80211_BAND_2GHZ:
1259 case IEEE80211_BAND_60GHZ:
1260 chan_increment = 1;
1261 break;
1262 case IEEE80211_BAND_5GHZ:
1263 chan_increment = 4;
1264 break;
1265 }
1266
1267 /* find channel */
1268 while (country_ie_len >= 3) {
1269 u8 first_channel = triplet->chans.first_channel;
1270
1271 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
1272 goto next;
1273
1274 for (i = 0; i < triplet->chans.num_channels; i++) {
1275 if (first_channel + i * chan_increment == chan) {
1276 have_chan_pwr = true;
1277 chan_pwr = triplet->chans.max_power;
1278 break;
1279 }
1280 }
1281 if (have_chan_pwr)
1282 break;
1283
1284 next:
1285 triplet++;
1286 country_ie_len -= 3;
1287 }
1288
1289 if (!have_chan_pwr)
1290 return 0;
1291
1292 new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
1293
1294 if (sdata->ap_power_level == new_ap_level)
1295 return 0;
1296
1297 sdata_info(sdata,
1298 "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
1299 new_ap_level, chan_pwr, *pwr_constr_elem,
1300 sdata->u.mgd.bssid);
1301 sdata->ap_power_level = new_ap_level;
1302 if (__ieee80211_recalc_txpower(sdata))
1303 return BSS_CHANGED_TXPOWER;
1304 return 0;
1305 }
1306
1307 /* powersave */
1308 static void ieee80211_enable_ps(struct ieee80211_local *local,
1309 struct ieee80211_sub_if_data *sdata)
1310 {
1311 struct ieee80211_conf *conf = &local->hw.conf;
1312
1313 /*
1314 * If we are scanning right now then the parameters will
1315 * take effect when scan finishes.
1316 */
1317 if (local->scanning)
1318 return;
1319
1320 if (conf->dynamic_ps_timeout > 0 &&
1321 !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
1322 mod_timer(&local->dynamic_ps_timer, jiffies +
1323 msecs_to_jiffies(conf->dynamic_ps_timeout));
1324 } else {
1325 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1326 ieee80211_send_nullfunc(local, sdata, 1);
1327
1328 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1329 (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
1330 return;
1331
1332 conf->flags |= IEEE80211_CONF_PS;
1333 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1334 }
1335 }
1336
1337 static void ieee80211_change_ps(struct ieee80211_local *local)
1338 {
1339 struct ieee80211_conf *conf = &local->hw.conf;
1340
1341 if (local->ps_sdata) {
1342 ieee80211_enable_ps(local, local->ps_sdata);
1343 } else if (conf->flags & IEEE80211_CONF_PS) {
1344 conf->flags &= ~IEEE80211_CONF_PS;
1345 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1346 del_timer_sync(&local->dynamic_ps_timer);
1347 cancel_work_sync(&local->dynamic_ps_enable_work);
1348 }
1349 }
1350
1351 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
1352 {
1353 struct ieee80211_if_managed *mgd = &sdata->u.mgd;
1354 struct sta_info *sta = NULL;
1355 bool authorized = false;
1356
1357 if (!mgd->powersave)
1358 return false;
1359
1360 if (mgd->broken_ap)
1361 return false;
1362
1363 if (!mgd->associated)
1364 return false;
1365
1366 if (mgd->flags & (IEEE80211_STA_BEACON_POLL |
1367 IEEE80211_STA_CONNECTION_POLL))
1368 return false;
1369
1370 if (!mgd->have_beacon)
1371 return false;
1372
1373 rcu_read_lock();
1374 sta = sta_info_get(sdata, mgd->bssid);
1375 if (sta)
1376 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1377 rcu_read_unlock();
1378
1379 return authorized;
1380 }
1381
1382 /* need to hold RTNL or interface lock */
1383 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1384 {
1385 struct ieee80211_sub_if_data *sdata, *found = NULL;
1386 int count = 0;
1387 int timeout;
1388
1389 if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
1390 local->ps_sdata = NULL;
1391 return;
1392 }
1393
1394 list_for_each_entry(sdata, &local->interfaces, list) {
1395 if (!ieee80211_sdata_running(sdata))
1396 continue;
1397 if (sdata->vif.type == NL80211_IFTYPE_AP) {
1398 /* If an AP vif is found, then disable PS
1399 * by setting the count to zero thereby setting
1400 * ps_sdata to NULL.
1401 */
1402 count = 0;
1403 break;
1404 }
1405 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1406 continue;
1407 found = sdata;
1408 count++;
1409 }
1410
1411 if (count == 1 && ieee80211_powersave_allowed(found)) {
1412 s32 beaconint_us;
1413
1414 if (latency < 0)
1415 latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1416
1417 beaconint_us = ieee80211_tu_to_usec(
1418 found->vif.bss_conf.beacon_int);
1419
1420 timeout = local->dynamic_ps_forced_timeout;
1421 if (timeout < 0) {
1422 /*
1423 * Go to full PSM if the user configures a very low
1424 * latency requirement.
1425 * The 2000 second value is there for compatibility
1426 * until the PM_QOS_NETWORK_LATENCY is configured
1427 * with real values.
1428 */
1429 if (latency > (1900 * USEC_PER_MSEC) &&
1430 latency != (2000 * USEC_PER_SEC))
1431 timeout = 0;
1432 else
1433 timeout = 100;
1434 }
1435 local->hw.conf.dynamic_ps_timeout = timeout;
1436
1437 if (beaconint_us > latency) {
1438 local->ps_sdata = NULL;
1439 } else {
1440 int maxslp = 1;
1441 u8 dtimper = found->u.mgd.dtim_period;
1442
1443 /* If the TIM IE is invalid, pretend the value is 1 */
1444 if (!dtimper)
1445 dtimper = 1;
1446 else if (dtimper > 1)
1447 maxslp = min_t(int, dtimper,
1448 latency / beaconint_us);
1449
1450 local->hw.conf.max_sleep_period = maxslp;
1451 local->hw.conf.ps_dtim_period = dtimper;
1452 local->ps_sdata = found;
1453 }
1454 } else {
1455 local->ps_sdata = NULL;
1456 }
1457
1458 ieee80211_change_ps(local);
1459 }
1460
1461 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
1462 {
1463 bool ps_allowed = ieee80211_powersave_allowed(sdata);
1464
1465 if (sdata->vif.bss_conf.ps != ps_allowed) {
1466 sdata->vif.bss_conf.ps = ps_allowed;
1467 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
1468 }
1469 }
1470
1471 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
1472 {
1473 struct ieee80211_local *local =
1474 container_of(work, struct ieee80211_local,
1475 dynamic_ps_disable_work);
1476
1477 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1478 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1479 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1480 }
1481
1482 ieee80211_wake_queues_by_reason(&local->hw,
1483 IEEE80211_MAX_QUEUE_MAP,
1484 IEEE80211_QUEUE_STOP_REASON_PS);
1485 }
1486
1487 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
1488 {
1489 struct ieee80211_local *local =
1490 container_of(work, struct ieee80211_local,
1491 dynamic_ps_enable_work);
1492 struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1493 struct ieee80211_if_managed *ifmgd;
1494 unsigned long flags;
1495 int q;
1496
1497 /* can only happen when PS was just disabled anyway */
1498 if (!sdata)
1499 return;
1500
1501 ifmgd = &sdata->u.mgd;
1502
1503 if (local->hw.conf.flags & IEEE80211_CONF_PS)
1504 return;
1505
1506 if (local->hw.conf.dynamic_ps_timeout > 0) {
1507 /* don't enter PS if TX frames are pending */
1508 if (drv_tx_frames_pending(local)) {
1509 mod_timer(&local->dynamic_ps_timer, jiffies +
1510 msecs_to_jiffies(
1511 local->hw.conf.dynamic_ps_timeout));
1512 return;
1513 }
1514
1515 /*
1516 * transmission can be stopped by others which leads to
1517 * dynamic_ps_timer expiry. Postpone the ps timer if it
1518 * is not the actual idle state.
1519 */
1520 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1521 for (q = 0; q < local->hw.queues; q++) {
1522 if (local->queue_stop_reasons[q]) {
1523 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1524 flags);
1525 mod_timer(&local->dynamic_ps_timer, jiffies +
1526 msecs_to_jiffies(
1527 local->hw.conf.dynamic_ps_timeout));
1528 return;
1529 }
1530 }
1531 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1532 }
1533
1534 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1535 !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1536 if (drv_tx_frames_pending(local)) {
1537 mod_timer(&local->dynamic_ps_timer, jiffies +
1538 msecs_to_jiffies(
1539 local->hw.conf.dynamic_ps_timeout));
1540 } else {
1541 ieee80211_send_nullfunc(local, sdata, 1);
1542 /* Flush to get the tx status of nullfunc frame */
1543 ieee80211_flush_queues(local, sdata);
1544 }
1545 }
1546
1547 if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
1548 (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
1549 (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1550 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
1551 local->hw.conf.flags |= IEEE80211_CONF_PS;
1552 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1553 }
1554 }
1555
1556 void ieee80211_dynamic_ps_timer(unsigned long data)
1557 {
1558 struct ieee80211_local *local = (void *) data;
1559
1560 if (local->quiescing || local->suspended)
1561 return;
1562
1563 ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1564 }
1565
1566 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
1567 {
1568 struct delayed_work *delayed_work =
1569 container_of(work, struct delayed_work, work);
1570 struct ieee80211_sub_if_data *sdata =
1571 container_of(delayed_work, struct ieee80211_sub_if_data,
1572 dfs_cac_timer_work);
1573
1574 ieee80211_vif_release_channel(sdata);
1575
1576 cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
1577 }
1578
1579 /* MLME */
1580 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1581 struct ieee80211_sub_if_data *sdata,
1582 const u8 *wmm_param, size_t wmm_param_len)
1583 {
1584 struct ieee80211_tx_queue_params params;
1585 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1586 size_t left;
1587 int count;
1588 const u8 *pos;
1589 u8 uapsd_queues = 0;
1590
1591 if (!local->ops->conf_tx)
1592 return false;
1593
1594 if (local->hw.queues < IEEE80211_NUM_ACS)
1595 return false;
1596
1597 if (!wmm_param)
1598 return false;
1599
1600 if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1601 return false;
1602
1603 if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1604 uapsd_queues = ifmgd->uapsd_queues;
1605
1606 count = wmm_param[6] & 0x0f;
1607 if (count == ifmgd->wmm_last_param_set)
1608 return false;
1609 ifmgd->wmm_last_param_set = count;
1610
1611 pos = wmm_param + 8;
1612 left = wmm_param_len - 8;
1613
1614 memset(&params, 0, sizeof(params));
1615
1616 sdata->wmm_acm = 0;
1617 for (; left >= 4; left -= 4, pos += 4) {
1618 int aci = (pos[0] >> 5) & 0x03;
1619 int acm = (pos[0] >> 4) & 0x01;
1620 bool uapsd = false;
1621 int queue;
1622
1623 switch (aci) {
1624 case 1: /* AC_BK */
1625 queue = 3;
1626 if (acm)
1627 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
1628 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
1629 uapsd = true;
1630 break;
1631 case 2: /* AC_VI */
1632 queue = 1;
1633 if (acm)
1634 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
1635 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
1636 uapsd = true;
1637 break;
1638 case 3: /* AC_VO */
1639 queue = 0;
1640 if (acm)
1641 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
1642 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
1643 uapsd = true;
1644 break;
1645 case 0: /* AC_BE */
1646 default:
1647 queue = 2;
1648 if (acm)
1649 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
1650 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
1651 uapsd = true;
1652 break;
1653 }
1654
1655 params.aifs = pos[0] & 0x0f;
1656 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
1657 params.cw_min = ecw2cw(pos[1] & 0x0f);
1658 params.txop = get_unaligned_le16(pos + 2);
1659 params.acm = acm;
1660 params.uapsd = uapsd;
1661
1662 mlme_dbg(sdata,
1663 "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
1664 queue, aci, acm,
1665 params.aifs, params.cw_min, params.cw_max,
1666 params.txop, params.uapsd);
1667 sdata->tx_conf[queue] = params;
1668 if (drv_conf_tx(local, sdata, queue, &params))
1669 sdata_err(sdata,
1670 "failed to set TX queue parameters for queue %d\n",
1671 queue);
1672 }
1673
1674 /* enable WMM or activate new settings */
1675 sdata->vif.bss_conf.qos = true;
1676 return true;
1677 }
1678
1679 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1680 {
1681 lockdep_assert_held(&sdata->local->mtx);
1682
1683 sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
1684 IEEE80211_STA_BEACON_POLL);
1685 ieee80211_run_deferred_scan(sdata->local);
1686 }
1687
1688 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1689 {
1690 mutex_lock(&sdata->local->mtx);
1691 __ieee80211_stop_poll(sdata);
1692 mutex_unlock(&sdata->local->mtx);
1693 }
1694
1695 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
1696 u16 capab, bool erp_valid, u8 erp)
1697 {
1698 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1699 u32 changed = 0;
1700 bool use_protection;
1701 bool use_short_preamble;
1702 bool use_short_slot;
1703
1704 if (erp_valid) {
1705 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
1706 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
1707 } else {
1708 use_protection = false;
1709 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
1710 }
1711
1712 use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
1713 if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1714 use_short_slot = true;
1715
1716 if (use_protection != bss_conf->use_cts_prot) {
1717 bss_conf->use_cts_prot = use_protection;
1718 changed |= BSS_CHANGED_ERP_CTS_PROT;
1719 }
1720
1721 if (use_short_preamble != bss_conf->use_short_preamble) {
1722 bss_conf->use_short_preamble = use_short_preamble;
1723 changed |= BSS_CHANGED_ERP_PREAMBLE;
1724 }
1725
1726 if (use_short_slot != bss_conf->use_short_slot) {
1727 bss_conf->use_short_slot = use_short_slot;
1728 changed |= BSS_CHANGED_ERP_SLOT;
1729 }
1730
1731 return changed;
1732 }
1733
1734 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1735 struct cfg80211_bss *cbss,
1736 u32 bss_info_changed)
1737 {
1738 struct ieee80211_bss *bss = (void *)cbss->priv;
1739 struct ieee80211_local *local = sdata->local;
1740 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1741
1742 bss_info_changed |= BSS_CHANGED_ASSOC;
1743 bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1744 bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1745
1746 sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1747 beacon_loss_count * bss_conf->beacon_int));
1748
1749 sdata->u.mgd.associated = cbss;
1750 memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1751
1752 sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
1753
1754 if (sdata->vif.p2p) {
1755 const struct cfg80211_bss_ies *ies;
1756
1757 rcu_read_lock();
1758 ies = rcu_dereference(cbss->ies);
1759 if (ies) {
1760 int ret;
1761
1762 ret = cfg80211_get_p2p_attr(
1763 ies->data, ies->len,
1764 IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
1765 (u8 *) &bss_conf->p2p_noa_attr,
1766 sizeof(bss_conf->p2p_noa_attr));
1767 if (ret >= 2) {
1768 sdata->u.mgd.p2p_noa_index =
1769 bss_conf->p2p_noa_attr.index;
1770 bss_info_changed |= BSS_CHANGED_P2P_PS;
1771 }
1772 }
1773 rcu_read_unlock();
1774 }
1775
1776 /* just to be sure */
1777 ieee80211_stop_poll(sdata);
1778
1779 ieee80211_led_assoc(local, 1);
1780
1781 if (sdata->u.mgd.have_beacon) {
1782 /*
1783 * If the AP is buggy we may get here with no DTIM period
1784 * known, so assume it's 1 which is the only safe assumption
1785 * in that case, although if the TIM IE is broken powersave
1786 * probably just won't work at all.
1787 */
1788 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1789 bss_conf->beacon_rate = bss->beacon_rate;
1790 bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1791 } else {
1792 bss_conf->beacon_rate = NULL;
1793 bss_conf->dtim_period = 0;
1794 }
1795
1796 bss_conf->assoc = 1;
1797
1798 /* Tell the driver to monitor connection quality (if supported) */
1799 if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1800 bss_conf->cqm_rssi_thold)
1801 bss_info_changed |= BSS_CHANGED_CQM;
1802
1803 /* Enable ARP filtering */
1804 if (bss_conf->arp_addr_cnt)
1805 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
1806
1807 ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1808
1809 mutex_lock(&local->iflist_mtx);
1810 ieee80211_recalc_ps(local, -1);
1811 mutex_unlock(&local->iflist_mtx);
1812
1813 ieee80211_recalc_smps(sdata);
1814 ieee80211_recalc_ps_vif(sdata);
1815
1816 netif_carrier_on(sdata->dev);
1817 }
1818
1819 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1820 u16 stype, u16 reason, bool tx,
1821 u8 *frame_buf)
1822 {
1823 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1824 struct ieee80211_local *local = sdata->local;
1825 u32 changed = 0;
1826
1827 sdata_assert_lock(sdata);
1828
1829 if (WARN_ON_ONCE(tx && !frame_buf))
1830 return;
1831
1832 if (WARN_ON(!ifmgd->associated))
1833 return;
1834
1835 ieee80211_stop_poll(sdata);
1836
1837 ifmgd->associated = NULL;
1838 netif_carrier_off(sdata->dev);
1839
1840 /*
1841 * if we want to get out of ps before disassoc (why?) we have
1842 * to do it before sending disassoc, as otherwise the null-packet
1843 * won't be valid.
1844 */
1845 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1846 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1847 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1848 }
1849 local->ps_sdata = NULL;
1850
1851 /* disable per-vif ps */
1852 ieee80211_recalc_ps_vif(sdata);
1853
1854 /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
1855 if (tx)
1856 ieee80211_flush_queues(local, sdata);
1857
1858 /* deauthenticate/disassociate now */
1859 if (tx || frame_buf)
1860 ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
1861 reason, tx, frame_buf);
1862
1863 /* flush out frame */
1864 if (tx)
1865 ieee80211_flush_queues(local, sdata);
1866
1867 /* clear bssid only after building the needed mgmt frames */
1868 memset(ifmgd->bssid, 0, ETH_ALEN);
1869
1870 /* remove AP and TDLS peers */
1871 sta_info_flush_defer(sdata);
1872
1873 /* finally reset all BSS / config parameters */
1874 changed |= ieee80211_reset_erp_info(sdata);
1875
1876 ieee80211_led_assoc(local, 0);
1877 changed |= BSS_CHANGED_ASSOC;
1878 sdata->vif.bss_conf.assoc = false;
1879
1880 ifmgd->p2p_noa_index = -1;
1881 memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
1882 sizeof(sdata->vif.bss_conf.p2p_noa_attr));
1883
1884 /* on the next assoc, re-program HT/VHT parameters */
1885 memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
1886 memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
1887 memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
1888 memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
1889
1890 sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
1891
1892 del_timer_sync(&local->dynamic_ps_timer);
1893 cancel_work_sync(&local->dynamic_ps_enable_work);
1894
1895 /* Disable ARP filtering */
1896 if (sdata->vif.bss_conf.arp_addr_cnt)
1897 changed |= BSS_CHANGED_ARP_FILTER;
1898
1899 sdata->vif.bss_conf.qos = false;
1900 changed |= BSS_CHANGED_QOS;
1901
1902 /* The BSSID (not really interesting) and HT changed */
1903 changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
1904 ieee80211_bss_info_change_notify(sdata, changed);
1905
1906 /* disassociated - set to defaults now */
1907 ieee80211_set_wmm_default(sdata, false);
1908
1909 del_timer_sync(&sdata->u.mgd.conn_mon_timer);
1910 del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
1911 del_timer_sync(&sdata->u.mgd.timer);
1912 del_timer_sync(&sdata->u.mgd.chswitch_timer);
1913
1914 sdata->vif.bss_conf.dtim_period = 0;
1915 sdata->vif.bss_conf.beacon_rate = NULL;
1916
1917 ifmgd->have_beacon = false;
1918
1919 ifmgd->flags = 0;
1920 ieee80211_vif_release_channel(sdata);
1921 }
1922
1923 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
1924 struct ieee80211_hdr *hdr)
1925 {
1926 /*
1927 * We can postpone the mgd.timer whenever receiving unicast frames
1928 * from AP because we know that the connection is working both ways
1929 * at that time. But multicast frames (and hence also beacons) must
1930 * be ignored here, because we need to trigger the timer during
1931 * data idle periods for sending the periodic probe request to the
1932 * AP we're connected to.
1933 */
1934 if (is_multicast_ether_addr(hdr->addr1))
1935 return;
1936
1937 ieee80211_sta_reset_conn_monitor(sdata);
1938 }
1939
1940 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
1941 {
1942 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1943 struct ieee80211_local *local = sdata->local;
1944
1945 mutex_lock(&local->mtx);
1946 if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
1947 IEEE80211_STA_CONNECTION_POLL))) {
1948 mutex_unlock(&local->mtx);
1949 return;
1950 }
1951
1952 __ieee80211_stop_poll(sdata);
1953
1954 mutex_lock(&local->iflist_mtx);
1955 ieee80211_recalc_ps(local, -1);
1956 mutex_unlock(&local->iflist_mtx);
1957
1958 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
1959 goto out;
1960
1961 /*
1962 * We've received a probe response, but are not sure whether
1963 * we have or will be receiving any beacons or data, so let's
1964 * schedule the timers again, just in case.
1965 */
1966 ieee80211_sta_reset_beacon_monitor(sdata);
1967
1968 mod_timer(&ifmgd->conn_mon_timer,
1969 round_jiffies_up(jiffies +
1970 IEEE80211_CONNECTION_IDLE_TIME));
1971 out:
1972 mutex_unlock(&local->mtx);
1973 }
1974
1975 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
1976 struct ieee80211_hdr *hdr, bool ack)
1977 {
1978 if (!ieee80211_is_data(hdr->frame_control))
1979 return;
1980
1981 if (ieee80211_is_nullfunc(hdr->frame_control) &&
1982 sdata->u.mgd.probe_send_count > 0) {
1983 if (ack)
1984 ieee80211_sta_reset_conn_monitor(sdata);
1985 else
1986 sdata->u.mgd.nullfunc_failed = true;
1987 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1988 return;
1989 }
1990
1991 if (ack)
1992 ieee80211_sta_reset_conn_monitor(sdata);
1993 }
1994
1995 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
1996 {
1997 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1998 const u8 *ssid;
1999 u8 *dst = ifmgd->associated->bssid;
2000 u8 unicast_limit = max(1, max_probe_tries - 3);
2001
2002 /*
2003 * Try sending broadcast probe requests for the last three
2004 * probe requests after the first ones failed since some
2005 * buggy APs only support broadcast probe requests.
2006 */
2007 if (ifmgd->probe_send_count >= unicast_limit)
2008 dst = NULL;
2009
2010 /*
2011 * When the hardware reports an accurate Tx ACK status, it's
2012 * better to send a nullfunc frame instead of a probe request,
2013 * as it will kick us off the AP quickly if we aren't associated
2014 * anymore. The timeout will be reset if the frame is ACKed by
2015 * the AP.
2016 */
2017 ifmgd->probe_send_count++;
2018
2019 if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
2020 ifmgd->nullfunc_failed = false;
2021 ieee80211_send_nullfunc(sdata->local, sdata, 0);
2022 } else {
2023 int ssid_len;
2024
2025 rcu_read_lock();
2026 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2027 if (WARN_ON_ONCE(ssid == NULL))
2028 ssid_len = 0;
2029 else
2030 ssid_len = ssid[1];
2031
2032 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
2033 0, (u32) -1, true, 0,
2034 ifmgd->associated->channel, false);
2035 rcu_read_unlock();
2036 }
2037
2038 ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2039 run_again(sdata, ifmgd->probe_timeout);
2040 if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2041 ieee80211_flush_queues(sdata->local, sdata);
2042 }
2043
2044 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
2045 bool beacon)
2046 {
2047 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2048 bool already = false;
2049
2050 if (!ieee80211_sdata_running(sdata))
2051 return;
2052
2053 sdata_lock(sdata);
2054
2055 if (!ifmgd->associated)
2056 goto out;
2057
2058 mutex_lock(&sdata->local->mtx);
2059
2060 if (sdata->local->tmp_channel || sdata->local->scanning) {
2061 mutex_unlock(&sdata->local->mtx);
2062 goto out;
2063 }
2064
2065 if (beacon) {
2066 mlme_dbg_ratelimited(sdata,
2067 "detected beacon loss from AP (missed %d beacons) - probing\n",
2068 beacon_loss_count);
2069
2070 ieee80211_cqm_rssi_notify(&sdata->vif,
2071 NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
2072 GFP_KERNEL);
2073 }
2074
2075 /*
2076 * The driver/our work has already reported this event or the
2077 * connection monitoring has kicked in and we have already sent
2078 * a probe request. Or maybe the AP died and the driver keeps
2079 * reporting until we disassociate...
2080 *
2081 * In either case we have to ignore the current call to this
2082 * function (except for setting the correct probe reason bit)
2083 * because otherwise we would reset the timer every time and
2084 * never check whether we received a probe response!
2085 */
2086 if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
2087 IEEE80211_STA_CONNECTION_POLL))
2088 already = true;
2089
2090 if (beacon)
2091 ifmgd->flags |= IEEE80211_STA_BEACON_POLL;
2092 else
2093 ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
2094
2095 mutex_unlock(&sdata->local->mtx);
2096
2097 if (already)
2098 goto out;
2099
2100 mutex_lock(&sdata->local->iflist_mtx);
2101 ieee80211_recalc_ps(sdata->local, -1);
2102 mutex_unlock(&sdata->local->iflist_mtx);
2103
2104 ifmgd->probe_send_count = 0;
2105 ieee80211_mgd_probe_ap_send(sdata);
2106 out:
2107 sdata_unlock(sdata);
2108 }
2109
2110 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
2111 struct ieee80211_vif *vif)
2112 {
2113 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2114 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2115 struct cfg80211_bss *cbss;
2116 struct sk_buff *skb;
2117 const u8 *ssid;
2118 int ssid_len;
2119
2120 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2121 return NULL;
2122
2123 sdata_assert_lock(sdata);
2124
2125 if (ifmgd->associated)
2126 cbss = ifmgd->associated;
2127 else if (ifmgd->auth_data)
2128 cbss = ifmgd->auth_data->bss;
2129 else if (ifmgd->assoc_data)
2130 cbss = ifmgd->assoc_data->bss;
2131 else
2132 return NULL;
2133
2134 rcu_read_lock();
2135 ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2136 if (WARN_ON_ONCE(ssid == NULL))
2137 ssid_len = 0;
2138 else
2139 ssid_len = ssid[1];
2140
2141 skb = ieee80211_build_probe_req(sdata, cbss->bssid,
2142 (u32) -1, cbss->channel,
2143 ssid + 2, ssid_len,
2144 NULL, 0, true);
2145 rcu_read_unlock();
2146
2147 return skb;
2148 }
2149 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
2150
2151 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2152 {
2153 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2154 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2155
2156 sdata_lock(sdata);
2157 if (!ifmgd->associated) {
2158 sdata_unlock(sdata);
2159 return;
2160 }
2161
2162 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
2163 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2164 true, frame_buf);
2165 ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
2166 ieee80211_wake_queues_by_reason(&sdata->local->hw,
2167 IEEE80211_MAX_QUEUE_MAP,
2168 IEEE80211_QUEUE_STOP_REASON_CSA);
2169
2170 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
2171 IEEE80211_DEAUTH_FRAME_LEN);
2172 sdata_unlock(sdata);
2173 }
2174
2175 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
2176 {
2177 struct ieee80211_sub_if_data *sdata =
2178 container_of(work, struct ieee80211_sub_if_data,
2179 u.mgd.beacon_connection_loss_work);
2180 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2181 struct sta_info *sta;
2182
2183 if (ifmgd->associated) {
2184 rcu_read_lock();
2185 sta = sta_info_get(sdata, ifmgd->bssid);
2186 if (sta)
2187 sta->beacon_loss_count++;
2188 rcu_read_unlock();
2189 }
2190
2191 if (ifmgd->connection_loss) {
2192 sdata_info(sdata, "Connection to AP %pM lost\n",
2193 ifmgd->bssid);
2194 __ieee80211_disconnect(sdata);
2195 } else {
2196 ieee80211_mgd_probe_ap(sdata, true);
2197 }
2198 }
2199
2200 static void ieee80211_csa_connection_drop_work(struct work_struct *work)
2201 {
2202 struct ieee80211_sub_if_data *sdata =
2203 container_of(work, struct ieee80211_sub_if_data,
2204 u.mgd.csa_connection_drop_work);
2205
2206 __ieee80211_disconnect(sdata);
2207 }
2208
2209 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
2210 {
2211 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2212 struct ieee80211_hw *hw = &sdata->local->hw;
2213
2214 trace_api_beacon_loss(sdata);
2215
2216 sdata->u.mgd.connection_loss = false;
2217 ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2218 }
2219 EXPORT_SYMBOL(ieee80211_beacon_loss);
2220
2221 void ieee80211_connection_loss(struct ieee80211_vif *vif)
2222 {
2223 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2224 struct ieee80211_hw *hw = &sdata->local->hw;
2225
2226 trace_api_connection_loss(sdata);
2227
2228 sdata->u.mgd.connection_loss = true;
2229 ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2230 }
2231 EXPORT_SYMBOL(ieee80211_connection_loss);
2232
2233
2234 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
2235 bool assoc)
2236 {
2237 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2238
2239 sdata_assert_lock(sdata);
2240
2241 if (!assoc) {
2242 sta_info_destroy_addr(sdata, auth_data->bss->bssid);
2243
2244 memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2245 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2246 sdata->u.mgd.flags = 0;
2247 ieee80211_vif_release_channel(sdata);
2248 }
2249
2250 cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
2251 kfree(auth_data);
2252 sdata->u.mgd.auth_data = NULL;
2253 }
2254
2255 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
2256 struct ieee80211_mgmt *mgmt, size_t len)
2257 {
2258 struct ieee80211_local *local = sdata->local;
2259 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2260 u8 *pos;
2261 struct ieee802_11_elems elems;
2262 u32 tx_flags = 0;
2263
2264 pos = mgmt->u.auth.variable;
2265 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2266 if (!elems.challenge)
2267 return;
2268 auth_data->expected_transaction = 4;
2269 drv_mgd_prepare_tx(sdata->local, sdata);
2270 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2271 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2272 IEEE80211_TX_INTFL_MLME_CONN_TX;
2273 ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
2274 elems.challenge - 2, elems.challenge_len + 2,
2275 auth_data->bss->bssid, auth_data->bss->bssid,
2276 auth_data->key, auth_data->key_len,
2277 auth_data->key_idx, tx_flags);
2278 }
2279
2280 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
2281 struct ieee80211_mgmt *mgmt, size_t len)
2282 {
2283 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2284 u8 bssid[ETH_ALEN];
2285 u16 auth_alg, auth_transaction, status_code;
2286 struct sta_info *sta;
2287
2288 sdata_assert_lock(sdata);
2289
2290 if (len < 24 + 6)
2291 return;
2292
2293 if (!ifmgd->auth_data || ifmgd->auth_data->done)
2294 return;
2295
2296 memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
2297
2298 if (!ether_addr_equal(bssid, mgmt->bssid))
2299 return;
2300
2301 auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
2302 auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
2303 status_code = le16_to_cpu(mgmt->u.auth.status_code);
2304
2305 if (auth_alg != ifmgd->auth_data->algorithm ||
2306 auth_transaction != ifmgd->auth_data->expected_transaction) {
2307 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
2308 mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
2309 auth_transaction,
2310 ifmgd->auth_data->expected_transaction);
2311 return;
2312 }
2313
2314 if (status_code != WLAN_STATUS_SUCCESS) {
2315 sdata_info(sdata, "%pM denied authentication (status %d)\n",
2316 mgmt->sa, status_code);
2317 ieee80211_destroy_auth_data(sdata, false);
2318 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2319 return;
2320 }
2321
2322 switch (ifmgd->auth_data->algorithm) {
2323 case WLAN_AUTH_OPEN:
2324 case WLAN_AUTH_LEAP:
2325 case WLAN_AUTH_FT:
2326 case WLAN_AUTH_SAE:
2327 break;
2328 case WLAN_AUTH_SHARED_KEY:
2329 if (ifmgd->auth_data->expected_transaction != 4) {
2330 ieee80211_auth_challenge(sdata, mgmt, len);
2331 /* need another frame */
2332 return;
2333 }
2334 break;
2335 default:
2336 WARN_ONCE(1, "invalid auth alg %d",
2337 ifmgd->auth_data->algorithm);
2338 return;
2339 }
2340
2341 sdata_info(sdata, "authenticated\n");
2342 ifmgd->auth_data->done = true;
2343 ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2344 ifmgd->auth_data->timeout_started = true;
2345 run_again(sdata, ifmgd->auth_data->timeout);
2346
2347 if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
2348 ifmgd->auth_data->expected_transaction != 2) {
2349 /*
2350 * Report auth frame to user space for processing since another
2351 * round of Authentication frames is still needed.
2352 */
2353 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2354 return;
2355 }
2356
2357 /* move station state to auth */
2358 mutex_lock(&sdata->local->sta_mtx);
2359 sta = sta_info_get(sdata, bssid);
2360 if (!sta) {
2361 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2362 goto out_err;
2363 }
2364 if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
2365 sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2366 goto out_err;
2367 }
2368 mutex_unlock(&sdata->local->sta_mtx);
2369
2370 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2371 return;
2372 out_err:
2373 mutex_unlock(&sdata->local->sta_mtx);
2374 /* ignore frame -- wait for timeout */
2375 }
2376
2377
2378 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
2379 struct ieee80211_mgmt *mgmt, size_t len)
2380 {
2381 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2382 const u8 *bssid = NULL;
2383 u16 reason_code;
2384
2385 sdata_assert_lock(sdata);
2386
2387 if (len < 24 + 2)
2388 return;
2389
2390 if (!ifmgd->associated ||
2391 !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2392 return;
2393
2394 bssid = ifmgd->associated->bssid;
2395
2396 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2397
2398 sdata_info(sdata, "deauthenticated from %pM (Reason: %u)\n",
2399 bssid, reason_code);
2400
2401 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2402
2403 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2404 }
2405
2406
2407 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
2408 struct ieee80211_mgmt *mgmt, size_t len)
2409 {
2410 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2411 u16 reason_code;
2412
2413 sdata_assert_lock(sdata);
2414
2415 if (len < 24 + 2)
2416 return;
2417
2418 if (!ifmgd->associated ||
2419 !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2420 return;
2421
2422 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
2423
2424 sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
2425 mgmt->sa, reason_code);
2426
2427 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2428
2429 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2430 }
2431
2432 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
2433 u8 *supp_rates, unsigned int supp_rates_len,
2434 u32 *rates, u32 *basic_rates,
2435 bool *have_higher_than_11mbit,
2436 int *min_rate, int *min_rate_index,
2437 int shift, u32 rate_flags)
2438 {
2439 int i, j;
2440
2441 for (i = 0; i < supp_rates_len; i++) {
2442 int rate = supp_rates[i] & 0x7f;
2443 bool is_basic = !!(supp_rates[i] & 0x80);
2444
2445 if ((rate * 5 * (1 << shift)) > 110)
2446 *have_higher_than_11mbit = true;
2447
2448 /*
2449 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
2450 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
2451 *
2452 * Note: Even through the membership selector and the basic
2453 * rate flag share the same bit, they are not exactly
2454 * the same.
2455 */
2456 if (!!(supp_rates[i] & 0x80) &&
2457 (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
2458 continue;
2459
2460 for (j = 0; j < sband->n_bitrates; j++) {
2461 struct ieee80211_rate *br;
2462 int brate;
2463
2464 br = &sband->bitrates[j];
2465 if ((rate_flags & br->flags) != rate_flags)
2466 continue;
2467
2468 brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
2469 if (brate == rate) {
2470 *rates |= BIT(j);
2471 if (is_basic)
2472 *basic_rates |= BIT(j);
2473 if ((rate * 5) < *min_rate) {
2474 *min_rate = rate * 5;
2475 *min_rate_index = j;
2476 }
2477 break;
2478 }
2479 }
2480 }
2481 }
2482
2483 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2484 bool assoc)
2485 {
2486 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2487
2488 sdata_assert_lock(sdata);
2489
2490 if (!assoc) {
2491 sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
2492
2493 memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2494 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2495 sdata->u.mgd.flags = 0;
2496 ieee80211_vif_release_channel(sdata);
2497 }
2498
2499 kfree(assoc_data);
2500 sdata->u.mgd.assoc_data = NULL;
2501 }
2502
2503 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
2504 struct cfg80211_bss *cbss,
2505 struct ieee80211_mgmt *mgmt, size_t len)
2506 {
2507 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2508 struct ieee80211_local *local = sdata->local;
2509 struct ieee80211_supported_band *sband;
2510 struct sta_info *sta;
2511 u8 *pos;
2512 u16 capab_info, aid;
2513 struct ieee802_11_elems elems;
2514 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2515 const struct cfg80211_bss_ies *bss_ies = NULL;
2516 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2517 u32 changed = 0;
2518 int err;
2519 bool ret;
2520
2521 /* AssocResp and ReassocResp have identical structure */
2522
2523 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2524 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2525
2526 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
2527 sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
2528 aid);
2529 aid &= ~(BIT(15) | BIT(14));
2530
2531 ifmgd->broken_ap = false;
2532
2533 if (aid == 0 || aid > IEEE80211_MAX_AID) {
2534 sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
2535 aid);
2536 aid = 0;
2537 ifmgd->broken_ap = true;
2538 }
2539
2540 pos = mgmt->u.assoc_resp.variable;
2541 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2542
2543 if (!elems.supp_rates) {
2544 sdata_info(sdata, "no SuppRates element in AssocResp\n");
2545 return false;
2546 }
2547
2548 ifmgd->aid = aid;
2549
2550 /*
2551 * Some APs are erroneously not including some information in their
2552 * (re)association response frames. Try to recover by using the data
2553 * from the beacon or probe response. This seems to afflict mobile
2554 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
2555 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
2556 */
2557 if ((assoc_data->wmm && !elems.wmm_param) ||
2558 (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2559 (!elems.ht_cap_elem || !elems.ht_operation)) ||
2560 (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2561 (!elems.vht_cap_elem || !elems.vht_operation))) {
2562 const struct cfg80211_bss_ies *ies;
2563 struct ieee802_11_elems bss_elems;
2564
2565 rcu_read_lock();
2566 ies = rcu_dereference(cbss->ies);
2567 if (ies)
2568 bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
2569 GFP_ATOMIC);
2570 rcu_read_unlock();
2571 if (!bss_ies)
2572 return false;
2573
2574 ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
2575 false, &bss_elems);
2576 if (assoc_data->wmm &&
2577 !elems.wmm_param && bss_elems.wmm_param) {
2578 elems.wmm_param = bss_elems.wmm_param;
2579 sdata_info(sdata,
2580 "AP bug: WMM param missing from AssocResp\n");
2581 }
2582
2583 /*
2584 * Also check if we requested HT/VHT, otherwise the AP doesn't
2585 * have to include the IEs in the (re)association response.
2586 */
2587 if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
2588 !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2589 elems.ht_cap_elem = bss_elems.ht_cap_elem;
2590 sdata_info(sdata,
2591 "AP bug: HT capability missing from AssocResp\n");
2592 }
2593 if (!elems.ht_operation && bss_elems.ht_operation &&
2594 !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2595 elems.ht_operation = bss_elems.ht_operation;
2596 sdata_info(sdata,
2597 "AP bug: HT operation missing from AssocResp\n");
2598 }
2599 if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
2600 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2601 elems.vht_cap_elem = bss_elems.vht_cap_elem;
2602 sdata_info(sdata,
2603 "AP bug: VHT capa missing from AssocResp\n");
2604 }
2605 if (!elems.vht_operation && bss_elems.vht_operation &&
2606 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2607 elems.vht_operation = bss_elems.vht_operation;
2608 sdata_info(sdata,
2609 "AP bug: VHT operation missing from AssocResp\n");
2610 }
2611 }
2612
2613 /*
2614 * We previously checked these in the beacon/probe response, so
2615 * they should be present here. This is just a safety net.
2616 */
2617 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2618 (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
2619 sdata_info(sdata,
2620 "HT AP is missing WMM params or HT capability/operation\n");
2621 ret = false;
2622 goto out;
2623 }
2624
2625 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2626 (!elems.vht_cap_elem || !elems.vht_operation)) {
2627 sdata_info(sdata,
2628 "VHT AP is missing VHT capability/operation\n");
2629 ret = false;
2630 goto out;
2631 }
2632
2633 mutex_lock(&sdata->local->sta_mtx);
2634 /*
2635 * station info was already allocated and inserted before
2636 * the association and should be available to us
2637 */
2638 sta = sta_info_get(sdata, cbss->bssid);
2639 if (WARN_ON(!sta)) {
2640 mutex_unlock(&sdata->local->sta_mtx);
2641 ret = false;
2642 goto out;
2643 }
2644
2645 sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2646
2647 /* Set up internal HT/VHT capabilities */
2648 if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
2649 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2650 elems.ht_cap_elem, sta);
2651
2652 if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
2653 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2654 elems.vht_cap_elem, sta);
2655
2656 /*
2657 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
2658 * in their association response, so ignore that data for our own
2659 * configuration. If it changed since the last beacon, we'll get the
2660 * next beacon and update then.
2661 */
2662
2663 /*
2664 * If an operating mode notification IE is present, override the
2665 * NSS calculation (that would be done in rate_control_rate_init())
2666 * and use the # of streams from that element.
2667 */
2668 if (elems.opmode_notif &&
2669 !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
2670 u8 nss;
2671
2672 nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
2673 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
2674 nss += 1;
2675 sta->sta.rx_nss = nss;
2676 }
2677
2678 rate_control_rate_init(sta);
2679
2680 if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
2681 set_sta_flag(sta, WLAN_STA_MFP);
2682
2683 if (elems.wmm_param)
2684 set_sta_flag(sta, WLAN_STA_WME);
2685
2686 err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
2687 if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
2688 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
2689 if (err) {
2690 sdata_info(sdata,
2691 "failed to move station %pM to desired state\n",
2692 sta->sta.addr);
2693 WARN_ON(__sta_info_destroy(sta));
2694 mutex_unlock(&sdata->local->sta_mtx);
2695 ret = false;
2696 goto out;
2697 }
2698
2699 mutex_unlock(&sdata->local->sta_mtx);
2700
2701 /*
2702 * Always handle WMM once after association regardless
2703 * of the first value the AP uses. Setting -1 here has
2704 * that effect because the AP values is an unsigned
2705 * 4-bit value.
2706 */
2707 ifmgd->wmm_last_param_set = -1;
2708
2709 if (elems.wmm_param)
2710 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
2711 elems.wmm_param_len);
2712 else
2713 ieee80211_set_wmm_default(sdata, false);
2714 changed |= BSS_CHANGED_QOS;
2715
2716 /* set AID and assoc capability,
2717 * ieee80211_set_associated() will tell the driver */
2718 bss_conf->aid = aid;
2719 bss_conf->assoc_capability = capab_info;
2720 ieee80211_set_associated(sdata, cbss, changed);
2721
2722 /*
2723 * If we're using 4-addr mode, let the AP know that we're
2724 * doing so, so that it can create the STA VLAN on its side
2725 */
2726 if (ifmgd->use_4addr)
2727 ieee80211_send_4addr_nullfunc(local, sdata);
2728
2729 /*
2730 * Start timer to probe the connection to the AP now.
2731 * Also start the timer that will detect beacon loss.
2732 */
2733 ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
2734 ieee80211_sta_reset_beacon_monitor(sdata);
2735
2736 ret = true;
2737 out:
2738 kfree(bss_ies);
2739 return ret;
2740 }
2741
2742 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
2743 struct ieee80211_mgmt *mgmt,
2744 size_t len)
2745 {
2746 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2747 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2748 u16 capab_info, status_code, aid;
2749 struct ieee802_11_elems elems;
2750 u8 *pos;
2751 bool reassoc;
2752 struct cfg80211_bss *bss;
2753
2754 sdata_assert_lock(sdata);
2755
2756 if (!assoc_data)
2757 return;
2758 if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
2759 return;
2760
2761 /*
2762 * AssocResp and ReassocResp have identical structure, so process both
2763 * of them in this function.
2764 */
2765
2766 if (len < 24 + 6)
2767 return;
2768
2769 reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
2770 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2771 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
2772 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2773
2774 sdata_info(sdata,
2775 "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
2776 reassoc ? "Rea" : "A", mgmt->sa,
2777 capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
2778
2779 pos = mgmt->u.assoc_resp.variable;
2780 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2781
2782 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
2783 elems.timeout_int &&
2784 elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
2785 u32 tu, ms;
2786 tu = le32_to_cpu(elems.timeout_int->value);
2787 ms = tu * 1024 / 1000;
2788 sdata_info(sdata,
2789 "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
2790 mgmt->sa, tu, ms);
2791 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
2792 assoc_data->timeout_started = true;
2793 if (ms > IEEE80211_ASSOC_TIMEOUT)
2794 run_again(sdata, assoc_data->timeout);
2795 return;
2796 }
2797
2798 bss = assoc_data->bss;
2799
2800 if (status_code != WLAN_STATUS_SUCCESS) {
2801 sdata_info(sdata, "%pM denied association (code=%d)\n",
2802 mgmt->sa, status_code);
2803 ieee80211_destroy_assoc_data(sdata, false);
2804 } else {
2805 if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
2806 /* oops -- internal error -- send timeout for now */
2807 ieee80211_destroy_assoc_data(sdata, false);
2808 cfg80211_assoc_timeout(sdata->dev, bss);
2809 return;
2810 }
2811 sdata_info(sdata, "associated\n");
2812
2813 /*
2814 * destroy assoc_data afterwards, as otherwise an idle
2815 * recalc after assoc_data is NULL but before associated
2816 * is set can cause the interface to go idle
2817 */
2818 ieee80211_destroy_assoc_data(sdata, true);
2819 }
2820
2821 cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len);
2822 }
2823
2824 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2825 struct ieee80211_mgmt *mgmt, size_t len,
2826 struct ieee80211_rx_status *rx_status,
2827 struct ieee802_11_elems *elems)
2828 {
2829 struct ieee80211_local *local = sdata->local;
2830 int freq;
2831 struct ieee80211_bss *bss;
2832 struct ieee80211_channel *channel;
2833
2834 sdata_assert_lock(sdata);
2835
2836 if (elems->ds_params)
2837 freq = ieee80211_channel_to_frequency(elems->ds_params[0],
2838 rx_status->band);
2839 else
2840 freq = rx_status->freq;
2841
2842 channel = ieee80211_get_channel(local->hw.wiphy, freq);
2843
2844 if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
2845 return;
2846
2847 bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
2848 channel);
2849 if (bss) {
2850 ieee80211_rx_bss_put(local, bss);
2851 sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
2852 }
2853
2854 if (!sdata->u.mgd.associated ||
2855 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
2856 return;
2857
2858 ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
2859 elems, true);
2860
2861 }
2862
2863
2864 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
2865 struct sk_buff *skb)
2866 {
2867 struct ieee80211_mgmt *mgmt = (void *)skb->data;
2868 struct ieee80211_if_managed *ifmgd;
2869 struct ieee80211_rx_status *rx_status = (void *) skb->cb;
2870 size_t baselen, len = skb->len;
2871 struct ieee802_11_elems elems;
2872
2873 ifmgd = &sdata->u.mgd;
2874
2875 sdata_assert_lock(sdata);
2876
2877 if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
2878 return; /* ignore ProbeResp to foreign address */
2879
2880 baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
2881 if (baselen > len)
2882 return;
2883
2884 ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
2885 false, &elems);
2886
2887 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2888
2889 if (ifmgd->associated &&
2890 ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2891 ieee80211_reset_ap_probe(sdata);
2892
2893 if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
2894 ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
2895 /* got probe response, continue with auth */
2896 sdata_info(sdata, "direct probe responded\n");
2897 ifmgd->auth_data->tries = 0;
2898 ifmgd->auth_data->timeout = jiffies;
2899 ifmgd->auth_data->timeout_started = true;
2900 run_again(sdata, ifmgd->auth_data->timeout);
2901 }
2902 }
2903
2904 /*
2905 * This is the canonical list of information elements we care about,
2906 * the filter code also gives us all changes to the Microsoft OUI
2907 * (00:50:F2) vendor IE which is used for WMM which we need to track.
2908 *
2909 * We implement beacon filtering in software since that means we can
2910 * avoid processing the frame here and in cfg80211, and userspace
2911 * will not be able to tell whether the hardware supports it or not.
2912 *
2913 * XXX: This list needs to be dynamic -- userspace needs to be able to
2914 * add items it requires. It also needs to be able to tell us to
2915 * look out for other vendor IEs.
2916 */
2917 static const u64 care_about_ies =
2918 (1ULL << WLAN_EID_COUNTRY) |
2919 (1ULL << WLAN_EID_ERP_INFO) |
2920 (1ULL << WLAN_EID_CHANNEL_SWITCH) |
2921 (1ULL << WLAN_EID_PWR_CONSTRAINT) |
2922 (1ULL << WLAN_EID_HT_CAPABILITY) |
2923 (1ULL << WLAN_EID_HT_OPERATION);
2924
2925 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
2926 struct ieee80211_mgmt *mgmt, size_t len,
2927 struct ieee80211_rx_status *rx_status)
2928 {
2929 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2930 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2931 size_t baselen;
2932 struct ieee802_11_elems elems;
2933 struct ieee80211_local *local = sdata->local;
2934 struct ieee80211_chanctx_conf *chanctx_conf;
2935 struct ieee80211_channel *chan;
2936 struct sta_info *sta;
2937 u32 changed = 0;
2938 bool erp_valid;
2939 u8 erp_value = 0;
2940 u32 ncrc;
2941 u8 *bssid;
2942 u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
2943
2944 sdata_assert_lock(sdata);
2945
2946 /* Process beacon from the current BSS */
2947 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2948 if (baselen > len)
2949 return;
2950
2951 rcu_read_lock();
2952 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2953 if (!chanctx_conf) {
2954 rcu_read_unlock();
2955 return;
2956 }
2957
2958 if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
2959 rcu_read_unlock();
2960 return;
2961 }
2962 chan = chanctx_conf->def.chan;
2963 rcu_read_unlock();
2964
2965 if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
2966 ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
2967 ieee802_11_parse_elems(mgmt->u.beacon.variable,
2968 len - baselen, false, &elems);
2969
2970 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2971 if (elems.tim && !elems.parse_error) {
2972 const struct ieee80211_tim_ie *tim_ie = elems.tim;
2973 ifmgd->dtim_period = tim_ie->dtim_period;
2974 }
2975 ifmgd->have_beacon = true;
2976 ifmgd->assoc_data->need_beacon = false;
2977 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
2978 sdata->vif.bss_conf.sync_tsf =
2979 le64_to_cpu(mgmt->u.beacon.timestamp);
2980 sdata->vif.bss_conf.sync_device_ts =
2981 rx_status->device_timestamp;
2982 if (elems.tim)
2983 sdata->vif.bss_conf.sync_dtim_count =
2984 elems.tim->dtim_count;
2985 else
2986 sdata->vif.bss_conf.sync_dtim_count = 0;
2987 }
2988 /* continue assoc process */
2989 ifmgd->assoc_data->timeout = jiffies;
2990 ifmgd->assoc_data->timeout_started = true;
2991 run_again(sdata, ifmgd->assoc_data->timeout);
2992 return;
2993 }
2994
2995 if (!ifmgd->associated ||
2996 !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2997 return;
2998 bssid = ifmgd->associated->bssid;
2999
3000 /* Track average RSSI from the Beacon frames of the current AP */
3001 ifmgd->last_beacon_signal = rx_status->signal;
3002 if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
3003 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3004 ifmgd->ave_beacon_signal = rx_status->signal * 16;
3005 ifmgd->last_cqm_event_signal = 0;
3006 ifmgd->count_beacon_signal = 1;
3007 ifmgd->last_ave_beacon_signal = 0;
3008 } else {
3009 ifmgd->ave_beacon_signal =
3010 (IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
3011 (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
3012 ifmgd->ave_beacon_signal) / 16;
3013 ifmgd->count_beacon_signal++;
3014 }
3015
3016 if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
3017 ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3018 int sig = ifmgd->ave_beacon_signal;
3019 int last_sig = ifmgd->last_ave_beacon_signal;
3020
3021 /*
3022 * if signal crosses either of the boundaries, invoke callback
3023 * with appropriate parameters
3024 */
3025 if (sig > ifmgd->rssi_max_thold &&
3026 (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
3027 ifmgd->last_ave_beacon_signal = sig;
3028 drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
3029 } else if (sig < ifmgd->rssi_min_thold &&
3030 (last_sig >= ifmgd->rssi_max_thold ||
3031 last_sig == 0)) {
3032 ifmgd->last_ave_beacon_signal = sig;
3033 drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
3034 }
3035 }
3036
3037 if (bss_conf->cqm_rssi_thold &&
3038 ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3039 !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3040 int sig = ifmgd->ave_beacon_signal / 16;
3041 int last_event = ifmgd->last_cqm_event_signal;
3042 int thold = bss_conf->cqm_rssi_thold;
3043 int hyst = bss_conf->cqm_rssi_hyst;
3044 if (sig < thold &&
3045 (last_event == 0 || sig < last_event - hyst)) {
3046 ifmgd->last_cqm_event_signal = sig;
3047 ieee80211_cqm_rssi_notify(
3048 &sdata->vif,
3049 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3050 GFP_KERNEL);
3051 } else if (sig > thold &&
3052 (last_event == 0 || sig > last_event + hyst)) {
3053 ifmgd->last_cqm_event_signal = sig;
3054 ieee80211_cqm_rssi_notify(
3055 &sdata->vif,
3056 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3057 GFP_KERNEL);
3058 }
3059 }
3060
3061 if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
3062 mlme_dbg_ratelimited(sdata,
3063 "cancelling AP probe due to a received beacon\n");
3064 mutex_lock(&local->mtx);
3065 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
3066 ieee80211_run_deferred_scan(local);
3067 mutex_unlock(&local->mtx);
3068
3069 mutex_lock(&local->iflist_mtx);
3070 ieee80211_recalc_ps(local, -1);
3071 mutex_unlock(&local->iflist_mtx);
3072 }
3073
3074 /*
3075 * Push the beacon loss detection into the future since
3076 * we are processing a beacon from the AP just now.
3077 */
3078 ieee80211_sta_reset_beacon_monitor(sdata);
3079
3080 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
3081 ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3082 len - baselen, false, &elems,
3083 care_about_ies, ncrc);
3084
3085 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
3086 bool directed_tim = ieee80211_check_tim(elems.tim,
3087 elems.tim_len,
3088 ifmgd->aid);
3089 if (directed_tim) {
3090 if (local->hw.conf.dynamic_ps_timeout > 0) {
3091 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
3092 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
3093 ieee80211_hw_config(local,
3094 IEEE80211_CONF_CHANGE_PS);
3095 }
3096 ieee80211_send_nullfunc(local, sdata, 0);
3097 } else if (!local->pspolling && sdata->u.mgd.powersave) {
3098 local->pspolling = true;
3099
3100 /*
3101 * Here is assumed that the driver will be
3102 * able to send ps-poll frame and receive a
3103 * response even though power save mode is
3104 * enabled, but some drivers might require
3105 * to disable power save here. This needs
3106 * to be investigated.
3107 */
3108 ieee80211_send_pspoll(local, sdata);
3109 }
3110 }
3111 }
3112
3113 if (sdata->vif.p2p) {
3114 struct ieee80211_p2p_noa_attr noa = {};
3115 int ret;
3116
3117 ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
3118 len - baselen,
3119 IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3120 (u8 *) &noa, sizeof(noa));
3121 if (ret >= 2) {
3122 if (sdata->u.mgd.p2p_noa_index != noa.index) {
3123 /* valid noa_attr and index changed */
3124 sdata->u.mgd.p2p_noa_index = noa.index;
3125 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
3126 changed |= BSS_CHANGED_P2P_PS;
3127 /*
3128 * make sure we update all information, the CRC
3129 * mechanism doesn't look at P2P attributes.
3130 */
3131 ifmgd->beacon_crc_valid = false;
3132 }
3133 } else if (sdata->u.mgd.p2p_noa_index != -1) {
3134 /* noa_attr not found and we had valid noa_attr before */
3135 sdata->u.mgd.p2p_noa_index = -1;
3136 memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3137 changed |= BSS_CHANGED_P2P_PS;
3138 ifmgd->beacon_crc_valid = false;
3139 }
3140 }
3141
3142 if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3143 return;
3144 ifmgd->beacon_crc = ncrc;
3145 ifmgd->beacon_crc_valid = true;
3146
3147 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3148
3149 if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3150 elems.wmm_param_len))
3151 changed |= BSS_CHANGED_QOS;
3152
3153 /*
3154 * If we haven't had a beacon before, tell the driver about the
3155 * DTIM period (and beacon timing if desired) now.
3156 */
3157 if (!ifmgd->have_beacon) {
3158 /* a few bogus AP send dtim_period = 0 or no TIM IE */
3159 if (elems.tim)
3160 bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
3161 else
3162 bss_conf->dtim_period = 1;
3163
3164 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
3165 sdata->vif.bss_conf.sync_tsf =
3166 le64_to_cpu(mgmt->u.beacon.timestamp);
3167 sdata->vif.bss_conf.sync_device_ts =
3168 rx_status->device_timestamp;
3169 if (elems.tim)
3170 sdata->vif.bss_conf.sync_dtim_count =
3171 elems.tim->dtim_count;
3172 else
3173 sdata->vif.bss_conf.sync_dtim_count = 0;
3174 }
3175
3176 changed |= BSS_CHANGED_BEACON_INFO;
3177 ifmgd->have_beacon = true;
3178
3179 mutex_lock(&local->iflist_mtx);
3180 ieee80211_recalc_ps(local, -1);
3181 mutex_unlock(&local->iflist_mtx);
3182
3183 ieee80211_recalc_ps_vif(sdata);
3184 }
3185
3186 if (elems.erp_info) {
3187 erp_valid = true;
3188 erp_value = elems.erp_info[0];
3189 } else {
3190 erp_valid = false;
3191 }
3192 changed |= ieee80211_handle_bss_capability(sdata,
3193 le16_to_cpu(mgmt->u.beacon.capab_info),
3194 erp_valid, erp_value);
3195
3196 mutex_lock(&local->sta_mtx);
3197 sta = sta_info_get(sdata, bssid);
3198
3199 if (ieee80211_config_bw(sdata, sta, elems.ht_operation,
3200 elems.vht_operation, bssid, &changed)) {
3201 mutex_unlock(&local->sta_mtx);
3202 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3203 WLAN_REASON_DEAUTH_LEAVING,
3204 true, deauth_buf);
3205 cfg80211_tx_mlme_mgmt(sdata->dev, deauth_buf,
3206 sizeof(deauth_buf));
3207 return;
3208 }
3209
3210 if (sta && elems.opmode_notif)
3211 ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
3212 rx_status->band, true);
3213 mutex_unlock(&local->sta_mtx);
3214
3215 if (elems.country_elem && elems.pwr_constr_elem &&
3216 mgmt->u.probe_resp.capab_info &
3217 cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
3218 changed |= ieee80211_handle_pwr_constr(sdata, chan,
3219 elems.country_elem,
3220 elems.country_elem_len,
3221 elems.pwr_constr_elem);
3222
3223 ieee80211_bss_info_change_notify(sdata, changed);
3224 }
3225
3226 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
3227 struct sk_buff *skb)
3228 {
3229 struct ieee80211_rx_status *rx_status;
3230 struct ieee80211_mgmt *mgmt;
3231 u16 fc;
3232 struct ieee802_11_elems elems;
3233 int ies_len;
3234
3235 rx_status = (struct ieee80211_rx_status *) skb->cb;
3236 mgmt = (struct ieee80211_mgmt *) skb->data;
3237 fc = le16_to_cpu(mgmt->frame_control);
3238
3239 sdata_lock(sdata);
3240
3241 switch (fc & IEEE80211_FCTL_STYPE) {
3242 case IEEE80211_STYPE_BEACON:
3243 ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
3244 break;
3245 case IEEE80211_STYPE_PROBE_RESP:
3246 ieee80211_rx_mgmt_probe_resp(sdata, skb);
3247 break;
3248 case IEEE80211_STYPE_AUTH:
3249 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
3250 break;
3251 case IEEE80211_STYPE_DEAUTH:
3252 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
3253 break;
3254 case IEEE80211_STYPE_DISASSOC:
3255 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
3256 break;
3257 case IEEE80211_STYPE_ASSOC_RESP:
3258 case IEEE80211_STYPE_REASSOC_RESP:
3259 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
3260 break;
3261 case IEEE80211_STYPE_ACTION:
3262 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3263 ies_len = skb->len -
3264 offsetof(struct ieee80211_mgmt,
3265 u.action.u.chan_switch.variable);
3266
3267 if (ies_len < 0)
3268 break;
3269
3270 ieee802_11_parse_elems(
3271 mgmt->u.action.u.chan_switch.variable,
3272 ies_len, true, &elems);
3273
3274 if (elems.parse_error)
3275 break;
3276
3277 ieee80211_sta_process_chanswitch(sdata,
3278 rx_status->mactime,
3279 &elems, false);
3280 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
3281 ies_len = skb->len -
3282 offsetof(struct ieee80211_mgmt,
3283 u.action.u.ext_chan_switch.variable);
3284
3285 if (ies_len < 0)
3286 break;
3287
3288 ieee802_11_parse_elems(
3289 mgmt->u.action.u.ext_chan_switch.variable,
3290 ies_len, true, &elems);
3291
3292 if (elems.parse_error)
3293 break;
3294
3295 /* for the handling code pretend this was also an IE */
3296 elems.ext_chansw_ie =
3297 &mgmt->u.action.u.ext_chan_switch.data;
3298
3299 ieee80211_sta_process_chanswitch(sdata,
3300 rx_status->mactime,
3301 &elems, false);
3302 }
3303 break;
3304 }
3305 sdata_unlock(sdata);
3306 }
3307
3308 static void ieee80211_sta_timer(unsigned long data)
3309 {
3310 struct ieee80211_sub_if_data *sdata =
3311 (struct ieee80211_sub_if_data *) data;
3312
3313 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3314 }
3315
3316 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3317 u8 *bssid, u8 reason, bool tx)
3318 {
3319 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3320
3321 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3322 tx, frame_buf);
3323
3324 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
3325 IEEE80211_DEAUTH_FRAME_LEN);
3326 }
3327
3328 static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
3329 {
3330 struct ieee80211_local *local = sdata->local;
3331 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3332 struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3333 u32 tx_flags = 0;
3334
3335 sdata_assert_lock(sdata);
3336
3337 if (WARN_ON_ONCE(!auth_data))
3338 return -EINVAL;
3339
3340 auth_data->tries++;
3341
3342 if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
3343 sdata_info(sdata, "authentication with %pM timed out\n",
3344 auth_data->bss->bssid);
3345
3346 /*
3347 * Most likely AP is not in the range so remove the
3348 * bss struct for that AP.
3349 */
3350 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
3351
3352 return -ETIMEDOUT;
3353 }
3354
3355 drv_mgd_prepare_tx(local, sdata);
3356
3357 if (auth_data->bss->proberesp_ies) {
3358 u16 trans = 1;
3359 u16 status = 0;
3360
3361 sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
3362 auth_data->bss->bssid, auth_data->tries,
3363 IEEE80211_AUTH_MAX_TRIES);
3364
3365 auth_data->expected_transaction = 2;
3366
3367 if (auth_data->algorithm == WLAN_AUTH_SAE) {
3368 trans = auth_data->sae_trans;
3369 status = auth_data->sae_status;
3370 auth_data->expected_transaction = trans;
3371 }
3372
3373 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3374 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3375 IEEE80211_TX_INTFL_MLME_CONN_TX;
3376
3377 ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
3378 auth_data->data, auth_data->data_len,
3379 auth_data->bss->bssid,
3380 auth_data->bss->bssid, NULL, 0, 0,
3381 tx_flags);
3382 } else {
3383 const u8 *ssidie;
3384
3385 sdata_info(sdata, "direct probe to %pM (try %d/%i)\n",
3386 auth_data->bss->bssid, auth_data->tries,
3387 IEEE80211_AUTH_MAX_TRIES);
3388
3389 rcu_read_lock();
3390 ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
3391 if (!ssidie) {
3392 rcu_read_unlock();
3393 return -EINVAL;
3394 }
3395 /*
3396 * Direct probe is sent to broadcast address as some APs
3397 * will not answer to direct packet in unassociated state.
3398 */
3399 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
3400 NULL, 0, (u32) -1, true, 0,
3401 auth_data->bss->channel, false);
3402 rcu_read_unlock();
3403 }
3404
3405 if (tx_flags == 0) {
3406 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3407 ifmgd->auth_data->timeout_started = true;
3408 run_again(sdata, auth_data->timeout);
3409 } else {
3410 auth_data->timeout_started = false;
3411 }
3412
3413 return 0;
3414 }
3415
3416 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
3417 {
3418 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3419 struct ieee80211_local *local = sdata->local;
3420
3421 sdata_assert_lock(sdata);
3422
3423 assoc_data->tries++;
3424 if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
3425 sdata_info(sdata, "association with %pM timed out\n",
3426 assoc_data->bss->bssid);
3427
3428 /*
3429 * Most likely AP is not in the range so remove the
3430 * bss struct for that AP.
3431 */
3432 cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);
3433
3434 return -ETIMEDOUT;
3435 }
3436
3437 sdata_info(sdata, "associate with %pM (try %d/%d)\n",
3438 assoc_data->bss->bssid, assoc_data->tries,
3439 IEEE80211_ASSOC_MAX_TRIES);
3440 ieee80211_send_assoc(sdata);
3441
3442 if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
3443 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3444 assoc_data->timeout_started = true;
3445 run_again(sdata, assoc_data->timeout);
3446 } else {
3447 assoc_data->timeout_started = false;
3448 }
3449
3450 return 0;
3451 }
3452
3453 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
3454 __le16 fc, bool acked)
3455 {
3456 struct ieee80211_local *local = sdata->local;
3457
3458 sdata->u.mgd.status_fc = fc;
3459 sdata->u.mgd.status_acked = acked;
3460 sdata->u.mgd.status_received = true;
3461
3462 ieee80211_queue_work(&local->hw, &sdata->work);
3463 }
3464
3465 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
3466 {
3467 struct ieee80211_local *local = sdata->local;
3468 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3469
3470 sdata_lock(sdata);
3471
3472 if (ifmgd->status_received) {
3473 __le16 fc = ifmgd->status_fc;
3474 bool status_acked = ifmgd->status_acked;
3475
3476 ifmgd->status_received = false;
3477 if (ifmgd->auth_data &&
3478 (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
3479 if (status_acked) {
3480 ifmgd->auth_data->timeout =
3481 jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3482 run_again(sdata, ifmgd->auth_data->timeout);
3483 } else {
3484 ifmgd->auth_data->timeout = jiffies - 1;
3485 }
3486 ifmgd->auth_data->timeout_started = true;
3487 } else if (ifmgd->assoc_data &&
3488 (ieee80211_is_assoc_req(fc) ||
3489 ieee80211_is_reassoc_req(fc))) {
3490 if (status_acked) {
3491 ifmgd->assoc_data->timeout =
3492 jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3493 run_again(sdata, ifmgd->assoc_data->timeout);
3494 } else {
3495 ifmgd->assoc_data->timeout = jiffies - 1;
3496 }
3497 ifmgd->assoc_data->timeout_started = true;
3498 }
3499 }
3500
3501 if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
3502 time_after(jiffies, ifmgd->auth_data->timeout)) {
3503 if (ifmgd->auth_data->done) {
3504 /*
3505 * ok ... we waited for assoc but userspace didn't,
3506 * so let's just kill the auth data
3507 */
3508 ieee80211_destroy_auth_data(sdata, false);
3509 } else if (ieee80211_probe_auth(sdata)) {
3510 u8 bssid[ETH_ALEN];
3511
3512 memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
3513
3514 ieee80211_destroy_auth_data(sdata, false);
3515
3516 cfg80211_auth_timeout(sdata->dev, bssid);
3517 }
3518 } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3519 run_again(sdata, ifmgd->auth_data->timeout);
3520
3521 if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
3522 time_after(jiffies, ifmgd->assoc_data->timeout)) {
3523 if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
3524 ieee80211_do_assoc(sdata)) {
3525 struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
3526
3527 ieee80211_destroy_assoc_data(sdata, false);
3528 cfg80211_assoc_timeout(sdata->dev, bss);
3529 }
3530 } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3531 run_again(sdata, ifmgd->assoc_data->timeout);
3532
3533 if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
3534 IEEE80211_STA_CONNECTION_POLL) &&
3535 ifmgd->associated) {
3536 u8 bssid[ETH_ALEN];
3537 int max_tries;
3538
3539 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3540
3541 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3542 max_tries = max_nullfunc_tries;
3543 else
3544 max_tries = max_probe_tries;
3545
3546 /* ACK received for nullfunc probing frame */
3547 if (!ifmgd->probe_send_count)
3548 ieee80211_reset_ap_probe(sdata);
3549 else if (ifmgd->nullfunc_failed) {
3550 if (ifmgd->probe_send_count < max_tries) {
3551 mlme_dbg(sdata,
3552 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
3553 bssid, ifmgd->probe_send_count,
3554 max_tries);
3555 ieee80211_mgd_probe_ap_send(sdata);
3556 } else {
3557 mlme_dbg(sdata,
3558 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
3559 bssid);
3560 ieee80211_sta_connection_lost(sdata, bssid,
3561 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3562 false);
3563 }
3564 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
3565 run_again(sdata, ifmgd->probe_timeout);
3566 else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
3567 mlme_dbg(sdata,
3568 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
3569 bssid, probe_wait_ms);
3570 ieee80211_sta_connection_lost(sdata, bssid,
3571 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3572 } else if (ifmgd->probe_send_count < max_tries) {
3573 mlme_dbg(sdata,
3574 "No probe response from AP %pM after %dms, try %d/%i\n",
3575 bssid, probe_wait_ms,
3576 ifmgd->probe_send_count, max_tries);
3577 ieee80211_mgd_probe_ap_send(sdata);
3578 } else {
3579 /*
3580 * We actually lost the connection ... or did we?
3581 * Let's make sure!
3582 */
3583 wiphy_debug(local->hw.wiphy,
3584 "%s: No probe response from AP %pM"
3585 " after %dms, disconnecting.\n",
3586 sdata->name,
3587 bssid, probe_wait_ms);
3588
3589 ieee80211_sta_connection_lost(sdata, bssid,
3590 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3591 }
3592 }
3593
3594 sdata_unlock(sdata);
3595 }
3596
3597 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
3598 {
3599 struct ieee80211_sub_if_data *sdata =
3600 (struct ieee80211_sub_if_data *) data;
3601 struct ieee80211_local *local = sdata->local;
3602
3603 if (local->quiescing)
3604 return;
3605
3606 sdata->u.mgd.connection_loss = false;
3607 ieee80211_queue_work(&sdata->local->hw,
3608 &sdata->u.mgd.beacon_connection_loss_work);
3609 }
3610
3611 static void ieee80211_sta_conn_mon_timer(unsigned long data)
3612 {
3613 struct ieee80211_sub_if_data *sdata =
3614 (struct ieee80211_sub_if_data *) data;
3615 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3616 struct ieee80211_local *local = sdata->local;
3617
3618 if (local->quiescing)
3619 return;
3620
3621 ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
3622 }
3623
3624 static void ieee80211_sta_monitor_work(struct work_struct *work)
3625 {
3626 struct ieee80211_sub_if_data *sdata =
3627 container_of(work, struct ieee80211_sub_if_data,
3628 u.mgd.monitor_work);
3629
3630 ieee80211_mgd_probe_ap(sdata, false);
3631 }
3632
3633 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
3634 {
3635 u32 flags;
3636
3637 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3638 __ieee80211_stop_poll(sdata);
3639
3640 /* let's probe the connection once */
3641 flags = sdata->local->hw.flags;
3642 if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
3643 ieee80211_queue_work(&sdata->local->hw,
3644 &sdata->u.mgd.monitor_work);
3645 /* and do all the other regular work too */
3646 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3647 }
3648 }
3649
3650 #ifdef CONFIG_PM
3651 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
3652 {
3653 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3654
3655 sdata_lock(sdata);
3656 if (!ifmgd->associated) {
3657 sdata_unlock(sdata);
3658 return;
3659 }
3660
3661 if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
3662 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
3663 mlme_dbg(sdata, "driver requested disconnect after resume\n");
3664 ieee80211_sta_connection_lost(sdata,
3665 ifmgd->associated->bssid,
3666 WLAN_REASON_UNSPECIFIED,
3667 true);
3668 sdata_unlock(sdata);
3669 return;
3670 }
3671 sdata_unlock(sdata);
3672 }
3673 #endif
3674
3675 /* interface setup */
3676 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
3677 {
3678 struct ieee80211_if_managed *ifmgd;
3679
3680 ifmgd = &sdata->u.mgd;
3681 INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
3682 INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
3683 INIT_WORK(&ifmgd->beacon_connection_loss_work,
3684 ieee80211_beacon_connection_loss_work);
3685 INIT_WORK(&ifmgd->csa_connection_drop_work,
3686 ieee80211_csa_connection_drop_work);
3687 INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_work);
3688 setup_timer(&ifmgd->timer, ieee80211_sta_timer,
3689 (unsigned long) sdata);
3690 setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
3691 (unsigned long) sdata);
3692 setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
3693 (unsigned long) sdata);
3694 setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
3695 (unsigned long) sdata);
3696
3697 ifmgd->flags = 0;
3698 ifmgd->powersave = sdata->wdev.ps;
3699 ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
3700 ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
3701 ifmgd->p2p_noa_index = -1;
3702
3703 if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
3704 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
3705 else
3706 ifmgd->req_smps = IEEE80211_SMPS_OFF;
3707 }
3708
3709 /* scan finished notification */
3710 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3711 {
3712 struct ieee80211_sub_if_data *sdata;
3713
3714 /* Restart STA timers */
3715 rcu_read_lock();
3716 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3717 if (ieee80211_sdata_running(sdata))
3718 ieee80211_restart_sta_timer(sdata);
3719 }
3720 rcu_read_unlock();
3721 }
3722
3723 int ieee80211_max_network_latency(struct notifier_block *nb,
3724 unsigned long data, void *dummy)
3725 {
3726 s32 latency_usec = (s32) data;
3727 struct ieee80211_local *local =
3728 container_of(nb, struct ieee80211_local,
3729 network_latency_notifier);
3730
3731 mutex_lock(&local->iflist_mtx);
3732 ieee80211_recalc_ps(local, latency_usec);
3733 mutex_unlock(&local->iflist_mtx);
3734
3735 return 0;
3736 }
3737
3738 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
3739 struct cfg80211_bss *cbss)
3740 {
3741 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3742 const u8 *ht_cap_ie, *vht_cap_ie;
3743 const struct ieee80211_ht_cap *ht_cap;
3744 const struct ieee80211_vht_cap *vht_cap;
3745 u8 chains = 1;
3746
3747 if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
3748 return chains;
3749
3750 ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3751 if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
3752 ht_cap = (void *)(ht_cap_ie + 2);
3753 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
3754 /*
3755 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
3756 * "Tx Unequal Modulation Supported" fields.
3757 */
3758 }
3759
3760 if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
3761 return chains;
3762
3763 vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3764 if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
3765 u8 nss;
3766 u16 tx_mcs_map;
3767
3768 vht_cap = (void *)(vht_cap_ie + 2);
3769 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
3770 for (nss = 8; nss > 0; nss--) {
3771 if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
3772 IEEE80211_VHT_MCS_NOT_SUPPORTED)
3773 break;
3774 }
3775 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
3776 chains = max(chains, nss);
3777 }
3778
3779 return chains;
3780 }
3781
3782 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
3783 struct cfg80211_bss *cbss)
3784 {
3785 struct ieee80211_local *local = sdata->local;
3786 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3787 const struct ieee80211_ht_operation *ht_oper = NULL;
3788 const struct ieee80211_vht_operation *vht_oper = NULL;
3789 struct ieee80211_supported_band *sband;
3790 struct cfg80211_chan_def chandef;
3791 int ret;
3792
3793 sband = local->hw.wiphy->bands[cbss->channel->band];
3794
3795 ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
3796 IEEE80211_STA_DISABLE_80P80MHZ |
3797 IEEE80211_STA_DISABLE_160MHZ);
3798
3799 rcu_read_lock();
3800
3801 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3802 sband->ht_cap.ht_supported) {
3803 const u8 *ht_oper_ie, *ht_cap;
3804
3805 ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
3806 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
3807 ht_oper = (void *)(ht_oper_ie + 2);
3808
3809 ht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3810 if (!ht_cap || ht_cap[1] < sizeof(struct ieee80211_ht_cap)) {
3811 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3812 ht_oper = NULL;
3813 }
3814 }
3815
3816 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3817 sband->vht_cap.vht_supported) {
3818 const u8 *vht_oper_ie, *vht_cap;
3819
3820 vht_oper_ie = ieee80211_bss_get_ie(cbss,
3821 WLAN_EID_VHT_OPERATION);
3822 if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
3823 vht_oper = (void *)(vht_oper_ie + 2);
3824 if (vht_oper && !ht_oper) {
3825 vht_oper = NULL;
3826 sdata_info(sdata,
3827 "AP advertised VHT without HT, disabling both\n");
3828 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3829 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3830 }
3831
3832 vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3833 if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
3834 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3835 vht_oper = NULL;
3836 }
3837 }
3838
3839 ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
3840 cbss->channel,
3841 ht_oper, vht_oper,
3842 &chandef, true);
3843
3844 sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
3845 local->rx_chains);
3846
3847 rcu_read_unlock();
3848
3849 /* will change later if needed */
3850 sdata->smps_mode = IEEE80211_SMPS_OFF;
3851
3852 /*
3853 * If this fails (possibly due to channel context sharing
3854 * on incompatible channels, e.g. 80+80 and 160 sharing the
3855 * same control channel) try to use a smaller bandwidth.
3856 */
3857 ret = ieee80211_vif_use_channel(sdata, &chandef,
3858 IEEE80211_CHANCTX_SHARED);
3859
3860 /* don't downgrade for 5 and 10 MHz channels, though. */
3861 if (chandef.width == NL80211_CHAN_WIDTH_5 ||
3862 chandef.width == NL80211_CHAN_WIDTH_10)
3863 return ret;
3864
3865 while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
3866 ifmgd->flags |= chandef_downgrade(&chandef);
3867 ret = ieee80211_vif_use_channel(sdata, &chandef,
3868 IEEE80211_CHANCTX_SHARED);
3869 }
3870 return ret;
3871 }
3872
3873 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
3874 struct cfg80211_bss *cbss, bool assoc)
3875 {
3876 struct ieee80211_local *local = sdata->local;
3877 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3878 struct ieee80211_bss *bss = (void *)cbss->priv;
3879 struct sta_info *new_sta = NULL;
3880 bool have_sta = false;
3881 int err;
3882
3883 if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
3884 return -EINVAL;
3885
3886 if (assoc) {
3887 rcu_read_lock();
3888 have_sta = sta_info_get(sdata, cbss->bssid);
3889 rcu_read_unlock();
3890 }
3891
3892 if (!have_sta) {
3893 new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
3894 if (!new_sta)
3895 return -ENOMEM;
3896 }
3897 if (new_sta) {
3898 u32 rates = 0, basic_rates = 0;
3899 bool have_higher_than_11mbit;
3900 int min_rate = INT_MAX, min_rate_index = -1;
3901 struct ieee80211_chanctx_conf *chanctx_conf;
3902 struct ieee80211_supported_band *sband;
3903 const struct cfg80211_bss_ies *ies;
3904 int shift;
3905 u32 rate_flags;
3906
3907 sband = local->hw.wiphy->bands[cbss->channel->band];
3908
3909 err = ieee80211_prep_channel(sdata, cbss);
3910 if (err) {
3911 sta_info_free(local, new_sta);
3912 return -EINVAL;
3913 }
3914 shift = ieee80211_vif_get_shift(&sdata->vif);
3915
3916 rcu_read_lock();
3917 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3918 if (WARN_ON(!chanctx_conf)) {
3919 rcu_read_unlock();
3920 return -EINVAL;
3921 }
3922 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
3923 rcu_read_unlock();
3924
3925 ieee80211_get_rates(sband, bss->supp_rates,
3926 bss->supp_rates_len,
3927 &rates, &basic_rates,
3928 &have_higher_than_11mbit,
3929 &min_rate, &min_rate_index,
3930 shift, rate_flags);
3931
3932 /*
3933 * This used to be a workaround for basic rates missing
3934 * in the association response frame. Now that we no
3935 * longer use the basic rates from there, it probably
3936 * doesn't happen any more, but keep the workaround so
3937 * in case some *other* APs are buggy in different ways
3938 * we can connect -- with a warning.
3939 */
3940 if (!basic_rates && min_rate_index >= 0) {
3941 sdata_info(sdata,
3942 "No basic rates, using min rate instead\n");
3943 basic_rates = BIT(min_rate_index);
3944 }
3945
3946 new_sta->sta.supp_rates[cbss->channel->band] = rates;
3947 sdata->vif.bss_conf.basic_rates = basic_rates;
3948
3949 /* cf. IEEE 802.11 9.2.12 */
3950 if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
3951 have_higher_than_11mbit)
3952 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
3953 else
3954 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
3955
3956 memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
3957
3958 /* set timing information */
3959 sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
3960 rcu_read_lock();
3961 ies = rcu_dereference(cbss->beacon_ies);
3962 if (ies) {
3963 const u8 *tim_ie;
3964
3965 sdata->vif.bss_conf.sync_tsf = ies->tsf;
3966 sdata->vif.bss_conf.sync_device_ts =
3967 bss->device_ts_beacon;
3968 tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
3969 ies->data, ies->len);
3970 if (tim_ie && tim_ie[1] >= 2)
3971 sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
3972 else
3973 sdata->vif.bss_conf.sync_dtim_count = 0;
3974 } else if (!(local->hw.flags &
3975 IEEE80211_HW_TIMING_BEACON_ONLY)) {
3976 ies = rcu_dereference(cbss->proberesp_ies);
3977 /* must be non-NULL since beacon IEs were NULL */
3978 sdata->vif.bss_conf.sync_tsf = ies->tsf;
3979 sdata->vif.bss_conf.sync_device_ts =
3980 bss->device_ts_presp;
3981 sdata->vif.bss_conf.sync_dtim_count = 0;
3982 } else {
3983 sdata->vif.bss_conf.sync_tsf = 0;
3984 sdata->vif.bss_conf.sync_device_ts = 0;
3985 sdata->vif.bss_conf.sync_dtim_count = 0;
3986 }
3987 rcu_read_unlock();
3988
3989 /* tell driver about BSSID, basic rates and timing */
3990 ieee80211_bss_info_change_notify(sdata,
3991 BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
3992 BSS_CHANGED_BEACON_INT);
3993
3994 if (assoc)
3995 sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
3996
3997 err = sta_info_insert(new_sta);
3998 new_sta = NULL;
3999 if (err) {
4000 sdata_info(sdata,
4001 "failed to insert STA entry for the AP (error %d)\n",
4002 err);
4003 return err;
4004 }
4005 } else
4006 WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4007
4008 return 0;
4009 }
4010
4011 /* config hooks */
4012 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
4013 struct cfg80211_auth_request *req)
4014 {
4015 struct ieee80211_local *local = sdata->local;
4016 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4017 struct ieee80211_mgd_auth_data *auth_data;
4018 u16 auth_alg;
4019 int err;
4020
4021 /* prepare auth data structure */
4022
4023 switch (req->auth_type) {
4024 case NL80211_AUTHTYPE_OPEN_SYSTEM:
4025 auth_alg = WLAN_AUTH_OPEN;
4026 break;
4027 case NL80211_AUTHTYPE_SHARED_KEY:
4028 if (IS_ERR(local->wep_tx_tfm))
4029 return -EOPNOTSUPP;
4030 auth_alg = WLAN_AUTH_SHARED_KEY;
4031 break;
4032 case NL80211_AUTHTYPE_FT:
4033 auth_alg = WLAN_AUTH_FT;
4034 break;
4035 case NL80211_AUTHTYPE_NETWORK_EAP:
4036 auth_alg = WLAN_AUTH_LEAP;
4037 break;
4038 case NL80211_AUTHTYPE_SAE:
4039 auth_alg = WLAN_AUTH_SAE;
4040 break;
4041 default:
4042 return -EOPNOTSUPP;
4043 }
4044
4045 auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
4046 req->ie_len, GFP_KERNEL);
4047 if (!auth_data)
4048 return -ENOMEM;
4049
4050 auth_data->bss = req->bss;
4051
4052 if (req->sae_data_len >= 4) {
4053 __le16 *pos = (__le16 *) req->sae_data;
4054 auth_data->sae_trans = le16_to_cpu(pos[0]);
4055 auth_data->sae_status = le16_to_cpu(pos[1]);
4056 memcpy(auth_data->data, req->sae_data + 4,
4057 req->sae_data_len - 4);
4058 auth_data->data_len += req->sae_data_len - 4;
4059 }
4060
4061 if (req->ie && req->ie_len) {
4062 memcpy(&auth_data->data[auth_data->data_len],
4063 req->ie, req->ie_len);
4064 auth_data->data_len += req->ie_len;
4065 }
4066
4067 if (req->key && req->key_len) {
4068 auth_data->key_len = req->key_len;
4069 auth_data->key_idx = req->key_idx;
4070 memcpy(auth_data->key, req->key, req->key_len);
4071 }
4072
4073 auth_data->algorithm = auth_alg;
4074
4075 /* try to authenticate/probe */
4076
4077 if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
4078 ifmgd->assoc_data) {
4079 err = -EBUSY;
4080 goto err_free;
4081 }
4082
4083 if (ifmgd->auth_data)
4084 ieee80211_destroy_auth_data(sdata, false);
4085
4086 /* prep auth_data so we don't go into idle on disassoc */
4087 ifmgd->auth_data = auth_data;
4088
4089 if (ifmgd->associated) {
4090 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4091
4092 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4093 WLAN_REASON_UNSPECIFIED,
4094 false, frame_buf);
4095
4096 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4097 sizeof(frame_buf));
4098 }
4099
4100 sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4101
4102 err = ieee80211_prep_connection(sdata, req->bss, false);
4103 if (err)
4104 goto err_clear;
4105
4106 err = ieee80211_probe_auth(sdata);
4107 if (err) {
4108 sta_info_destroy_addr(sdata, req->bss->bssid);
4109 goto err_clear;
4110 }
4111
4112 /* hold our own reference */
4113 cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4114 return 0;
4115
4116 err_clear:
4117 memset(ifmgd->bssid, 0, ETH_ALEN);
4118 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4119 ifmgd->auth_data = NULL;
4120 err_free:
4121 kfree(auth_data);
4122 return err;
4123 }
4124
4125 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
4126 struct cfg80211_assoc_request *req)
4127 {
4128 struct ieee80211_local *local = sdata->local;
4129 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4130 struct ieee80211_bss *bss = (void *)req->bss->priv;
4131 struct ieee80211_mgd_assoc_data *assoc_data;
4132 const struct cfg80211_bss_ies *beacon_ies;
4133 struct ieee80211_supported_band *sband;
4134 const u8 *ssidie, *ht_ie, *vht_ie;
4135 int i, err;
4136
4137 assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
4138 if (!assoc_data)
4139 return -ENOMEM;
4140
4141 rcu_read_lock();
4142 ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
4143 if (!ssidie) {
4144 rcu_read_unlock();
4145 kfree(assoc_data);
4146 return -EINVAL;
4147 }
4148 memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
4149 assoc_data->ssid_len = ssidie[1];
4150 rcu_read_unlock();
4151
4152 if (ifmgd->associated) {
4153 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4154
4155 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4156 WLAN_REASON_UNSPECIFIED,
4157 false, frame_buf);
4158
4159 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4160 sizeof(frame_buf));
4161 }
4162
4163 if (ifmgd->auth_data && !ifmgd->auth_data->done) {
4164 err = -EBUSY;
4165 goto err_free;
4166 }
4167
4168 if (ifmgd->assoc_data) {
4169 err = -EBUSY;
4170 goto err_free;
4171 }
4172
4173 if (ifmgd->auth_data) {
4174 bool match;
4175
4176 /* keep sta info, bssid if matching */
4177 match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
4178 ieee80211_destroy_auth_data(sdata, match);
4179 }
4180
4181 /* prepare assoc data */
4182
4183 ifmgd->beacon_crc_valid = false;
4184
4185 /*
4186 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
4187 * We still associate in non-HT mode (11a/b/g) if any one of these
4188 * ciphers is configured as pairwise.
4189 * We can set this to true for non-11n hardware, that'll be checked
4190 * separately along with the peer capabilities.
4191 */
4192 for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4193 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
4194 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4195 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4196 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4197 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4198 netdev_info(sdata->dev,
4199 "disabling HT/VHT due to WEP/TKIP use\n");
4200 }
4201 }
4202
4203 if (req->flags & ASSOC_REQ_DISABLE_HT) {
4204 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4205 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4206 }
4207
4208 if (req->flags & ASSOC_REQ_DISABLE_VHT)
4209 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4210
4211 /* Also disable HT if we don't support it or the AP doesn't use WMM */
4212 sband = local->hw.wiphy->bands[req->bss->channel->band];
4213 if (!sband->ht_cap.ht_supported ||
4214 local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
4215 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4216 if (!bss->wmm_used)
4217 netdev_info(sdata->dev,
4218 "disabling HT as WMM/QoS is not supported by the AP\n");
4219 }
4220
4221 /* disable VHT if we don't support it or the AP doesn't use WMM */
4222 if (!sband->vht_cap.vht_supported ||
4223 local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
4224 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4225 if (!bss->wmm_used)
4226 netdev_info(sdata->dev,
4227 "disabling VHT as WMM/QoS is not supported by the AP\n");
4228 }
4229
4230 memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
4231 memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
4232 sizeof(ifmgd->ht_capa_mask));
4233
4234 memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
4235 memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
4236 sizeof(ifmgd->vht_capa_mask));
4237
4238 if (req->ie && req->ie_len) {
4239 memcpy(assoc_data->ie, req->ie, req->ie_len);
4240 assoc_data->ie_len = req->ie_len;
4241 }
4242
4243 assoc_data->bss = req->bss;
4244
4245 if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
4246 if (ifmgd->powersave)
4247 sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
4248 else
4249 sdata->smps_mode = IEEE80211_SMPS_OFF;
4250 } else
4251 sdata->smps_mode = ifmgd->req_smps;
4252
4253 assoc_data->capability = req->bss->capability;
4254 assoc_data->wmm = bss->wmm_used &&
4255 (local->hw.queues >= IEEE80211_NUM_ACS);
4256 assoc_data->supp_rates = bss->supp_rates;
4257 assoc_data->supp_rates_len = bss->supp_rates_len;
4258
4259 rcu_read_lock();
4260 ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
4261 if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
4262 assoc_data->ap_ht_param =
4263 ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
4264 else
4265 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4266 vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
4267 if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
4268 memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
4269 sizeof(struct ieee80211_vht_cap));
4270 else
4271 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4272 rcu_read_unlock();
4273
4274 if (bss->wmm_used && bss->uapsd_supported &&
4275 (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD) &&
4276 sdata->wmm_acm != 0xff) {
4277 assoc_data->uapsd = true;
4278 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
4279 } else {
4280 assoc_data->uapsd = false;
4281 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
4282 }
4283
4284 if (req->prev_bssid)
4285 memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4286
4287 if (req->use_mfp) {
4288 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
4289 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
4290 } else {
4291 ifmgd->mfp = IEEE80211_MFP_DISABLED;
4292 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
4293 }
4294
4295 if (req->crypto.control_port)
4296 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
4297 else
4298 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
4299
4300 sdata->control_port_protocol = req->crypto.control_port_ethertype;
4301 sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4302
4303 /* kick off associate process */
4304
4305 ifmgd->assoc_data = assoc_data;
4306 ifmgd->dtim_period = 0;
4307 ifmgd->have_beacon = false;
4308
4309 err = ieee80211_prep_connection(sdata, req->bss, true);
4310 if (err)
4311 goto err_clear;
4312
4313 rcu_read_lock();
4314 beacon_ies = rcu_dereference(req->bss->beacon_ies);
4315
4316 if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC &&
4317 !beacon_ies) {
4318 /*
4319 * Wait up to one beacon interval ...
4320 * should this be more if we miss one?
4321 */
4322 sdata_info(sdata, "waiting for beacon from %pM\n",
4323 ifmgd->bssid);
4324 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4325 assoc_data->timeout_started = true;
4326 assoc_data->need_beacon = true;
4327 } else if (beacon_ies) {
4328 const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
4329 beacon_ies->data,
4330 beacon_ies->len);
4331 u8 dtim_count = 0;
4332
4333 if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
4334 const struct ieee80211_tim_ie *tim;
4335 tim = (void *)(tim_ie + 2);
4336 ifmgd->dtim_period = tim->dtim_period;
4337 dtim_count = tim->dtim_count;
4338 }
4339 ifmgd->have_beacon = true;
4340 assoc_data->timeout = jiffies;
4341 assoc_data->timeout_started = true;
4342
4343 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
4344 sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
4345 sdata->vif.bss_conf.sync_device_ts =
4346 bss->device_ts_beacon;
4347 sdata->vif.bss_conf.sync_dtim_count = dtim_count;
4348 }
4349 } else {
4350 assoc_data->timeout = jiffies;
4351 assoc_data->timeout_started = true;
4352 }
4353 rcu_read_unlock();
4354
4355 run_again(sdata, assoc_data->timeout);
4356
4357 if (bss->corrupt_data) {
4358 char *corrupt_type = "data";
4359 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
4360 if (bss->corrupt_data &
4361 IEEE80211_BSS_CORRUPT_PROBE_RESP)
4362 corrupt_type = "beacon and probe response";
4363 else
4364 corrupt_type = "beacon";
4365 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
4366 corrupt_type = "probe response";
4367 sdata_info(sdata, "associating with AP with corrupt %s\n",
4368 corrupt_type);
4369 }
4370
4371 return 0;
4372 err_clear:
4373 memset(ifmgd->bssid, 0, ETH_ALEN);
4374 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4375 ifmgd->assoc_data = NULL;
4376 err_free:
4377 kfree(assoc_data);
4378 return err;
4379 }
4380
4381 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4382 struct cfg80211_deauth_request *req)
4383 {
4384 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4385 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4386 bool tx = !req->local_state_change;
4387 bool report_frame = false;
4388
4389 sdata_info(sdata,
4390 "deauthenticating from %pM by local choice (reason=%d)\n",
4391 req->bssid, req->reason_code);
4392
4393 if (ifmgd->auth_data) {
4394 drv_mgd_prepare_tx(sdata->local, sdata);
4395 ieee80211_send_deauth_disassoc(sdata, req->bssid,
4396 IEEE80211_STYPE_DEAUTH,
4397 req->reason_code, tx,
4398 frame_buf);
4399 ieee80211_destroy_auth_data(sdata, false);
4400
4401 report_frame = true;
4402 goto out;
4403 }
4404
4405 if (ifmgd->associated &&
4406 ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4407 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4408 req->reason_code, tx, frame_buf);
4409 report_frame = true;
4410 }
4411
4412 out:
4413 if (report_frame)
4414 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4415 IEEE80211_DEAUTH_FRAME_LEN);
4416
4417 return 0;
4418 }
4419
4420 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4421 struct cfg80211_disassoc_request *req)
4422 {
4423 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4424 u8 bssid[ETH_ALEN];
4425 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4426
4427 /*
4428 * cfg80211 should catch this ... but it's racy since
4429 * we can receive a disassoc frame, process it, hand it
4430 * to cfg80211 while that's in a locked section already
4431 * trying to tell us that the user wants to disconnect.
4432 */
4433 if (ifmgd->associated != req->bss)
4434 return -ENOLINK;
4435
4436 sdata_info(sdata,
4437 "disassociating from %pM by local choice (reason=%d)\n",
4438 req->bss->bssid, req->reason_code);
4439
4440 memcpy(bssid, req->bss->bssid, ETH_ALEN);
4441 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
4442 req->reason_code, !req->local_state_change,
4443 frame_buf);
4444
4445 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4446 IEEE80211_DEAUTH_FRAME_LEN);
4447
4448 return 0;
4449 }
4450
4451 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4452 {
4453 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4454
4455 /*
4456 * Make sure some work items will not run after this,
4457 * they will not do anything but might not have been
4458 * cancelled when disconnecting.
4459 */
4460 cancel_work_sync(&ifmgd->monitor_work);
4461 cancel_work_sync(&ifmgd->beacon_connection_loss_work);
4462 cancel_work_sync(&ifmgd->request_smps_work);
4463 cancel_work_sync(&ifmgd->csa_connection_drop_work);
4464 cancel_work_sync(&ifmgd->chswitch_work);
4465
4466 sdata_lock(sdata);
4467 if (ifmgd->assoc_data) {
4468 struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4469 ieee80211_destroy_assoc_data(sdata, false);
4470 cfg80211_assoc_timeout(sdata->dev, bss);
4471 }
4472 if (ifmgd->auth_data)
4473 ieee80211_destroy_auth_data(sdata, false);
4474 del_timer_sync(&ifmgd->timer);
4475 sdata_unlock(sdata);
4476 }
4477
4478 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
4479 enum nl80211_cqm_rssi_threshold_event rssi_event,
4480 gfp_t gfp)
4481 {
4482 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4483
4484 trace_api_cqm_rssi_notify(sdata, rssi_event);
4485
4486 cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
4487 }
4488 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
(deprecated) Btrfs devel tree