]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/mac80211/mlme.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'tiny/for-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/josh/linux
[mirror_ubuntu-bionic-kernel.git] / net / mac80211 / mlme.c
1 /*
2 * BSS client mode implementation
3 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4 * Copyright 2004, Instant802 Networks, Inc.
5 * Copyright 2005, Devicescape Software, Inc.
6 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
7 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
12 */
13
14 #include <linux/delay.h>
15 #include <linux/if_ether.h>
16 #include <linux/skbuff.h>
17 #include <linux/if_arp.h>
18 #include <linux/etherdevice.h>
19 #include <linux/moduleparam.h>
20 #include <linux/rtnetlink.h>
21 #include <linux/pm_qos.h>
22 #include <linux/crc32.h>
23 #include <linux/slab.h>
24 #include <linux/export.h>
25 #include <net/mac80211.h>
26 #include <asm/unaligned.h>
27
28 #include "ieee80211_i.h"
29 #include "driver-ops.h"
30 #include "rate.h"
31 #include "led.h"
32
33 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
34 #define IEEE80211_AUTH_TIMEOUT_LONG (HZ / 2)
35 #define IEEE80211_AUTH_TIMEOUT_SHORT (HZ / 10)
36 #define IEEE80211_AUTH_MAX_TRIES 3
37 #define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5)
38 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
39 #define IEEE80211_ASSOC_TIMEOUT_LONG (HZ / 2)
40 #define IEEE80211_ASSOC_TIMEOUT_SHORT (HZ / 10)
41 #define IEEE80211_ASSOC_MAX_TRIES 3
42
43 static int max_nullfunc_tries = 2;
44 module_param(max_nullfunc_tries, int, 0644);
45 MODULE_PARM_DESC(max_nullfunc_tries,
46 "Maximum nullfunc tx tries before disconnecting (reason 4).");
47
48 static int max_probe_tries = 5;
49 module_param(max_probe_tries, int, 0644);
50 MODULE_PARM_DESC(max_probe_tries,
51 "Maximum probe tries before disconnecting (reason 4).");
52
53 /*
54 * Beacon loss timeout is calculated as N frames times the
55 * advertised beacon interval. This may need to be somewhat
56 * higher than what hardware might detect to account for
57 * delays in the host processing frames. But since we also
58 * probe on beacon miss before declaring the connection lost
59 * default to what we want.
60 */
61 static int beacon_loss_count = 7;
62 module_param(beacon_loss_count, int, 0644);
63 MODULE_PARM_DESC(beacon_loss_count,
64 "Number of beacon intervals before we decide beacon was lost.");
65
66 /*
67 * Time the connection can be idle before we probe
68 * it to see if we can still talk to the AP.
69 */
70 #define IEEE80211_CONNECTION_IDLE_TIME (30 * HZ)
71 /*
72 * Time we wait for a probe response after sending
73 * a probe request because of beacon loss or for
74 * checking the connection still works.
75 */
76 static int probe_wait_ms = 500;
77 module_param(probe_wait_ms, int, 0644);
78 MODULE_PARM_DESC(probe_wait_ms,
79 "Maximum time(ms) to wait for probe response"
80 " before disconnecting (reason 4).");
81
82 /*
83 * Weight given to the latest Beacon frame when calculating average signal
84 * strength for Beacon frames received in the current BSS. This must be
85 * between 1 and 15.
86 */
87 #define IEEE80211_SIGNAL_AVE_WEIGHT 3
88
89 /*
90 * How many Beacon frames need to have been used in average signal strength
91 * before starting to indicate signal change events.
92 */
93 #define IEEE80211_SIGNAL_AVE_MIN_COUNT 4
94
95 /*
96 * We can have multiple work items (and connection probing)
97 * scheduling this timer, but we need to take care to only
98 * reschedule it when it should fire _earlier_ than it was
99 * asked for before, or if it's not pending right now. This
100 * function ensures that. Note that it then is required to
101 * run this function for all timeouts after the first one
102 * has happened -- the work that runs from this timer will
103 * do that.
104 */
105 static void run_again(struct ieee80211_sub_if_data *sdata,
106 unsigned long timeout)
107 {
108 sdata_assert_lock(sdata);
109
110 if (!timer_pending(&sdata->u.mgd.timer) ||
111 time_before(timeout, sdata->u.mgd.timer.expires))
112 mod_timer(&sdata->u.mgd.timer, timeout);
113 }
114
115 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
116 {
117 if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
118 return;
119
120 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
121 return;
122
123 mod_timer(&sdata->u.mgd.bcn_mon_timer,
124 round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
125 }
126
127 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
128 {
129 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
130
131 if (unlikely(!sdata->u.mgd.associated))
132 return;
133
134 ifmgd->probe_send_count = 0;
135
136 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
137 return;
138
139 mod_timer(&sdata->u.mgd.conn_mon_timer,
140 round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
141 }
142
143 static int ecw2cw(int ecw)
144 {
145 return (1 << ecw) - 1;
146 }
147
148 static u32
149 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
150 struct ieee80211_supported_band *sband,
151 struct ieee80211_channel *channel,
152 const struct ieee80211_ht_operation *ht_oper,
153 const struct ieee80211_vht_operation *vht_oper,
154 struct cfg80211_chan_def *chandef, bool tracking)
155 {
156 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
157 struct cfg80211_chan_def vht_chandef;
158 u32 ht_cfreq, ret;
159
160 chandef->chan = channel;
161 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
162 chandef->center_freq1 = channel->center_freq;
163 chandef->center_freq2 = 0;
164
165 if (!ht_oper || !sband->ht_cap.ht_supported) {
166 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
167 goto out;
168 }
169
170 chandef->width = NL80211_CHAN_WIDTH_20;
171
172 ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
173 channel->band);
174 /* check that channel matches the right operating channel */
175 if (!tracking && channel->center_freq != ht_cfreq) {
176 /*
177 * It's possible that some APs are confused here;
178 * Netgear WNDR3700 sometimes reports 4 higher than
179 * the actual channel in association responses, but
180 * since we look at probe response/beacon data here
181 * it should be OK.
182 */
183 sdata_info(sdata,
184 "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
185 channel->center_freq, ht_cfreq,
186 ht_oper->primary_chan, channel->band);
187 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
188 goto out;
189 }
190
191 /* check 40 MHz support, if we have it */
192 if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
193 switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
194 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
195 chandef->width = NL80211_CHAN_WIDTH_40;
196 chandef->center_freq1 += 10;
197 break;
198 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
199 chandef->width = NL80211_CHAN_WIDTH_40;
200 chandef->center_freq1 -= 10;
201 break;
202 }
203 } else {
204 /* 40 MHz (and 80 MHz) must be supported for VHT */
205 ret = IEEE80211_STA_DISABLE_VHT;
206 /* also mark 40 MHz disabled */
207 ret |= IEEE80211_STA_DISABLE_40MHZ;
208 goto out;
209 }
210
211 if (!vht_oper || !sband->vht_cap.vht_supported) {
212 ret = IEEE80211_STA_DISABLE_VHT;
213 goto out;
214 }
215
216 vht_chandef.chan = channel;
217 vht_chandef.center_freq1 =
218 ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
219 channel->band);
220 vht_chandef.center_freq2 = 0;
221
222 switch (vht_oper->chan_width) {
223 case IEEE80211_VHT_CHANWIDTH_USE_HT:
224 vht_chandef.width = chandef->width;
225 vht_chandef.center_freq1 = chandef->center_freq1;
226 break;
227 case IEEE80211_VHT_CHANWIDTH_80MHZ:
228 vht_chandef.width = NL80211_CHAN_WIDTH_80;
229 break;
230 case IEEE80211_VHT_CHANWIDTH_160MHZ:
231 vht_chandef.width = NL80211_CHAN_WIDTH_160;
232 break;
233 case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
234 vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
235 vht_chandef.center_freq2 =
236 ieee80211_channel_to_frequency(
237 vht_oper->center_freq_seg2_idx,
238 channel->band);
239 break;
240 default:
241 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
242 sdata_info(sdata,
243 "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
244 vht_oper->chan_width);
245 ret = IEEE80211_STA_DISABLE_VHT;
246 goto out;
247 }
248
249 if (!cfg80211_chandef_valid(&vht_chandef)) {
250 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
251 sdata_info(sdata,
252 "AP VHT information is invalid, disable VHT\n");
253 ret = IEEE80211_STA_DISABLE_VHT;
254 goto out;
255 }
256
257 if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
258 ret = 0;
259 goto out;
260 }
261
262 if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
263 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
264 sdata_info(sdata,
265 "AP VHT information doesn't match HT, disable VHT\n");
266 ret = IEEE80211_STA_DISABLE_VHT;
267 goto out;
268 }
269
270 *chandef = vht_chandef;
271
272 ret = 0;
273
274 out:
275 /*
276 * When tracking the current AP, don't do any further checks if the
277 * new chandef is identical to the one we're currently using for the
278 * connection. This keeps us from playing ping-pong with regulatory,
279 * without it the following can happen (for example):
280 * - connect to an AP with 80 MHz, world regdom allows 80 MHz
281 * - AP advertises regdom US
282 * - CRDA loads regdom US with 80 MHz prohibited (old database)
283 * - the code below detects an unsupported channel, downgrades, and
284 * we disconnect from the AP in the caller
285 * - disconnect causes CRDA to reload world regdomain and the game
286 * starts anew.
287 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
288 *
289 * It seems possible that there are still scenarios with CSA or real
290 * bandwidth changes where a this could happen, but those cases are
291 * less common and wouldn't completely prevent using the AP.
292 */
293 if (tracking &&
294 cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
295 return ret;
296
297 /* don't print the message below for VHT mismatch if VHT is disabled */
298 if (ret & IEEE80211_STA_DISABLE_VHT)
299 vht_chandef = *chandef;
300
301 /*
302 * Ignore the DISABLED flag when we're already connected and only
303 * tracking the APs beacon for bandwidth changes - otherwise we
304 * might get disconnected here if we connect to an AP, update our
305 * regulatory information based on the AP's country IE and the
306 * information we have is wrong/outdated and disables the channel
307 * that we're actually using for the connection to the AP.
308 */
309 while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
310 tracking ? 0 :
311 IEEE80211_CHAN_DISABLED)) {
312 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
313 ret = IEEE80211_STA_DISABLE_HT |
314 IEEE80211_STA_DISABLE_VHT;
315 break;
316 }
317
318 ret |= ieee80211_chandef_downgrade(chandef);
319 }
320
321 if (chandef->width != vht_chandef.width && !tracking)
322 sdata_info(sdata,
323 "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
324
325 WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
326 return ret;
327 }
328
329 static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
330 struct sta_info *sta,
331 const struct ieee80211_ht_operation *ht_oper,
332 const struct ieee80211_vht_operation *vht_oper,
333 const u8 *bssid, u32 *changed)
334 {
335 struct ieee80211_local *local = sdata->local;
336 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
337 struct ieee80211_supported_band *sband;
338 struct ieee80211_channel *chan;
339 struct cfg80211_chan_def chandef;
340 u16 ht_opmode;
341 u32 flags;
342 enum ieee80211_sta_rx_bandwidth new_sta_bw;
343 int ret;
344
345 /* if HT was/is disabled, don't track any bandwidth changes */
346 if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
347 return 0;
348
349 /* don't check VHT if we associated as non-VHT station */
350 if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
351 vht_oper = NULL;
352
353 if (WARN_ON_ONCE(!sta))
354 return -EINVAL;
355
356 /*
357 * if bss configuration changed store the new one -
358 * this may be applicable even if channel is identical
359 */
360 ht_opmode = le16_to_cpu(ht_oper->operation_mode);
361 if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
362 *changed |= BSS_CHANGED_HT;
363 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
364 }
365
366 chan = sdata->vif.bss_conf.chandef.chan;
367 sband = local->hw.wiphy->bands[chan->band];
368
369 /* calculate new channel (type) based on HT/VHT operation IEs */
370 flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
371 vht_oper, &chandef, true);
372
373 /*
374 * Downgrade the new channel if we associated with restricted
375 * capabilities. For example, if we associated as a 20 MHz STA
376 * to a 40 MHz AP (due to regulatory, capabilities or config
377 * reasons) then switching to a 40 MHz channel now won't do us
378 * any good -- we couldn't use it with the AP.
379 */
380 if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
381 chandef.width == NL80211_CHAN_WIDTH_80P80)
382 flags |= ieee80211_chandef_downgrade(&chandef);
383 if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
384 chandef.width == NL80211_CHAN_WIDTH_160)
385 flags |= ieee80211_chandef_downgrade(&chandef);
386 if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
387 chandef.width > NL80211_CHAN_WIDTH_20)
388 flags |= ieee80211_chandef_downgrade(&chandef);
389
390 if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
391 return 0;
392
393 sdata_info(sdata,
394 "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
395 ifmgd->bssid, chandef.chan->center_freq, chandef.width,
396 chandef.center_freq1, chandef.center_freq2);
397
398 if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
399 IEEE80211_STA_DISABLE_VHT |
400 IEEE80211_STA_DISABLE_40MHZ |
401 IEEE80211_STA_DISABLE_80P80MHZ |
402 IEEE80211_STA_DISABLE_160MHZ)) ||
403 !cfg80211_chandef_valid(&chandef)) {
404 sdata_info(sdata,
405 "AP %pM changed bandwidth in a way we can't support - disconnect\n",
406 ifmgd->bssid);
407 return -EINVAL;
408 }
409
410 switch (chandef.width) {
411 case NL80211_CHAN_WIDTH_20_NOHT:
412 case NL80211_CHAN_WIDTH_20:
413 new_sta_bw = IEEE80211_STA_RX_BW_20;
414 break;
415 case NL80211_CHAN_WIDTH_40:
416 new_sta_bw = IEEE80211_STA_RX_BW_40;
417 break;
418 case NL80211_CHAN_WIDTH_80:
419 new_sta_bw = IEEE80211_STA_RX_BW_80;
420 break;
421 case NL80211_CHAN_WIDTH_80P80:
422 case NL80211_CHAN_WIDTH_160:
423 new_sta_bw = IEEE80211_STA_RX_BW_160;
424 break;
425 default:
426 return -EINVAL;
427 }
428
429 if (new_sta_bw > sta->cur_max_bandwidth)
430 new_sta_bw = sta->cur_max_bandwidth;
431
432 if (new_sta_bw < sta->sta.bandwidth) {
433 sta->sta.bandwidth = new_sta_bw;
434 rate_control_rate_update(local, sband, sta,
435 IEEE80211_RC_BW_CHANGED);
436 }
437
438 ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
439 if (ret) {
440 sdata_info(sdata,
441 "AP %pM changed bandwidth to incompatible one - disconnect\n",
442 ifmgd->bssid);
443 return ret;
444 }
445
446 if (new_sta_bw > sta->sta.bandwidth) {
447 sta->sta.bandwidth = new_sta_bw;
448 rate_control_rate_update(local, sband, sta,
449 IEEE80211_RC_BW_CHANGED);
450 }
451
452 return 0;
453 }
454
455 /* frame sending functions */
456
457 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
458 struct sk_buff *skb, u8 ap_ht_param,
459 struct ieee80211_supported_band *sband,
460 struct ieee80211_channel *channel,
461 enum ieee80211_smps_mode smps)
462 {
463 u8 *pos;
464 u32 flags = channel->flags;
465 u16 cap;
466 struct ieee80211_sta_ht_cap ht_cap;
467
468 BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
469
470 memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
471 ieee80211_apply_htcap_overrides(sdata, &ht_cap);
472
473 /* determine capability flags */
474 cap = ht_cap.cap;
475
476 switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
477 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
478 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
479 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
480 cap &= ~IEEE80211_HT_CAP_SGI_40;
481 }
482 break;
483 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
484 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
485 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
486 cap &= ~IEEE80211_HT_CAP_SGI_40;
487 }
488 break;
489 }
490
491 /*
492 * If 40 MHz was disabled associate as though we weren't
493 * capable of 40 MHz -- some broken APs will never fall
494 * back to trying to transmit in 20 MHz.
495 */
496 if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
497 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
498 cap &= ~IEEE80211_HT_CAP_SGI_40;
499 }
500
501 /* set SM PS mode properly */
502 cap &= ~IEEE80211_HT_CAP_SM_PS;
503 switch (smps) {
504 case IEEE80211_SMPS_AUTOMATIC:
505 case IEEE80211_SMPS_NUM_MODES:
506 WARN_ON(1);
507 case IEEE80211_SMPS_OFF:
508 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
509 IEEE80211_HT_CAP_SM_PS_SHIFT;
510 break;
511 case IEEE80211_SMPS_STATIC:
512 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
513 IEEE80211_HT_CAP_SM_PS_SHIFT;
514 break;
515 case IEEE80211_SMPS_DYNAMIC:
516 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
517 IEEE80211_HT_CAP_SM_PS_SHIFT;
518 break;
519 }
520
521 /* reserve and fill IE */
522 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
523 ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
524 }
525
526 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
527 struct sk_buff *skb,
528 struct ieee80211_supported_band *sband,
529 struct ieee80211_vht_cap *ap_vht_cap)
530 {
531 u8 *pos;
532 u32 cap;
533 struct ieee80211_sta_vht_cap vht_cap;
534 u32 mask, ap_bf_sts, our_bf_sts;
535
536 BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
537
538 memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
539 ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
540
541 /* determine capability flags */
542 cap = vht_cap.cap;
543
544 if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
545 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
546 cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
547 }
548
549 if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
550 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
551 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
552 }
553
554 /*
555 * Some APs apparently get confused if our capabilities are better
556 * than theirs, so restrict what we advertise in the assoc request.
557 */
558 if (!(ap_vht_cap->vht_cap_info &
559 cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
560 cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
561
562 mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
563
564 ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
565 our_bf_sts = cap & mask;
566
567 if (ap_bf_sts < our_bf_sts) {
568 cap &= ~mask;
569 cap |= ap_bf_sts;
570 }
571
572 /* reserve and fill IE */
573 pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
574 ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
575 }
576
577 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
578 {
579 struct ieee80211_local *local = sdata->local;
580 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
581 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
582 struct sk_buff *skb;
583 struct ieee80211_mgmt *mgmt;
584 u8 *pos, qos_info;
585 size_t offset = 0, noffset;
586 int i, count, rates_len, supp_rates_len, shift;
587 u16 capab;
588 struct ieee80211_supported_band *sband;
589 struct ieee80211_chanctx_conf *chanctx_conf;
590 struct ieee80211_channel *chan;
591 u32 rate_flags, rates = 0;
592
593 sdata_assert_lock(sdata);
594
595 rcu_read_lock();
596 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
597 if (WARN_ON(!chanctx_conf)) {
598 rcu_read_unlock();
599 return;
600 }
601 chan = chanctx_conf->def.chan;
602 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
603 rcu_read_unlock();
604 sband = local->hw.wiphy->bands[chan->band];
605 shift = ieee80211_vif_get_shift(&sdata->vif);
606
607 if (assoc_data->supp_rates_len) {
608 /*
609 * Get all rates supported by the device and the AP as
610 * some APs don't like getting a superset of their rates
611 * in the association request (e.g. D-Link DAP 1353 in
612 * b-only mode)...
613 */
614 rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
615 assoc_data->supp_rates,
616 assoc_data->supp_rates_len,
617 &rates);
618 } else {
619 /*
620 * In case AP not provide any supported rates information
621 * before association, we send information element(s) with
622 * all rates that we support.
623 */
624 rates_len = 0;
625 for (i = 0; i < sband->n_bitrates; i++) {
626 if ((rate_flags & sband->bitrates[i].flags)
627 != rate_flags)
628 continue;
629 rates |= BIT(i);
630 rates_len++;
631 }
632 }
633
634 skb = alloc_skb(local->hw.extra_tx_headroom +
635 sizeof(*mgmt) + /* bit too much but doesn't matter */
636 2 + assoc_data->ssid_len + /* SSID */
637 4 + rates_len + /* (extended) rates */
638 4 + /* power capability */
639 2 + 2 * sband->n_channels + /* supported channels */
640 2 + sizeof(struct ieee80211_ht_cap) + /* HT */
641 2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
642 assoc_data->ie_len + /* extra IEs */
643 9, /* WMM */
644 GFP_KERNEL);
645 if (!skb)
646 return;
647
648 skb_reserve(skb, local->hw.extra_tx_headroom);
649
650 capab = WLAN_CAPABILITY_ESS;
651
652 if (sband->band == IEEE80211_BAND_2GHZ) {
653 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
654 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
655 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
656 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
657 }
658
659 if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
660 capab |= WLAN_CAPABILITY_PRIVACY;
661
662 if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
663 (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
664 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
665
666 mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
667 memset(mgmt, 0, 24);
668 memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
669 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
670 memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
671
672 if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
673 skb_put(skb, 10);
674 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
675 IEEE80211_STYPE_REASSOC_REQ);
676 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
677 mgmt->u.reassoc_req.listen_interval =
678 cpu_to_le16(local->hw.conf.listen_interval);
679 memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
680 ETH_ALEN);
681 } else {
682 skb_put(skb, 4);
683 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
684 IEEE80211_STYPE_ASSOC_REQ);
685 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
686 mgmt->u.assoc_req.listen_interval =
687 cpu_to_le16(local->hw.conf.listen_interval);
688 }
689
690 /* SSID */
691 pos = skb_put(skb, 2 + assoc_data->ssid_len);
692 *pos++ = WLAN_EID_SSID;
693 *pos++ = assoc_data->ssid_len;
694 memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
695
696 /* add all rates which were marked to be used above */
697 supp_rates_len = rates_len;
698 if (supp_rates_len > 8)
699 supp_rates_len = 8;
700
701 pos = skb_put(skb, supp_rates_len + 2);
702 *pos++ = WLAN_EID_SUPP_RATES;
703 *pos++ = supp_rates_len;
704
705 count = 0;
706 for (i = 0; i < sband->n_bitrates; i++) {
707 if (BIT(i) & rates) {
708 int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
709 5 * (1 << shift));
710 *pos++ = (u8) rate;
711 if (++count == 8)
712 break;
713 }
714 }
715
716 if (rates_len > count) {
717 pos = skb_put(skb, rates_len - count + 2);
718 *pos++ = WLAN_EID_EXT_SUPP_RATES;
719 *pos++ = rates_len - count;
720
721 for (i++; i < sband->n_bitrates; i++) {
722 if (BIT(i) & rates) {
723 int rate;
724 rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
725 5 * (1 << shift));
726 *pos++ = (u8) rate;
727 }
728 }
729 }
730
731 if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
732 /* 1. power capabilities */
733 pos = skb_put(skb, 4);
734 *pos++ = WLAN_EID_PWR_CAPABILITY;
735 *pos++ = 2;
736 *pos++ = 0; /* min tx power */
737 /* max tx power */
738 *pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
739
740 /* 2. supported channels */
741 /* TODO: get this in reg domain format */
742 pos = skb_put(skb, 2 * sband->n_channels + 2);
743 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
744 *pos++ = 2 * sband->n_channels;
745 for (i = 0; i < sband->n_channels; i++) {
746 *pos++ = ieee80211_frequency_to_channel(
747 sband->channels[i].center_freq);
748 *pos++ = 1; /* one channel in the subband*/
749 }
750 }
751
752 /* if present, add any custom IEs that go before HT */
753 if (assoc_data->ie_len) {
754 static const u8 before_ht[] = {
755 WLAN_EID_SSID,
756 WLAN_EID_SUPP_RATES,
757 WLAN_EID_EXT_SUPP_RATES,
758 WLAN_EID_PWR_CAPABILITY,
759 WLAN_EID_SUPPORTED_CHANNELS,
760 WLAN_EID_RSN,
761 WLAN_EID_QOS_CAPA,
762 WLAN_EID_RRM_ENABLED_CAPABILITIES,
763 WLAN_EID_MOBILITY_DOMAIN,
764 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
765 };
766 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
767 before_ht, ARRAY_SIZE(before_ht),
768 offset);
769 pos = skb_put(skb, noffset - offset);
770 memcpy(pos, assoc_data->ie + offset, noffset - offset);
771 offset = noffset;
772 }
773
774 if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
775 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
776 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
777
778 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
779 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
780 sband, chan, sdata->smps_mode);
781
782 /* if present, add any custom IEs that go before VHT */
783 if (assoc_data->ie_len) {
784 static const u8 before_vht[] = {
785 WLAN_EID_SSID,
786 WLAN_EID_SUPP_RATES,
787 WLAN_EID_EXT_SUPP_RATES,
788 WLAN_EID_PWR_CAPABILITY,
789 WLAN_EID_SUPPORTED_CHANNELS,
790 WLAN_EID_RSN,
791 WLAN_EID_QOS_CAPA,
792 WLAN_EID_RRM_ENABLED_CAPABILITIES,
793 WLAN_EID_MOBILITY_DOMAIN,
794 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
795 WLAN_EID_HT_CAPABILITY,
796 WLAN_EID_BSS_COEX_2040,
797 WLAN_EID_EXT_CAPABILITY,
798 WLAN_EID_QOS_TRAFFIC_CAPA,
799 WLAN_EID_TIM_BCAST_REQ,
800 WLAN_EID_INTERWORKING,
801 };
802 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
803 before_vht, ARRAY_SIZE(before_vht),
804 offset);
805 pos = skb_put(skb, noffset - offset);
806 memcpy(pos, assoc_data->ie + offset, noffset - offset);
807 offset = noffset;
808 }
809
810 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
811 ieee80211_add_vht_ie(sdata, skb, sband,
812 &assoc_data->ap_vht_cap);
813
814 /* if present, add any custom non-vendor IEs that go after HT */
815 if (assoc_data->ie_len) {
816 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
817 assoc_data->ie_len,
818 offset);
819 pos = skb_put(skb, noffset - offset);
820 memcpy(pos, assoc_data->ie + offset, noffset - offset);
821 offset = noffset;
822 }
823
824 if (assoc_data->wmm) {
825 if (assoc_data->uapsd) {
826 qos_info = ifmgd->uapsd_queues;
827 qos_info |= (ifmgd->uapsd_max_sp_len <<
828 IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
829 } else {
830 qos_info = 0;
831 }
832
833 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
834 }
835
836 /* add any remaining custom (i.e. vendor specific here) IEs */
837 if (assoc_data->ie_len) {
838 noffset = assoc_data->ie_len;
839 pos = skb_put(skb, noffset - offset);
840 memcpy(pos, assoc_data->ie + offset, noffset - offset);
841 }
842
843 drv_mgd_prepare_tx(local, sdata);
844
845 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
846 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
847 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
848 IEEE80211_TX_INTFL_MLME_CONN_TX;
849 ieee80211_tx_skb(sdata, skb);
850 }
851
852 void ieee80211_send_pspoll(struct ieee80211_local *local,
853 struct ieee80211_sub_if_data *sdata)
854 {
855 struct ieee80211_pspoll *pspoll;
856 struct sk_buff *skb;
857
858 skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
859 if (!skb)
860 return;
861
862 pspoll = (struct ieee80211_pspoll *) skb->data;
863 pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
864
865 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
866 ieee80211_tx_skb(sdata, skb);
867 }
868
869 void ieee80211_send_nullfunc(struct ieee80211_local *local,
870 struct ieee80211_sub_if_data *sdata,
871 int powersave)
872 {
873 struct sk_buff *skb;
874 struct ieee80211_hdr_3addr *nullfunc;
875 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
876
877 skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
878 if (!skb)
879 return;
880
881 nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
882 if (powersave)
883 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
884
885 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
886 IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
887
888 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
889 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
890
891 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
892 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
893
894 ieee80211_tx_skb(sdata, skb);
895 }
896
897 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
898 struct ieee80211_sub_if_data *sdata)
899 {
900 struct sk_buff *skb;
901 struct ieee80211_hdr *nullfunc;
902 __le16 fc;
903
904 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
905 return;
906
907 skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
908 if (!skb)
909 return;
910
911 skb_reserve(skb, local->hw.extra_tx_headroom);
912
913 nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
914 memset(nullfunc, 0, 30);
915 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
916 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
917 nullfunc->frame_control = fc;
918 memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
919 memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
920 memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
921 memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
922
923 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
924 ieee80211_tx_skb(sdata, skb);
925 }
926
927 /* spectrum management related things */
928 static void ieee80211_chswitch_work(struct work_struct *work)
929 {
930 struct ieee80211_sub_if_data *sdata =
931 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
932 struct ieee80211_local *local = sdata->local;
933 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
934 int ret;
935
936 if (!ieee80211_sdata_running(sdata))
937 return;
938
939 sdata_lock(sdata);
940 mutex_lock(&local->mtx);
941 mutex_lock(&local->chanctx_mtx);
942
943 if (!ifmgd->associated)
944 goto out;
945
946 if (!sdata->vif.csa_active)
947 goto out;
948
949 /*
950 * using reservation isn't immediate as it may be deferred until later
951 * with multi-vif. once reservation is complete it will re-schedule the
952 * work with no reserved_chanctx so verify chandef to check if it
953 * completed successfully
954 */
955
956 if (sdata->reserved_chanctx) {
957 /*
958 * with multi-vif csa driver may call ieee80211_csa_finish()
959 * many times while waiting for other interfaces to use their
960 * reservations
961 */
962 if (sdata->reserved_ready)
963 goto out;
964
965 ret = ieee80211_vif_use_reserved_context(sdata);
966 if (ret) {
967 sdata_info(sdata,
968 "failed to use reserved channel context, disconnecting (err=%d)\n",
969 ret);
970 ieee80211_queue_work(&sdata->local->hw,
971 &ifmgd->csa_connection_drop_work);
972 goto out;
973 }
974
975 goto out;
976 }
977
978 if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
979 &sdata->csa_chandef)) {
980 sdata_info(sdata,
981 "failed to finalize channel switch, disconnecting\n");
982 ieee80211_queue_work(&sdata->local->hw,
983 &ifmgd->csa_connection_drop_work);
984 goto out;
985 }
986
987 /* XXX: shouldn't really modify cfg80211-owned data! */
988 ifmgd->associated->channel = sdata->csa_chandef.chan;
989
990 sdata->vif.csa_active = false;
991
992 /* XXX: wait for a beacon first? */
993 if (sdata->csa_block_tx) {
994 ieee80211_wake_vif_queues(local, sdata,
995 IEEE80211_QUEUE_STOP_REASON_CSA);
996 sdata->csa_block_tx = false;
997 }
998
999 ieee80211_sta_reset_beacon_monitor(sdata);
1000 ieee80211_sta_reset_conn_monitor(sdata);
1001
1002 out:
1003 mutex_unlock(&local->chanctx_mtx);
1004 mutex_unlock(&local->mtx);
1005 sdata_unlock(sdata);
1006 }
1007
1008 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1009 {
1010 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1011 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1012
1013 trace_api_chswitch_done(sdata, success);
1014 if (!success) {
1015 sdata_info(sdata,
1016 "driver channel switch failed, disconnecting\n");
1017 ieee80211_queue_work(&sdata->local->hw,
1018 &ifmgd->csa_connection_drop_work);
1019 } else {
1020 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1021 }
1022 }
1023 EXPORT_SYMBOL(ieee80211_chswitch_done);
1024
1025 static void ieee80211_chswitch_timer(unsigned long data)
1026 {
1027 struct ieee80211_sub_if_data *sdata =
1028 (struct ieee80211_sub_if_data *) data;
1029
1030 ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1031 }
1032
1033 static void
1034 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1035 u64 timestamp, struct ieee802_11_elems *elems,
1036 bool beacon)
1037 {
1038 struct ieee80211_local *local = sdata->local;
1039 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1040 struct cfg80211_bss *cbss = ifmgd->associated;
1041 struct ieee80211_chanctx_conf *conf;
1042 struct ieee80211_chanctx *chanctx;
1043 enum ieee80211_band current_band;
1044 struct ieee80211_csa_ie csa_ie;
1045 int res;
1046
1047 sdata_assert_lock(sdata);
1048
1049 if (!cbss)
1050 return;
1051
1052 if (local->scanning)
1053 return;
1054
1055 /* disregard subsequent announcements if we are already processing */
1056 if (sdata->vif.csa_active)
1057 return;
1058
1059 current_band = cbss->channel->band;
1060 memset(&csa_ie, 0, sizeof(csa_ie));
1061 res = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, current_band,
1062 ifmgd->flags,
1063 ifmgd->associated->bssid, &csa_ie);
1064 if (res < 0)
1065 ieee80211_queue_work(&local->hw,
1066 &ifmgd->csa_connection_drop_work);
1067 if (res)
1068 return;
1069
1070 if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1071 IEEE80211_CHAN_DISABLED)) {
1072 sdata_info(sdata,
1073 "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1074 ifmgd->associated->bssid,
1075 csa_ie.chandef.chan->center_freq,
1076 csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1077 csa_ie.chandef.center_freq2);
1078 ieee80211_queue_work(&local->hw,
1079 &ifmgd->csa_connection_drop_work);
1080 return;
1081 }
1082
1083 mutex_lock(&local->mtx);
1084 mutex_lock(&local->chanctx_mtx);
1085 conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
1086 lockdep_is_held(&local->chanctx_mtx));
1087 if (!conf) {
1088 sdata_info(sdata,
1089 "no channel context assigned to vif?, disconnecting\n");
1090 ieee80211_queue_work(&local->hw,
1091 &ifmgd->csa_connection_drop_work);
1092 mutex_unlock(&local->chanctx_mtx);
1093 mutex_unlock(&local->mtx);
1094 return;
1095 }
1096
1097 chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1098
1099 if (local->use_chanctx) {
1100 u32 num_chanctx = 0;
1101 list_for_each_entry(chanctx, &local->chanctx_list, list)
1102 num_chanctx++;
1103
1104 if (num_chanctx > 1 ||
1105 !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
1106 sdata_info(sdata,
1107 "not handling chan-switch with channel contexts\n");
1108 ieee80211_queue_work(&local->hw,
1109 &ifmgd->csa_connection_drop_work);
1110 mutex_unlock(&local->chanctx_mtx);
1111 mutex_unlock(&local->mtx);
1112 return;
1113 }
1114 }
1115
1116 res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
1117 chanctx->mode, false);
1118 if (res) {
1119 sdata_info(sdata,
1120 "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1121 res);
1122 ieee80211_queue_work(&local->hw,
1123 &ifmgd->csa_connection_drop_work);
1124 mutex_unlock(&local->chanctx_mtx);
1125 mutex_unlock(&local->mtx);
1126 return;
1127 }
1128 mutex_unlock(&local->chanctx_mtx);
1129
1130 sdata->vif.csa_active = true;
1131 sdata->csa_chandef = csa_ie.chandef;
1132 sdata->csa_block_tx = csa_ie.mode;
1133
1134 if (sdata->csa_block_tx)
1135 ieee80211_stop_vif_queues(local, sdata,
1136 IEEE80211_QUEUE_STOP_REASON_CSA);
1137 mutex_unlock(&local->mtx);
1138
1139 if (local->ops->channel_switch) {
1140 /* use driver's channel switch callback */
1141 struct ieee80211_channel_switch ch_switch = {
1142 .timestamp = timestamp,
1143 .block_tx = csa_ie.mode,
1144 .chandef = csa_ie.chandef,
1145 .count = csa_ie.count,
1146 };
1147
1148 drv_channel_switch(local, &ch_switch);
1149 return;
1150 }
1151
1152 /* channel switch handled in software */
1153 if (csa_ie.count <= 1)
1154 ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1155 else
1156 mod_timer(&ifmgd->chswitch_timer,
1157 TU_TO_EXP_TIME(csa_ie.count * cbss->beacon_interval));
1158 }
1159
1160 static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
1161 struct ieee80211_channel *channel,
1162 const u8 *country_ie, u8 country_ie_len,
1163 const u8 *pwr_constr_elem)
1164 {
1165 struct ieee80211_country_ie_triplet *triplet;
1166 int chan = ieee80211_frequency_to_channel(channel->center_freq);
1167 int i, chan_pwr, chan_increment, new_ap_level;
1168 bool have_chan_pwr = false;
1169
1170 /* Invalid IE */
1171 if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1172 return 0;
1173
1174 triplet = (void *)(country_ie + 3);
1175 country_ie_len -= 3;
1176
1177 switch (channel->band) {
1178 default:
1179 WARN_ON_ONCE(1);
1180 /* fall through */
1181 case IEEE80211_BAND_2GHZ:
1182 case IEEE80211_BAND_60GHZ:
1183 chan_increment = 1;
1184 break;
1185 case IEEE80211_BAND_5GHZ:
1186 chan_increment = 4;
1187 break;
1188 }
1189
1190 /* find channel */
1191 while (country_ie_len >= 3) {
1192 u8 first_channel = triplet->chans.first_channel;
1193
1194 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
1195 goto next;
1196
1197 for (i = 0; i < triplet->chans.num_channels; i++) {
1198 if (first_channel + i * chan_increment == chan) {
1199 have_chan_pwr = true;
1200 chan_pwr = triplet->chans.max_power;
1201 break;
1202 }
1203 }
1204 if (have_chan_pwr)
1205 break;
1206
1207 next:
1208 triplet++;
1209 country_ie_len -= 3;
1210 }
1211
1212 if (!have_chan_pwr)
1213 return 0;
1214
1215 new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
1216
1217 if (sdata->ap_power_level == new_ap_level)
1218 return 0;
1219
1220 sdata_info(sdata,
1221 "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
1222 new_ap_level, chan_pwr, *pwr_constr_elem,
1223 sdata->u.mgd.bssid);
1224 sdata->ap_power_level = new_ap_level;
1225 if (__ieee80211_recalc_txpower(sdata))
1226 return BSS_CHANGED_TXPOWER;
1227 return 0;
1228 }
1229
1230 /* powersave */
1231 static void ieee80211_enable_ps(struct ieee80211_local *local,
1232 struct ieee80211_sub_if_data *sdata)
1233 {
1234 struct ieee80211_conf *conf = &local->hw.conf;
1235
1236 /*
1237 * If we are scanning right now then the parameters will
1238 * take effect when scan finishes.
1239 */
1240 if (local->scanning)
1241 return;
1242
1243 if (conf->dynamic_ps_timeout > 0 &&
1244 !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
1245 mod_timer(&local->dynamic_ps_timer, jiffies +
1246 msecs_to_jiffies(conf->dynamic_ps_timeout));
1247 } else {
1248 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1249 ieee80211_send_nullfunc(local, sdata, 1);
1250
1251 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1252 (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
1253 return;
1254
1255 conf->flags |= IEEE80211_CONF_PS;
1256 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1257 }
1258 }
1259
1260 static void ieee80211_change_ps(struct ieee80211_local *local)
1261 {
1262 struct ieee80211_conf *conf = &local->hw.conf;
1263
1264 if (local->ps_sdata) {
1265 ieee80211_enable_ps(local, local->ps_sdata);
1266 } else if (conf->flags & IEEE80211_CONF_PS) {
1267 conf->flags &= ~IEEE80211_CONF_PS;
1268 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1269 del_timer_sync(&local->dynamic_ps_timer);
1270 cancel_work_sync(&local->dynamic_ps_enable_work);
1271 }
1272 }
1273
1274 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
1275 {
1276 struct ieee80211_if_managed *mgd = &sdata->u.mgd;
1277 struct sta_info *sta = NULL;
1278 bool authorized = false;
1279
1280 if (!mgd->powersave)
1281 return false;
1282
1283 if (mgd->broken_ap)
1284 return false;
1285
1286 if (!mgd->associated)
1287 return false;
1288
1289 if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1290 return false;
1291
1292 if (!mgd->have_beacon)
1293 return false;
1294
1295 rcu_read_lock();
1296 sta = sta_info_get(sdata, mgd->bssid);
1297 if (sta)
1298 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1299 rcu_read_unlock();
1300
1301 return authorized;
1302 }
1303
1304 /* need to hold RTNL or interface lock */
1305 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1306 {
1307 struct ieee80211_sub_if_data *sdata, *found = NULL;
1308 int count = 0;
1309 int timeout;
1310
1311 if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
1312 local->ps_sdata = NULL;
1313 return;
1314 }
1315
1316 list_for_each_entry(sdata, &local->interfaces, list) {
1317 if (!ieee80211_sdata_running(sdata))
1318 continue;
1319 if (sdata->vif.type == NL80211_IFTYPE_AP) {
1320 /* If an AP vif is found, then disable PS
1321 * by setting the count to zero thereby setting
1322 * ps_sdata to NULL.
1323 */
1324 count = 0;
1325 break;
1326 }
1327 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1328 continue;
1329 found = sdata;
1330 count++;
1331 }
1332
1333 if (count == 1 && ieee80211_powersave_allowed(found)) {
1334 s32 beaconint_us;
1335
1336 if (latency < 0)
1337 latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1338
1339 beaconint_us = ieee80211_tu_to_usec(
1340 found->vif.bss_conf.beacon_int);
1341
1342 timeout = local->dynamic_ps_forced_timeout;
1343 if (timeout < 0) {
1344 /*
1345 * Go to full PSM if the user configures a very low
1346 * latency requirement.
1347 * The 2000 second value is there for compatibility
1348 * until the PM_QOS_NETWORK_LATENCY is configured
1349 * with real values.
1350 */
1351 if (latency > (1900 * USEC_PER_MSEC) &&
1352 latency != (2000 * USEC_PER_SEC))
1353 timeout = 0;
1354 else
1355 timeout = 100;
1356 }
1357 local->hw.conf.dynamic_ps_timeout = timeout;
1358
1359 if (beaconint_us > latency) {
1360 local->ps_sdata = NULL;
1361 } else {
1362 int maxslp = 1;
1363 u8 dtimper = found->u.mgd.dtim_period;
1364
1365 /* If the TIM IE is invalid, pretend the value is 1 */
1366 if (!dtimper)
1367 dtimper = 1;
1368 else if (dtimper > 1)
1369 maxslp = min_t(int, dtimper,
1370 latency / beaconint_us);
1371
1372 local->hw.conf.max_sleep_period = maxslp;
1373 local->hw.conf.ps_dtim_period = dtimper;
1374 local->ps_sdata = found;
1375 }
1376 } else {
1377 local->ps_sdata = NULL;
1378 }
1379
1380 ieee80211_change_ps(local);
1381 }
1382
1383 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
1384 {
1385 bool ps_allowed = ieee80211_powersave_allowed(sdata);
1386
1387 if (sdata->vif.bss_conf.ps != ps_allowed) {
1388 sdata->vif.bss_conf.ps = ps_allowed;
1389 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
1390 }
1391 }
1392
1393 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
1394 {
1395 struct ieee80211_local *local =
1396 container_of(work, struct ieee80211_local,
1397 dynamic_ps_disable_work);
1398
1399 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1400 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1401 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1402 }
1403
1404 ieee80211_wake_queues_by_reason(&local->hw,
1405 IEEE80211_MAX_QUEUE_MAP,
1406 IEEE80211_QUEUE_STOP_REASON_PS,
1407 false);
1408 }
1409
1410 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
1411 {
1412 struct ieee80211_local *local =
1413 container_of(work, struct ieee80211_local,
1414 dynamic_ps_enable_work);
1415 struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1416 struct ieee80211_if_managed *ifmgd;
1417 unsigned long flags;
1418 int q;
1419
1420 /* can only happen when PS was just disabled anyway */
1421 if (!sdata)
1422 return;
1423
1424 ifmgd = &sdata->u.mgd;
1425
1426 if (local->hw.conf.flags & IEEE80211_CONF_PS)
1427 return;
1428
1429 if (local->hw.conf.dynamic_ps_timeout > 0) {
1430 /* don't enter PS if TX frames are pending */
1431 if (drv_tx_frames_pending(local)) {
1432 mod_timer(&local->dynamic_ps_timer, jiffies +
1433 msecs_to_jiffies(
1434 local->hw.conf.dynamic_ps_timeout));
1435 return;
1436 }
1437
1438 /*
1439 * transmission can be stopped by others which leads to
1440 * dynamic_ps_timer expiry. Postpone the ps timer if it
1441 * is not the actual idle state.
1442 */
1443 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1444 for (q = 0; q < local->hw.queues; q++) {
1445 if (local->queue_stop_reasons[q]) {
1446 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1447 flags);
1448 mod_timer(&local->dynamic_ps_timer, jiffies +
1449 msecs_to_jiffies(
1450 local->hw.conf.dynamic_ps_timeout));
1451 return;
1452 }
1453 }
1454 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1455 }
1456
1457 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1458 !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1459 if (drv_tx_frames_pending(local)) {
1460 mod_timer(&local->dynamic_ps_timer, jiffies +
1461 msecs_to_jiffies(
1462 local->hw.conf.dynamic_ps_timeout));
1463 } else {
1464 ieee80211_send_nullfunc(local, sdata, 1);
1465 /* Flush to get the tx status of nullfunc frame */
1466 ieee80211_flush_queues(local, sdata);
1467 }
1468 }
1469
1470 if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
1471 (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
1472 (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1473 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
1474 local->hw.conf.flags |= IEEE80211_CONF_PS;
1475 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1476 }
1477 }
1478
1479 void ieee80211_dynamic_ps_timer(unsigned long data)
1480 {
1481 struct ieee80211_local *local = (void *) data;
1482
1483 if (local->quiescing || local->suspended)
1484 return;
1485
1486 ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1487 }
1488
1489 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
1490 {
1491 struct delayed_work *delayed_work =
1492 container_of(work, struct delayed_work, work);
1493 struct ieee80211_sub_if_data *sdata =
1494 container_of(delayed_work, struct ieee80211_sub_if_data,
1495 dfs_cac_timer_work);
1496 struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1497
1498 mutex_lock(&sdata->local->mtx);
1499 if (sdata->wdev.cac_started) {
1500 ieee80211_vif_release_channel(sdata);
1501 cfg80211_cac_event(sdata->dev, &chandef,
1502 NL80211_RADAR_CAC_FINISHED,
1503 GFP_KERNEL);
1504 }
1505 mutex_unlock(&sdata->local->mtx);
1506 }
1507
1508 /* MLME */
1509 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1510 struct ieee80211_sub_if_data *sdata,
1511 const u8 *wmm_param, size_t wmm_param_len)
1512 {
1513 struct ieee80211_tx_queue_params params;
1514 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1515 size_t left;
1516 int count;
1517 const u8 *pos;
1518 u8 uapsd_queues = 0;
1519
1520 if (!local->ops->conf_tx)
1521 return false;
1522
1523 if (local->hw.queues < IEEE80211_NUM_ACS)
1524 return false;
1525
1526 if (!wmm_param)
1527 return false;
1528
1529 if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1530 return false;
1531
1532 if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1533 uapsd_queues = ifmgd->uapsd_queues;
1534
1535 count = wmm_param[6] & 0x0f;
1536 if (count == ifmgd->wmm_last_param_set)
1537 return false;
1538 ifmgd->wmm_last_param_set = count;
1539
1540 pos = wmm_param + 8;
1541 left = wmm_param_len - 8;
1542
1543 memset(&params, 0, sizeof(params));
1544
1545 sdata->wmm_acm = 0;
1546 for (; left >= 4; left -= 4, pos += 4) {
1547 int aci = (pos[0] >> 5) & 0x03;
1548 int acm = (pos[0] >> 4) & 0x01;
1549 bool uapsd = false;
1550 int queue;
1551
1552 switch (aci) {
1553 case 1: /* AC_BK */
1554 queue = 3;
1555 if (acm)
1556 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
1557 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
1558 uapsd = true;
1559 break;
1560 case 2: /* AC_VI */
1561 queue = 1;
1562 if (acm)
1563 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
1564 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
1565 uapsd = true;
1566 break;
1567 case 3: /* AC_VO */
1568 queue = 0;
1569 if (acm)
1570 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
1571 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
1572 uapsd = true;
1573 break;
1574 case 0: /* AC_BE */
1575 default:
1576 queue = 2;
1577 if (acm)
1578 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
1579 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
1580 uapsd = true;
1581 break;
1582 }
1583
1584 params.aifs = pos[0] & 0x0f;
1585 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
1586 params.cw_min = ecw2cw(pos[1] & 0x0f);
1587 params.txop = get_unaligned_le16(pos + 2);
1588 params.acm = acm;
1589 params.uapsd = uapsd;
1590
1591 mlme_dbg(sdata,
1592 "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
1593 queue, aci, acm,
1594 params.aifs, params.cw_min, params.cw_max,
1595 params.txop, params.uapsd);
1596 sdata->tx_conf[queue] = params;
1597 if (drv_conf_tx(local, sdata, queue, &params))
1598 sdata_err(sdata,
1599 "failed to set TX queue parameters for queue %d\n",
1600 queue);
1601 }
1602
1603 /* enable WMM or activate new settings */
1604 sdata->vif.bss_conf.qos = true;
1605 return true;
1606 }
1607
1608 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1609 {
1610 lockdep_assert_held(&sdata->local->mtx);
1611
1612 sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1613 ieee80211_run_deferred_scan(sdata->local);
1614 }
1615
1616 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1617 {
1618 mutex_lock(&sdata->local->mtx);
1619 __ieee80211_stop_poll(sdata);
1620 mutex_unlock(&sdata->local->mtx);
1621 }
1622
1623 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
1624 u16 capab, bool erp_valid, u8 erp)
1625 {
1626 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1627 u32 changed = 0;
1628 bool use_protection;
1629 bool use_short_preamble;
1630 bool use_short_slot;
1631
1632 if (erp_valid) {
1633 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
1634 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
1635 } else {
1636 use_protection = false;
1637 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
1638 }
1639
1640 use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
1641 if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1642 use_short_slot = true;
1643
1644 if (use_protection != bss_conf->use_cts_prot) {
1645 bss_conf->use_cts_prot = use_protection;
1646 changed |= BSS_CHANGED_ERP_CTS_PROT;
1647 }
1648
1649 if (use_short_preamble != bss_conf->use_short_preamble) {
1650 bss_conf->use_short_preamble = use_short_preamble;
1651 changed |= BSS_CHANGED_ERP_PREAMBLE;
1652 }
1653
1654 if (use_short_slot != bss_conf->use_short_slot) {
1655 bss_conf->use_short_slot = use_short_slot;
1656 changed |= BSS_CHANGED_ERP_SLOT;
1657 }
1658
1659 return changed;
1660 }
1661
1662 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1663 struct cfg80211_bss *cbss,
1664 u32 bss_info_changed)
1665 {
1666 struct ieee80211_bss *bss = (void *)cbss->priv;
1667 struct ieee80211_local *local = sdata->local;
1668 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1669
1670 bss_info_changed |= BSS_CHANGED_ASSOC;
1671 bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1672 bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1673
1674 sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1675 beacon_loss_count * bss_conf->beacon_int));
1676
1677 sdata->u.mgd.associated = cbss;
1678 memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1679
1680 sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
1681
1682 if (sdata->vif.p2p) {
1683 const struct cfg80211_bss_ies *ies;
1684
1685 rcu_read_lock();
1686 ies = rcu_dereference(cbss->ies);
1687 if (ies) {
1688 int ret;
1689
1690 ret = cfg80211_get_p2p_attr(
1691 ies->data, ies->len,
1692 IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
1693 (u8 *) &bss_conf->p2p_noa_attr,
1694 sizeof(bss_conf->p2p_noa_attr));
1695 if (ret >= 2) {
1696 sdata->u.mgd.p2p_noa_index =
1697 bss_conf->p2p_noa_attr.index;
1698 bss_info_changed |= BSS_CHANGED_P2P_PS;
1699 }
1700 }
1701 rcu_read_unlock();
1702 }
1703
1704 /* just to be sure */
1705 ieee80211_stop_poll(sdata);
1706
1707 ieee80211_led_assoc(local, 1);
1708
1709 if (sdata->u.mgd.have_beacon) {
1710 /*
1711 * If the AP is buggy we may get here with no DTIM period
1712 * known, so assume it's 1 which is the only safe assumption
1713 * in that case, although if the TIM IE is broken powersave
1714 * probably just won't work at all.
1715 */
1716 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1717 bss_conf->beacon_rate = bss->beacon_rate;
1718 bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1719 } else {
1720 bss_conf->beacon_rate = NULL;
1721 bss_conf->dtim_period = 0;
1722 }
1723
1724 bss_conf->assoc = 1;
1725
1726 /* Tell the driver to monitor connection quality (if supported) */
1727 if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1728 bss_conf->cqm_rssi_thold)
1729 bss_info_changed |= BSS_CHANGED_CQM;
1730
1731 /* Enable ARP filtering */
1732 if (bss_conf->arp_addr_cnt)
1733 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
1734
1735 ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1736
1737 mutex_lock(&local->iflist_mtx);
1738 ieee80211_recalc_ps(local, -1);
1739 mutex_unlock(&local->iflist_mtx);
1740
1741 ieee80211_recalc_smps(sdata);
1742 ieee80211_recalc_ps_vif(sdata);
1743
1744 netif_carrier_on(sdata->dev);
1745 }
1746
1747 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1748 u16 stype, u16 reason, bool tx,
1749 u8 *frame_buf)
1750 {
1751 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1752 struct ieee80211_local *local = sdata->local;
1753 u32 changed = 0;
1754
1755 sdata_assert_lock(sdata);
1756
1757 if (WARN_ON_ONCE(tx && !frame_buf))
1758 return;
1759
1760 if (WARN_ON(!ifmgd->associated))
1761 return;
1762
1763 ieee80211_stop_poll(sdata);
1764
1765 ifmgd->associated = NULL;
1766 netif_carrier_off(sdata->dev);
1767
1768 /*
1769 * if we want to get out of ps before disassoc (why?) we have
1770 * to do it before sending disassoc, as otherwise the null-packet
1771 * won't be valid.
1772 */
1773 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1774 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1775 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1776 }
1777 local->ps_sdata = NULL;
1778
1779 /* disable per-vif ps */
1780 ieee80211_recalc_ps_vif(sdata);
1781
1782 /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
1783 if (tx)
1784 ieee80211_flush_queues(local, sdata);
1785
1786 /* deauthenticate/disassociate now */
1787 if (tx || frame_buf)
1788 ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
1789 reason, tx, frame_buf);
1790
1791 /* flush out frame */
1792 if (tx)
1793 ieee80211_flush_queues(local, sdata);
1794
1795 /* clear bssid only after building the needed mgmt frames */
1796 memset(ifmgd->bssid, 0, ETH_ALEN);
1797
1798 /* remove AP and TDLS peers */
1799 sta_info_flush(sdata);
1800
1801 /* finally reset all BSS / config parameters */
1802 changed |= ieee80211_reset_erp_info(sdata);
1803
1804 ieee80211_led_assoc(local, 0);
1805 changed |= BSS_CHANGED_ASSOC;
1806 sdata->vif.bss_conf.assoc = false;
1807
1808 ifmgd->p2p_noa_index = -1;
1809 memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
1810 sizeof(sdata->vif.bss_conf.p2p_noa_attr));
1811
1812 /* on the next assoc, re-program HT/VHT parameters */
1813 memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
1814 memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
1815 memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
1816 memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
1817
1818 sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
1819
1820 del_timer_sync(&local->dynamic_ps_timer);
1821 cancel_work_sync(&local->dynamic_ps_enable_work);
1822
1823 /* Disable ARP filtering */
1824 if (sdata->vif.bss_conf.arp_addr_cnt)
1825 changed |= BSS_CHANGED_ARP_FILTER;
1826
1827 sdata->vif.bss_conf.qos = false;
1828 changed |= BSS_CHANGED_QOS;
1829
1830 /* The BSSID (not really interesting) and HT changed */
1831 changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
1832 ieee80211_bss_info_change_notify(sdata, changed);
1833
1834 /* disassociated - set to defaults now */
1835 ieee80211_set_wmm_default(sdata, false);
1836
1837 del_timer_sync(&sdata->u.mgd.conn_mon_timer);
1838 del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
1839 del_timer_sync(&sdata->u.mgd.timer);
1840 del_timer_sync(&sdata->u.mgd.chswitch_timer);
1841
1842 sdata->vif.bss_conf.dtim_period = 0;
1843 sdata->vif.bss_conf.beacon_rate = NULL;
1844
1845 ifmgd->have_beacon = false;
1846
1847 ifmgd->flags = 0;
1848 mutex_lock(&local->mtx);
1849 ieee80211_vif_release_channel(sdata);
1850
1851 sdata->vif.csa_active = false;
1852 if (sdata->csa_block_tx) {
1853 ieee80211_wake_vif_queues(local, sdata,
1854 IEEE80211_QUEUE_STOP_REASON_CSA);
1855 sdata->csa_block_tx = false;
1856 }
1857 mutex_unlock(&local->mtx);
1858
1859 sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
1860 }
1861
1862 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
1863 struct ieee80211_hdr *hdr)
1864 {
1865 /*
1866 * We can postpone the mgd.timer whenever receiving unicast frames
1867 * from AP because we know that the connection is working both ways
1868 * at that time. But multicast frames (and hence also beacons) must
1869 * be ignored here, because we need to trigger the timer during
1870 * data idle periods for sending the periodic probe request to the
1871 * AP we're connected to.
1872 */
1873 if (is_multicast_ether_addr(hdr->addr1))
1874 return;
1875
1876 ieee80211_sta_reset_conn_monitor(sdata);
1877 }
1878
1879 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
1880 {
1881 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1882 struct ieee80211_local *local = sdata->local;
1883
1884 mutex_lock(&local->mtx);
1885 if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
1886 goto out;
1887
1888 __ieee80211_stop_poll(sdata);
1889
1890 mutex_lock(&local->iflist_mtx);
1891 ieee80211_recalc_ps(local, -1);
1892 mutex_unlock(&local->iflist_mtx);
1893
1894 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
1895 goto out;
1896
1897 /*
1898 * We've received a probe response, but are not sure whether
1899 * we have or will be receiving any beacons or data, so let's
1900 * schedule the timers again, just in case.
1901 */
1902 ieee80211_sta_reset_beacon_monitor(sdata);
1903
1904 mod_timer(&ifmgd->conn_mon_timer,
1905 round_jiffies_up(jiffies +
1906 IEEE80211_CONNECTION_IDLE_TIME));
1907 out:
1908 mutex_unlock(&local->mtx);
1909 }
1910
1911 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
1912 struct ieee80211_hdr *hdr, bool ack)
1913 {
1914 if (!ieee80211_is_data(hdr->frame_control))
1915 return;
1916
1917 if (ieee80211_is_nullfunc(hdr->frame_control) &&
1918 sdata->u.mgd.probe_send_count > 0) {
1919 if (ack)
1920 ieee80211_sta_reset_conn_monitor(sdata);
1921 else
1922 sdata->u.mgd.nullfunc_failed = true;
1923 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1924 return;
1925 }
1926
1927 if (ack)
1928 ieee80211_sta_reset_conn_monitor(sdata);
1929 }
1930
1931 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
1932 {
1933 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1934 const u8 *ssid;
1935 u8 *dst = ifmgd->associated->bssid;
1936 u8 unicast_limit = max(1, max_probe_tries - 3);
1937
1938 /*
1939 * Try sending broadcast probe requests for the last three
1940 * probe requests after the first ones failed since some
1941 * buggy APs only support broadcast probe requests.
1942 */
1943 if (ifmgd->probe_send_count >= unicast_limit)
1944 dst = NULL;
1945
1946 /*
1947 * When the hardware reports an accurate Tx ACK status, it's
1948 * better to send a nullfunc frame instead of a probe request,
1949 * as it will kick us off the AP quickly if we aren't associated
1950 * anymore. The timeout will be reset if the frame is ACKed by
1951 * the AP.
1952 */
1953 ifmgd->probe_send_count++;
1954
1955 if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
1956 ifmgd->nullfunc_failed = false;
1957 ieee80211_send_nullfunc(sdata->local, sdata, 0);
1958 } else {
1959 int ssid_len;
1960
1961 rcu_read_lock();
1962 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
1963 if (WARN_ON_ONCE(ssid == NULL))
1964 ssid_len = 0;
1965 else
1966 ssid_len = ssid[1];
1967
1968 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
1969 0, (u32) -1, true, 0,
1970 ifmgd->associated->channel, false);
1971 rcu_read_unlock();
1972 }
1973
1974 ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
1975 run_again(sdata, ifmgd->probe_timeout);
1976 if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
1977 ieee80211_flush_queues(sdata->local, sdata);
1978 }
1979
1980 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
1981 bool beacon)
1982 {
1983 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1984 bool already = false;
1985
1986 if (!ieee80211_sdata_running(sdata))
1987 return;
1988
1989 sdata_lock(sdata);
1990
1991 if (!ifmgd->associated)
1992 goto out;
1993
1994 mutex_lock(&sdata->local->mtx);
1995
1996 if (sdata->local->tmp_channel || sdata->local->scanning) {
1997 mutex_unlock(&sdata->local->mtx);
1998 goto out;
1999 }
2000
2001 if (beacon) {
2002 mlme_dbg_ratelimited(sdata,
2003 "detected beacon loss from AP (missed %d beacons) - probing\n",
2004 beacon_loss_count);
2005
2006 ieee80211_cqm_rssi_notify(&sdata->vif,
2007 NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
2008 GFP_KERNEL);
2009 }
2010
2011 /*
2012 * The driver/our work has already reported this event or the
2013 * connection monitoring has kicked in and we have already sent
2014 * a probe request. Or maybe the AP died and the driver keeps
2015 * reporting until we disassociate...
2016 *
2017 * In either case we have to ignore the current call to this
2018 * function (except for setting the correct probe reason bit)
2019 * because otherwise we would reset the timer every time and
2020 * never check whether we received a probe response!
2021 */
2022 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
2023 already = true;
2024
2025 ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
2026
2027 mutex_unlock(&sdata->local->mtx);
2028
2029 if (already)
2030 goto out;
2031
2032 mutex_lock(&sdata->local->iflist_mtx);
2033 ieee80211_recalc_ps(sdata->local, -1);
2034 mutex_unlock(&sdata->local->iflist_mtx);
2035
2036 ifmgd->probe_send_count = 0;
2037 ieee80211_mgd_probe_ap_send(sdata);
2038 out:
2039 sdata_unlock(sdata);
2040 }
2041
2042 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
2043 struct ieee80211_vif *vif)
2044 {
2045 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2046 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2047 struct cfg80211_bss *cbss;
2048 struct sk_buff *skb;
2049 const u8 *ssid;
2050 int ssid_len;
2051
2052 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2053 return NULL;
2054
2055 sdata_assert_lock(sdata);
2056
2057 if (ifmgd->associated)
2058 cbss = ifmgd->associated;
2059 else if (ifmgd->auth_data)
2060 cbss = ifmgd->auth_data->bss;
2061 else if (ifmgd->assoc_data)
2062 cbss = ifmgd->assoc_data->bss;
2063 else
2064 return NULL;
2065
2066 rcu_read_lock();
2067 ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2068 if (WARN_ON_ONCE(ssid == NULL))
2069 ssid_len = 0;
2070 else
2071 ssid_len = ssid[1];
2072
2073 skb = ieee80211_build_probe_req(sdata, cbss->bssid,
2074 (u32) -1, cbss->channel,
2075 ssid + 2, ssid_len,
2076 NULL, 0, true);
2077 rcu_read_unlock();
2078
2079 return skb;
2080 }
2081 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
2082
2083 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2084 {
2085 struct ieee80211_local *local = sdata->local;
2086 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2087 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2088
2089 sdata_lock(sdata);
2090 if (!ifmgd->associated) {
2091 sdata_unlock(sdata);
2092 return;
2093 }
2094
2095 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
2096 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2097 true, frame_buf);
2098 mutex_lock(&local->mtx);
2099 sdata->vif.csa_active = false;
2100 if (sdata->csa_block_tx) {
2101 ieee80211_wake_vif_queues(local, sdata,
2102 IEEE80211_QUEUE_STOP_REASON_CSA);
2103 sdata->csa_block_tx = false;
2104 }
2105 mutex_unlock(&local->mtx);
2106
2107 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
2108 IEEE80211_DEAUTH_FRAME_LEN);
2109 sdata_unlock(sdata);
2110 }
2111
2112 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
2113 {
2114 struct ieee80211_sub_if_data *sdata =
2115 container_of(work, struct ieee80211_sub_if_data,
2116 u.mgd.beacon_connection_loss_work);
2117 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2118 struct sta_info *sta;
2119
2120 if (ifmgd->associated) {
2121 rcu_read_lock();
2122 sta = sta_info_get(sdata, ifmgd->bssid);
2123 if (sta)
2124 sta->beacon_loss_count++;
2125 rcu_read_unlock();
2126 }
2127
2128 if (ifmgd->connection_loss) {
2129 sdata_info(sdata, "Connection to AP %pM lost\n",
2130 ifmgd->bssid);
2131 __ieee80211_disconnect(sdata);
2132 } else {
2133 ieee80211_mgd_probe_ap(sdata, true);
2134 }
2135 }
2136
2137 static void ieee80211_csa_connection_drop_work(struct work_struct *work)
2138 {
2139 struct ieee80211_sub_if_data *sdata =
2140 container_of(work, struct ieee80211_sub_if_data,
2141 u.mgd.csa_connection_drop_work);
2142
2143 __ieee80211_disconnect(sdata);
2144 }
2145
2146 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
2147 {
2148 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2149 struct ieee80211_hw *hw = &sdata->local->hw;
2150
2151 trace_api_beacon_loss(sdata);
2152
2153 sdata->u.mgd.connection_loss = false;
2154 ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2155 }
2156 EXPORT_SYMBOL(ieee80211_beacon_loss);
2157
2158 void ieee80211_connection_loss(struct ieee80211_vif *vif)
2159 {
2160 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2161 struct ieee80211_hw *hw = &sdata->local->hw;
2162
2163 trace_api_connection_loss(sdata);
2164
2165 sdata->u.mgd.connection_loss = true;
2166 ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2167 }
2168 EXPORT_SYMBOL(ieee80211_connection_loss);
2169
2170
2171 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
2172 bool assoc)
2173 {
2174 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2175
2176 sdata_assert_lock(sdata);
2177
2178 if (!assoc) {
2179 sta_info_destroy_addr(sdata, auth_data->bss->bssid);
2180
2181 memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2182 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2183 sdata->u.mgd.flags = 0;
2184 mutex_lock(&sdata->local->mtx);
2185 ieee80211_vif_release_channel(sdata);
2186 mutex_unlock(&sdata->local->mtx);
2187 }
2188
2189 cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
2190 kfree(auth_data);
2191 sdata->u.mgd.auth_data = NULL;
2192 }
2193
2194 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
2195 struct ieee80211_mgmt *mgmt, size_t len)
2196 {
2197 struct ieee80211_local *local = sdata->local;
2198 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2199 u8 *pos;
2200 struct ieee802_11_elems elems;
2201 u32 tx_flags = 0;
2202
2203 pos = mgmt->u.auth.variable;
2204 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2205 if (!elems.challenge)
2206 return;
2207 auth_data->expected_transaction = 4;
2208 drv_mgd_prepare_tx(sdata->local, sdata);
2209 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2210 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2211 IEEE80211_TX_INTFL_MLME_CONN_TX;
2212 ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
2213 elems.challenge - 2, elems.challenge_len + 2,
2214 auth_data->bss->bssid, auth_data->bss->bssid,
2215 auth_data->key, auth_data->key_len,
2216 auth_data->key_idx, tx_flags);
2217 }
2218
2219 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
2220 struct ieee80211_mgmt *mgmt, size_t len)
2221 {
2222 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2223 u8 bssid[ETH_ALEN];
2224 u16 auth_alg, auth_transaction, status_code;
2225 struct sta_info *sta;
2226
2227 sdata_assert_lock(sdata);
2228
2229 if (len < 24 + 6)
2230 return;
2231
2232 if (!ifmgd->auth_data || ifmgd->auth_data->done)
2233 return;
2234
2235 memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
2236
2237 if (!ether_addr_equal(bssid, mgmt->bssid))
2238 return;
2239
2240 auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
2241 auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
2242 status_code = le16_to_cpu(mgmt->u.auth.status_code);
2243
2244 if (auth_alg != ifmgd->auth_data->algorithm ||
2245 auth_transaction != ifmgd->auth_data->expected_transaction) {
2246 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
2247 mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
2248 auth_transaction,
2249 ifmgd->auth_data->expected_transaction);
2250 return;
2251 }
2252
2253 if (status_code != WLAN_STATUS_SUCCESS) {
2254 sdata_info(sdata, "%pM denied authentication (status %d)\n",
2255 mgmt->sa, status_code);
2256 ieee80211_destroy_auth_data(sdata, false);
2257 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2258 return;
2259 }
2260
2261 switch (ifmgd->auth_data->algorithm) {
2262 case WLAN_AUTH_OPEN:
2263 case WLAN_AUTH_LEAP:
2264 case WLAN_AUTH_FT:
2265 case WLAN_AUTH_SAE:
2266 break;
2267 case WLAN_AUTH_SHARED_KEY:
2268 if (ifmgd->auth_data->expected_transaction != 4) {
2269 ieee80211_auth_challenge(sdata, mgmt, len);
2270 /* need another frame */
2271 return;
2272 }
2273 break;
2274 default:
2275 WARN_ONCE(1, "invalid auth alg %d",
2276 ifmgd->auth_data->algorithm);
2277 return;
2278 }
2279
2280 sdata_info(sdata, "authenticated\n");
2281 ifmgd->auth_data->done = true;
2282 ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2283 ifmgd->auth_data->timeout_started = true;
2284 run_again(sdata, ifmgd->auth_data->timeout);
2285
2286 if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
2287 ifmgd->auth_data->expected_transaction != 2) {
2288 /*
2289 * Report auth frame to user space for processing since another
2290 * round of Authentication frames is still needed.
2291 */
2292 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2293 return;
2294 }
2295
2296 /* move station state to auth */
2297 mutex_lock(&sdata->local->sta_mtx);
2298 sta = sta_info_get(sdata, bssid);
2299 if (!sta) {
2300 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2301 goto out_err;
2302 }
2303 if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
2304 sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2305 goto out_err;
2306 }
2307 mutex_unlock(&sdata->local->sta_mtx);
2308
2309 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2310 return;
2311 out_err:
2312 mutex_unlock(&sdata->local->sta_mtx);
2313 /* ignore frame -- wait for timeout */
2314 }
2315
2316 #define case_WLAN(type) \
2317 case WLAN_REASON_##type: return #type
2318
2319 static const char *ieee80211_get_reason_code_string(u16 reason_code)
2320 {
2321 switch (reason_code) {
2322 case_WLAN(UNSPECIFIED);
2323 case_WLAN(PREV_AUTH_NOT_VALID);
2324 case_WLAN(DEAUTH_LEAVING);
2325 case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
2326 case_WLAN(DISASSOC_AP_BUSY);
2327 case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
2328 case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
2329 case_WLAN(DISASSOC_STA_HAS_LEFT);
2330 case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
2331 case_WLAN(DISASSOC_BAD_POWER);
2332 case_WLAN(DISASSOC_BAD_SUPP_CHAN);
2333 case_WLAN(INVALID_IE);
2334 case_WLAN(MIC_FAILURE);
2335 case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
2336 case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
2337 case_WLAN(IE_DIFFERENT);
2338 case_WLAN(INVALID_GROUP_CIPHER);
2339 case_WLAN(INVALID_PAIRWISE_CIPHER);
2340 case_WLAN(INVALID_AKMP);
2341 case_WLAN(UNSUPP_RSN_VERSION);
2342 case_WLAN(INVALID_RSN_IE_CAP);
2343 case_WLAN(IEEE8021X_FAILED);
2344 case_WLAN(CIPHER_SUITE_REJECTED);
2345 case_WLAN(DISASSOC_UNSPECIFIED_QOS);
2346 case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
2347 case_WLAN(DISASSOC_LOW_ACK);
2348 case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
2349 case_WLAN(QSTA_LEAVE_QBSS);
2350 case_WLAN(QSTA_NOT_USE);
2351 case_WLAN(QSTA_REQUIRE_SETUP);
2352 case_WLAN(QSTA_TIMEOUT);
2353 case_WLAN(QSTA_CIPHER_NOT_SUPP);
2354 case_WLAN(MESH_PEER_CANCELED);
2355 case_WLAN(MESH_MAX_PEERS);
2356 case_WLAN(MESH_CONFIG);
2357 case_WLAN(MESH_CLOSE);
2358 case_WLAN(MESH_MAX_RETRIES);
2359 case_WLAN(MESH_CONFIRM_TIMEOUT);
2360 case_WLAN(MESH_INVALID_GTK);
2361 case_WLAN(MESH_INCONSISTENT_PARAM);
2362 case_WLAN(MESH_INVALID_SECURITY);
2363 case_WLAN(MESH_PATH_ERROR);
2364 case_WLAN(MESH_PATH_NOFORWARD);
2365 case_WLAN(MESH_PATH_DEST_UNREACHABLE);
2366 case_WLAN(MAC_EXISTS_IN_MBSS);
2367 case_WLAN(MESH_CHAN_REGULATORY);
2368 case_WLAN(MESH_CHAN);
2369 default: return "<unknown>";
2370 }
2371 }
2372
2373 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
2374 struct ieee80211_mgmt *mgmt, size_t len)
2375 {
2376 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2377 const u8 *bssid = NULL;
2378 u16 reason_code;
2379
2380 sdata_assert_lock(sdata);
2381
2382 if (len < 24 + 2)
2383 return;
2384
2385 if (!ifmgd->associated ||
2386 !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2387 return;
2388
2389 bssid = ifmgd->associated->bssid;
2390
2391 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2392
2393 sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
2394 bssid, reason_code, ieee80211_get_reason_code_string(reason_code));
2395
2396 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2397
2398 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2399 }
2400
2401
2402 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
2403 struct ieee80211_mgmt *mgmt, size_t len)
2404 {
2405 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2406 u16 reason_code;
2407
2408 sdata_assert_lock(sdata);
2409
2410 if (len < 24 + 2)
2411 return;
2412
2413 if (!ifmgd->associated ||
2414 !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2415 return;
2416
2417 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
2418
2419 sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
2420 mgmt->sa, reason_code);
2421
2422 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2423
2424 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2425 }
2426
2427 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
2428 u8 *supp_rates, unsigned int supp_rates_len,
2429 u32 *rates, u32 *basic_rates,
2430 bool *have_higher_than_11mbit,
2431 int *min_rate, int *min_rate_index,
2432 int shift, u32 rate_flags)
2433 {
2434 int i, j;
2435
2436 for (i = 0; i < supp_rates_len; i++) {
2437 int rate = supp_rates[i] & 0x7f;
2438 bool is_basic = !!(supp_rates[i] & 0x80);
2439
2440 if ((rate * 5 * (1 << shift)) > 110)
2441 *have_higher_than_11mbit = true;
2442
2443 /*
2444 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
2445 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
2446 *
2447 * Note: Even through the membership selector and the basic
2448 * rate flag share the same bit, they are not exactly
2449 * the same.
2450 */
2451 if (!!(supp_rates[i] & 0x80) &&
2452 (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
2453 continue;
2454
2455 for (j = 0; j < sband->n_bitrates; j++) {
2456 struct ieee80211_rate *br;
2457 int brate;
2458
2459 br = &sband->bitrates[j];
2460 if ((rate_flags & br->flags) != rate_flags)
2461 continue;
2462
2463 brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
2464 if (brate == rate) {
2465 *rates |= BIT(j);
2466 if (is_basic)
2467 *basic_rates |= BIT(j);
2468 if ((rate * 5) < *min_rate) {
2469 *min_rate = rate * 5;
2470 *min_rate_index = j;
2471 }
2472 break;
2473 }
2474 }
2475 }
2476 }
2477
2478 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2479 bool assoc)
2480 {
2481 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2482
2483 sdata_assert_lock(sdata);
2484
2485 if (!assoc) {
2486 sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
2487
2488 memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2489 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2490 sdata->u.mgd.flags = 0;
2491 mutex_lock(&sdata->local->mtx);
2492 ieee80211_vif_release_channel(sdata);
2493 mutex_unlock(&sdata->local->mtx);
2494 }
2495
2496 kfree(assoc_data);
2497 sdata->u.mgd.assoc_data = NULL;
2498 }
2499
2500 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
2501 struct cfg80211_bss *cbss,
2502 struct ieee80211_mgmt *mgmt, size_t len)
2503 {
2504 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2505 struct ieee80211_local *local = sdata->local;
2506 struct ieee80211_supported_band *sband;
2507 struct sta_info *sta;
2508 u8 *pos;
2509 u16 capab_info, aid;
2510 struct ieee802_11_elems elems;
2511 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2512 const struct cfg80211_bss_ies *bss_ies = NULL;
2513 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2514 u32 changed = 0;
2515 int err;
2516 bool ret;
2517
2518 /* AssocResp and ReassocResp have identical structure */
2519
2520 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2521 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2522
2523 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
2524 sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
2525 aid);
2526 aid &= ~(BIT(15) | BIT(14));
2527
2528 ifmgd->broken_ap = false;
2529
2530 if (aid == 0 || aid > IEEE80211_MAX_AID) {
2531 sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
2532 aid);
2533 aid = 0;
2534 ifmgd->broken_ap = true;
2535 }
2536
2537 pos = mgmt->u.assoc_resp.variable;
2538 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2539
2540 if (!elems.supp_rates) {
2541 sdata_info(sdata, "no SuppRates element in AssocResp\n");
2542 return false;
2543 }
2544
2545 ifmgd->aid = aid;
2546
2547 /*
2548 * Some APs are erroneously not including some information in their
2549 * (re)association response frames. Try to recover by using the data
2550 * from the beacon or probe response. This seems to afflict mobile
2551 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
2552 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
2553 */
2554 if ((assoc_data->wmm && !elems.wmm_param) ||
2555 (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2556 (!elems.ht_cap_elem || !elems.ht_operation)) ||
2557 (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2558 (!elems.vht_cap_elem || !elems.vht_operation))) {
2559 const struct cfg80211_bss_ies *ies;
2560 struct ieee802_11_elems bss_elems;
2561
2562 rcu_read_lock();
2563 ies = rcu_dereference(cbss->ies);
2564 if (ies)
2565 bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
2566 GFP_ATOMIC);
2567 rcu_read_unlock();
2568 if (!bss_ies)
2569 return false;
2570
2571 ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
2572 false, &bss_elems);
2573 if (assoc_data->wmm &&
2574 !elems.wmm_param && bss_elems.wmm_param) {
2575 elems.wmm_param = bss_elems.wmm_param;
2576 sdata_info(sdata,
2577 "AP bug: WMM param missing from AssocResp\n");
2578 }
2579
2580 /*
2581 * Also check if we requested HT/VHT, otherwise the AP doesn't
2582 * have to include the IEs in the (re)association response.
2583 */
2584 if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
2585 !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2586 elems.ht_cap_elem = bss_elems.ht_cap_elem;
2587 sdata_info(sdata,
2588 "AP bug: HT capability missing from AssocResp\n");
2589 }
2590 if (!elems.ht_operation && bss_elems.ht_operation &&
2591 !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2592 elems.ht_operation = bss_elems.ht_operation;
2593 sdata_info(sdata,
2594 "AP bug: HT operation missing from AssocResp\n");
2595 }
2596 if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
2597 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2598 elems.vht_cap_elem = bss_elems.vht_cap_elem;
2599 sdata_info(sdata,
2600 "AP bug: VHT capa missing from AssocResp\n");
2601 }
2602 if (!elems.vht_operation && bss_elems.vht_operation &&
2603 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2604 elems.vht_operation = bss_elems.vht_operation;
2605 sdata_info(sdata,
2606 "AP bug: VHT operation missing from AssocResp\n");
2607 }
2608 }
2609
2610 /*
2611 * We previously checked these in the beacon/probe response, so
2612 * they should be present here. This is just a safety net.
2613 */
2614 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2615 (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
2616 sdata_info(sdata,
2617 "HT AP is missing WMM params or HT capability/operation\n");
2618 ret = false;
2619 goto out;
2620 }
2621
2622 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2623 (!elems.vht_cap_elem || !elems.vht_operation)) {
2624 sdata_info(sdata,
2625 "VHT AP is missing VHT capability/operation\n");
2626 ret = false;
2627 goto out;
2628 }
2629
2630 mutex_lock(&sdata->local->sta_mtx);
2631 /*
2632 * station info was already allocated and inserted before
2633 * the association and should be available to us
2634 */
2635 sta = sta_info_get(sdata, cbss->bssid);
2636 if (WARN_ON(!sta)) {
2637 mutex_unlock(&sdata->local->sta_mtx);
2638 ret = false;
2639 goto out;
2640 }
2641
2642 sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2643
2644 /* Set up internal HT/VHT capabilities */
2645 if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
2646 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2647 elems.ht_cap_elem, sta);
2648
2649 if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
2650 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2651 elems.vht_cap_elem, sta);
2652
2653 /*
2654 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
2655 * in their association response, so ignore that data for our own
2656 * configuration. If it changed since the last beacon, we'll get the
2657 * next beacon and update then.
2658 */
2659
2660 /*
2661 * If an operating mode notification IE is present, override the
2662 * NSS calculation (that would be done in rate_control_rate_init())
2663 * and use the # of streams from that element.
2664 */
2665 if (elems.opmode_notif &&
2666 !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
2667 u8 nss;
2668
2669 nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
2670 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
2671 nss += 1;
2672 sta->sta.rx_nss = nss;
2673 }
2674
2675 rate_control_rate_init(sta);
2676
2677 if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
2678 set_sta_flag(sta, WLAN_STA_MFP);
2679
2680 if (elems.wmm_param)
2681 set_sta_flag(sta, WLAN_STA_WME);
2682
2683 err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
2684 if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
2685 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
2686 if (err) {
2687 sdata_info(sdata,
2688 "failed to move station %pM to desired state\n",
2689 sta->sta.addr);
2690 WARN_ON(__sta_info_destroy(sta));
2691 mutex_unlock(&sdata->local->sta_mtx);
2692 ret = false;
2693 goto out;
2694 }
2695
2696 mutex_unlock(&sdata->local->sta_mtx);
2697
2698 /*
2699 * Always handle WMM once after association regardless
2700 * of the first value the AP uses. Setting -1 here has
2701 * that effect because the AP values is an unsigned
2702 * 4-bit value.
2703 */
2704 ifmgd->wmm_last_param_set = -1;
2705
2706 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) && elems.wmm_param)
2707 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
2708 elems.wmm_param_len);
2709 else
2710 ieee80211_set_wmm_default(sdata, false);
2711 changed |= BSS_CHANGED_QOS;
2712
2713 /* set AID and assoc capability,
2714 * ieee80211_set_associated() will tell the driver */
2715 bss_conf->aid = aid;
2716 bss_conf->assoc_capability = capab_info;
2717 ieee80211_set_associated(sdata, cbss, changed);
2718
2719 /*
2720 * If we're using 4-addr mode, let the AP know that we're
2721 * doing so, so that it can create the STA VLAN on its side
2722 */
2723 if (ifmgd->use_4addr)
2724 ieee80211_send_4addr_nullfunc(local, sdata);
2725
2726 /*
2727 * Start timer to probe the connection to the AP now.
2728 * Also start the timer that will detect beacon loss.
2729 */
2730 ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
2731 ieee80211_sta_reset_beacon_monitor(sdata);
2732
2733 ret = true;
2734 out:
2735 kfree(bss_ies);
2736 return ret;
2737 }
2738
2739 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
2740 struct ieee80211_mgmt *mgmt,
2741 size_t len)
2742 {
2743 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2744 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2745 u16 capab_info, status_code, aid;
2746 struct ieee802_11_elems elems;
2747 u8 *pos;
2748 bool reassoc;
2749 struct cfg80211_bss *bss;
2750
2751 sdata_assert_lock(sdata);
2752
2753 if (!assoc_data)
2754 return;
2755 if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
2756 return;
2757
2758 /*
2759 * AssocResp and ReassocResp have identical structure, so process both
2760 * of them in this function.
2761 */
2762
2763 if (len < 24 + 6)
2764 return;
2765
2766 reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
2767 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2768 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
2769 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2770
2771 sdata_info(sdata,
2772 "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
2773 reassoc ? "Rea" : "A", mgmt->sa,
2774 capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
2775
2776 pos = mgmt->u.assoc_resp.variable;
2777 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2778
2779 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
2780 elems.timeout_int &&
2781 elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
2782 u32 tu, ms;
2783 tu = le32_to_cpu(elems.timeout_int->value);
2784 ms = tu * 1024 / 1000;
2785 sdata_info(sdata,
2786 "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
2787 mgmt->sa, tu, ms);
2788 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
2789 assoc_data->timeout_started = true;
2790 if (ms > IEEE80211_ASSOC_TIMEOUT)
2791 run_again(sdata, assoc_data->timeout);
2792 return;
2793 }
2794
2795 bss = assoc_data->bss;
2796
2797 if (status_code != WLAN_STATUS_SUCCESS) {
2798 sdata_info(sdata, "%pM denied association (code=%d)\n",
2799 mgmt->sa, status_code);
2800 ieee80211_destroy_assoc_data(sdata, false);
2801 } else {
2802 if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
2803 /* oops -- internal error -- send timeout for now */
2804 ieee80211_destroy_assoc_data(sdata, false);
2805 cfg80211_assoc_timeout(sdata->dev, bss);
2806 return;
2807 }
2808 sdata_info(sdata, "associated\n");
2809
2810 /*
2811 * destroy assoc_data afterwards, as otherwise an idle
2812 * recalc after assoc_data is NULL but before associated
2813 * is set can cause the interface to go idle
2814 */
2815 ieee80211_destroy_assoc_data(sdata, true);
2816 }
2817
2818 cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len);
2819 }
2820
2821 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2822 struct ieee80211_mgmt *mgmt, size_t len,
2823 struct ieee80211_rx_status *rx_status,
2824 struct ieee802_11_elems *elems)
2825 {
2826 struct ieee80211_local *local = sdata->local;
2827 struct ieee80211_bss *bss;
2828 struct ieee80211_channel *channel;
2829
2830 sdata_assert_lock(sdata);
2831
2832 channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
2833 if (!channel)
2834 return;
2835
2836 bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
2837 channel);
2838 if (bss) {
2839 sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
2840 ieee80211_rx_bss_put(local, bss);
2841 }
2842 }
2843
2844
2845 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
2846 struct sk_buff *skb)
2847 {
2848 struct ieee80211_mgmt *mgmt = (void *)skb->data;
2849 struct ieee80211_if_managed *ifmgd;
2850 struct ieee80211_rx_status *rx_status = (void *) skb->cb;
2851 size_t baselen, len = skb->len;
2852 struct ieee802_11_elems elems;
2853
2854 ifmgd = &sdata->u.mgd;
2855
2856 sdata_assert_lock(sdata);
2857
2858 if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
2859 return; /* ignore ProbeResp to foreign address */
2860
2861 baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
2862 if (baselen > len)
2863 return;
2864
2865 ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
2866 false, &elems);
2867
2868 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2869
2870 if (ifmgd->associated &&
2871 ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2872 ieee80211_reset_ap_probe(sdata);
2873
2874 if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
2875 ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
2876 /* got probe response, continue with auth */
2877 sdata_info(sdata, "direct probe responded\n");
2878 ifmgd->auth_data->tries = 0;
2879 ifmgd->auth_data->timeout = jiffies;
2880 ifmgd->auth_data->timeout_started = true;
2881 run_again(sdata, ifmgd->auth_data->timeout);
2882 }
2883 }
2884
2885 /*
2886 * This is the canonical list of information elements we care about,
2887 * the filter code also gives us all changes to the Microsoft OUI
2888 * (00:50:F2) vendor IE which is used for WMM which we need to track.
2889 *
2890 * We implement beacon filtering in software since that means we can
2891 * avoid processing the frame here and in cfg80211, and userspace
2892 * will not be able to tell whether the hardware supports it or not.
2893 *
2894 * XXX: This list needs to be dynamic -- userspace needs to be able to
2895 * add items it requires. It also needs to be able to tell us to
2896 * look out for other vendor IEs.
2897 */
2898 static const u64 care_about_ies =
2899 (1ULL << WLAN_EID_COUNTRY) |
2900 (1ULL << WLAN_EID_ERP_INFO) |
2901 (1ULL << WLAN_EID_CHANNEL_SWITCH) |
2902 (1ULL << WLAN_EID_PWR_CONSTRAINT) |
2903 (1ULL << WLAN_EID_HT_CAPABILITY) |
2904 (1ULL << WLAN_EID_HT_OPERATION);
2905
2906 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
2907 struct ieee80211_mgmt *mgmt, size_t len,
2908 struct ieee80211_rx_status *rx_status)
2909 {
2910 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2911 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2912 size_t baselen;
2913 struct ieee802_11_elems elems;
2914 struct ieee80211_local *local = sdata->local;
2915 struct ieee80211_chanctx_conf *chanctx_conf;
2916 struct ieee80211_channel *chan;
2917 struct sta_info *sta;
2918 u32 changed = 0;
2919 bool erp_valid;
2920 u8 erp_value = 0;
2921 u32 ncrc;
2922 u8 *bssid;
2923 u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
2924
2925 sdata_assert_lock(sdata);
2926
2927 /* Process beacon from the current BSS */
2928 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2929 if (baselen > len)
2930 return;
2931
2932 rcu_read_lock();
2933 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2934 if (!chanctx_conf) {
2935 rcu_read_unlock();
2936 return;
2937 }
2938
2939 if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
2940 rcu_read_unlock();
2941 return;
2942 }
2943 chan = chanctx_conf->def.chan;
2944 rcu_read_unlock();
2945
2946 if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
2947 ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
2948 ieee802_11_parse_elems(mgmt->u.beacon.variable,
2949 len - baselen, false, &elems);
2950
2951 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2952 if (elems.tim && !elems.parse_error) {
2953 const struct ieee80211_tim_ie *tim_ie = elems.tim;
2954 ifmgd->dtim_period = tim_ie->dtim_period;
2955 }
2956 ifmgd->have_beacon = true;
2957 ifmgd->assoc_data->need_beacon = false;
2958 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
2959 sdata->vif.bss_conf.sync_tsf =
2960 le64_to_cpu(mgmt->u.beacon.timestamp);
2961 sdata->vif.bss_conf.sync_device_ts =
2962 rx_status->device_timestamp;
2963 if (elems.tim)
2964 sdata->vif.bss_conf.sync_dtim_count =
2965 elems.tim->dtim_count;
2966 else
2967 sdata->vif.bss_conf.sync_dtim_count = 0;
2968 }
2969 /* continue assoc process */
2970 ifmgd->assoc_data->timeout = jiffies;
2971 ifmgd->assoc_data->timeout_started = true;
2972 run_again(sdata, ifmgd->assoc_data->timeout);
2973 return;
2974 }
2975
2976 if (!ifmgd->associated ||
2977 !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2978 return;
2979 bssid = ifmgd->associated->bssid;
2980
2981 /* Track average RSSI from the Beacon frames of the current AP */
2982 ifmgd->last_beacon_signal = rx_status->signal;
2983 if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
2984 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
2985 ifmgd->ave_beacon_signal = rx_status->signal * 16;
2986 ifmgd->last_cqm_event_signal = 0;
2987 ifmgd->count_beacon_signal = 1;
2988 ifmgd->last_ave_beacon_signal = 0;
2989 } else {
2990 ifmgd->ave_beacon_signal =
2991 (IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
2992 (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
2993 ifmgd->ave_beacon_signal) / 16;
2994 ifmgd->count_beacon_signal++;
2995 }
2996
2997 if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
2998 ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
2999 int sig = ifmgd->ave_beacon_signal;
3000 int last_sig = ifmgd->last_ave_beacon_signal;
3001
3002 /*
3003 * if signal crosses either of the boundaries, invoke callback
3004 * with appropriate parameters
3005 */
3006 if (sig > ifmgd->rssi_max_thold &&
3007 (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
3008 ifmgd->last_ave_beacon_signal = sig;
3009 drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
3010 } else if (sig < ifmgd->rssi_min_thold &&
3011 (last_sig >= ifmgd->rssi_max_thold ||
3012 last_sig == 0)) {
3013 ifmgd->last_ave_beacon_signal = sig;
3014 drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
3015 }
3016 }
3017
3018 if (bss_conf->cqm_rssi_thold &&
3019 ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3020 !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3021 int sig = ifmgd->ave_beacon_signal / 16;
3022 int last_event = ifmgd->last_cqm_event_signal;
3023 int thold = bss_conf->cqm_rssi_thold;
3024 int hyst = bss_conf->cqm_rssi_hyst;
3025 if (sig < thold &&
3026 (last_event == 0 || sig < last_event - hyst)) {
3027 ifmgd->last_cqm_event_signal = sig;
3028 ieee80211_cqm_rssi_notify(
3029 &sdata->vif,
3030 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3031 GFP_KERNEL);
3032 } else if (sig > thold &&
3033 (last_event == 0 || sig > last_event + hyst)) {
3034 ifmgd->last_cqm_event_signal = sig;
3035 ieee80211_cqm_rssi_notify(
3036 &sdata->vif,
3037 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3038 GFP_KERNEL);
3039 }
3040 }
3041
3042 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
3043 mlme_dbg_ratelimited(sdata,
3044 "cancelling AP probe due to a received beacon\n");
3045 ieee80211_reset_ap_probe(sdata);
3046 }
3047
3048 /*
3049 * Push the beacon loss detection into the future since
3050 * we are processing a beacon from the AP just now.
3051 */
3052 ieee80211_sta_reset_beacon_monitor(sdata);
3053
3054 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
3055 ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3056 len - baselen, false, &elems,
3057 care_about_ies, ncrc);
3058
3059 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
3060 bool directed_tim = ieee80211_check_tim(elems.tim,
3061 elems.tim_len,
3062 ifmgd->aid);
3063 if (directed_tim) {
3064 if (local->hw.conf.dynamic_ps_timeout > 0) {
3065 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
3066 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
3067 ieee80211_hw_config(local,
3068 IEEE80211_CONF_CHANGE_PS);
3069 }
3070 ieee80211_send_nullfunc(local, sdata, 0);
3071 } else if (!local->pspolling && sdata->u.mgd.powersave) {
3072 local->pspolling = true;
3073
3074 /*
3075 * Here is assumed that the driver will be
3076 * able to send ps-poll frame and receive a
3077 * response even though power save mode is
3078 * enabled, but some drivers might require
3079 * to disable power save here. This needs
3080 * to be investigated.
3081 */
3082 ieee80211_send_pspoll(local, sdata);
3083 }
3084 }
3085 }
3086
3087 if (sdata->vif.p2p) {
3088 struct ieee80211_p2p_noa_attr noa = {};
3089 int ret;
3090
3091 ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
3092 len - baselen,
3093 IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3094 (u8 *) &noa, sizeof(noa));
3095 if (ret >= 2) {
3096 if (sdata->u.mgd.p2p_noa_index != noa.index) {
3097 /* valid noa_attr and index changed */
3098 sdata->u.mgd.p2p_noa_index = noa.index;
3099 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
3100 changed |= BSS_CHANGED_P2P_PS;
3101 /*
3102 * make sure we update all information, the CRC
3103 * mechanism doesn't look at P2P attributes.
3104 */
3105 ifmgd->beacon_crc_valid = false;
3106 }
3107 } else if (sdata->u.mgd.p2p_noa_index != -1) {
3108 /* noa_attr not found and we had valid noa_attr before */
3109 sdata->u.mgd.p2p_noa_index = -1;
3110 memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3111 changed |= BSS_CHANGED_P2P_PS;
3112 ifmgd->beacon_crc_valid = false;
3113 }
3114 }
3115
3116 if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3117 return;
3118 ifmgd->beacon_crc = ncrc;
3119 ifmgd->beacon_crc_valid = true;
3120
3121 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3122
3123 ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
3124 &elems, true);
3125
3126 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
3127 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3128 elems.wmm_param_len))
3129 changed |= BSS_CHANGED_QOS;
3130
3131 /*
3132 * If we haven't had a beacon before, tell the driver about the
3133 * DTIM period (and beacon timing if desired) now.
3134 */
3135 if (!ifmgd->have_beacon) {
3136 /* a few bogus AP send dtim_period = 0 or no TIM IE */
3137 if (elems.tim)
3138 bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
3139 else
3140 bss_conf->dtim_period = 1;
3141
3142 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
3143 sdata->vif.bss_conf.sync_tsf =
3144 le64_to_cpu(mgmt->u.beacon.timestamp);
3145 sdata->vif.bss_conf.sync_device_ts =
3146 rx_status->device_timestamp;
3147 if (elems.tim)
3148 sdata->vif.bss_conf.sync_dtim_count =
3149 elems.tim->dtim_count;
3150 else
3151 sdata->vif.bss_conf.sync_dtim_count = 0;
3152 }
3153
3154 changed |= BSS_CHANGED_BEACON_INFO;
3155 ifmgd->have_beacon = true;
3156
3157 mutex_lock(&local->iflist_mtx);
3158 ieee80211_recalc_ps(local, -1);
3159 mutex_unlock(&local->iflist_mtx);
3160
3161 ieee80211_recalc_ps_vif(sdata);
3162 }
3163
3164 if (elems.erp_info) {
3165 erp_valid = true;
3166 erp_value = elems.erp_info[0];
3167 } else {
3168 erp_valid = false;
3169 }
3170 changed |= ieee80211_handle_bss_capability(sdata,
3171 le16_to_cpu(mgmt->u.beacon.capab_info),
3172 erp_valid, erp_value);
3173
3174 mutex_lock(&local->sta_mtx);
3175 sta = sta_info_get(sdata, bssid);
3176
3177 if (ieee80211_config_bw(sdata, sta, elems.ht_operation,
3178 elems.vht_operation, bssid, &changed)) {
3179 mutex_unlock(&local->sta_mtx);
3180 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3181 WLAN_REASON_DEAUTH_LEAVING,
3182 true, deauth_buf);
3183 cfg80211_tx_mlme_mgmt(sdata->dev, deauth_buf,
3184 sizeof(deauth_buf));
3185 return;
3186 }
3187
3188 if (sta && elems.opmode_notif)
3189 ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
3190 rx_status->band, true);
3191 mutex_unlock(&local->sta_mtx);
3192
3193 if (elems.country_elem && elems.pwr_constr_elem &&
3194 mgmt->u.probe_resp.capab_info &
3195 cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
3196 changed |= ieee80211_handle_pwr_constr(sdata, chan,
3197 elems.country_elem,
3198 elems.country_elem_len,
3199 elems.pwr_constr_elem);
3200
3201 ieee80211_bss_info_change_notify(sdata, changed);
3202 }
3203
3204 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
3205 struct sk_buff *skb)
3206 {
3207 struct ieee80211_rx_status *rx_status;
3208 struct ieee80211_mgmt *mgmt;
3209 u16 fc;
3210 struct ieee802_11_elems elems;
3211 int ies_len;
3212
3213 rx_status = (struct ieee80211_rx_status *) skb->cb;
3214 mgmt = (struct ieee80211_mgmt *) skb->data;
3215 fc = le16_to_cpu(mgmt->frame_control);
3216
3217 sdata_lock(sdata);
3218
3219 switch (fc & IEEE80211_FCTL_STYPE) {
3220 case IEEE80211_STYPE_BEACON:
3221 ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
3222 break;
3223 case IEEE80211_STYPE_PROBE_RESP:
3224 ieee80211_rx_mgmt_probe_resp(sdata, skb);
3225 break;
3226 case IEEE80211_STYPE_AUTH:
3227 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
3228 break;
3229 case IEEE80211_STYPE_DEAUTH:
3230 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
3231 break;
3232 case IEEE80211_STYPE_DISASSOC:
3233 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
3234 break;
3235 case IEEE80211_STYPE_ASSOC_RESP:
3236 case IEEE80211_STYPE_REASSOC_RESP:
3237 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
3238 break;
3239 case IEEE80211_STYPE_ACTION:
3240 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3241 ies_len = skb->len -
3242 offsetof(struct ieee80211_mgmt,
3243 u.action.u.chan_switch.variable);
3244
3245 if (ies_len < 0)
3246 break;
3247
3248 ieee802_11_parse_elems(
3249 mgmt->u.action.u.chan_switch.variable,
3250 ies_len, true, &elems);
3251
3252 if (elems.parse_error)
3253 break;
3254
3255 ieee80211_sta_process_chanswitch(sdata,
3256 rx_status->mactime,
3257 &elems, false);
3258 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
3259 ies_len = skb->len -
3260 offsetof(struct ieee80211_mgmt,
3261 u.action.u.ext_chan_switch.variable);
3262
3263 if (ies_len < 0)
3264 break;
3265
3266 ieee802_11_parse_elems(
3267 mgmt->u.action.u.ext_chan_switch.variable,
3268 ies_len, true, &elems);
3269
3270 if (elems.parse_error)
3271 break;
3272
3273 /* for the handling code pretend this was also an IE */
3274 elems.ext_chansw_ie =
3275 &mgmt->u.action.u.ext_chan_switch.data;
3276
3277 ieee80211_sta_process_chanswitch(sdata,
3278 rx_status->mactime,
3279 &elems, false);
3280 }
3281 break;
3282 }
3283 sdata_unlock(sdata);
3284 }
3285
3286 static void ieee80211_sta_timer(unsigned long data)
3287 {
3288 struct ieee80211_sub_if_data *sdata =
3289 (struct ieee80211_sub_if_data *) data;
3290
3291 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3292 }
3293
3294 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3295 u8 *bssid, u8 reason, bool tx)
3296 {
3297 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3298
3299 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3300 tx, frame_buf);
3301
3302 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
3303 IEEE80211_DEAUTH_FRAME_LEN);
3304 }
3305
3306 static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
3307 {
3308 struct ieee80211_local *local = sdata->local;
3309 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3310 struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3311 u32 tx_flags = 0;
3312
3313 sdata_assert_lock(sdata);
3314
3315 if (WARN_ON_ONCE(!auth_data))
3316 return -EINVAL;
3317
3318 auth_data->tries++;
3319
3320 if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
3321 sdata_info(sdata, "authentication with %pM timed out\n",
3322 auth_data->bss->bssid);
3323
3324 /*
3325 * Most likely AP is not in the range so remove the
3326 * bss struct for that AP.
3327 */
3328 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
3329
3330 return -ETIMEDOUT;
3331 }
3332
3333 drv_mgd_prepare_tx(local, sdata);
3334
3335 if (auth_data->bss->proberesp_ies) {
3336 u16 trans = 1;
3337 u16 status = 0;
3338
3339 sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
3340 auth_data->bss->bssid, auth_data->tries,
3341 IEEE80211_AUTH_MAX_TRIES);
3342
3343 auth_data->expected_transaction = 2;
3344
3345 if (auth_data->algorithm == WLAN_AUTH_SAE) {
3346 trans = auth_data->sae_trans;
3347 status = auth_data->sae_status;
3348 auth_data->expected_transaction = trans;
3349 }
3350
3351 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3352 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3353 IEEE80211_TX_INTFL_MLME_CONN_TX;
3354
3355 ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
3356 auth_data->data, auth_data->data_len,
3357 auth_data->bss->bssid,
3358 auth_data->bss->bssid, NULL, 0, 0,
3359 tx_flags);
3360 } else {
3361 const u8 *ssidie;
3362
3363 sdata_info(sdata, "direct probe to %pM (try %d/%i)\n",
3364 auth_data->bss->bssid, auth_data->tries,
3365 IEEE80211_AUTH_MAX_TRIES);
3366
3367 rcu_read_lock();
3368 ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
3369 if (!ssidie) {
3370 rcu_read_unlock();
3371 return -EINVAL;
3372 }
3373 /*
3374 * Direct probe is sent to broadcast address as some APs
3375 * will not answer to direct packet in unassociated state.
3376 */
3377 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
3378 NULL, 0, (u32) -1, true, 0,
3379 auth_data->bss->channel, false);
3380 rcu_read_unlock();
3381 }
3382
3383 if (tx_flags == 0) {
3384 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3385 auth_data->timeout_started = true;
3386 run_again(sdata, auth_data->timeout);
3387 } else {
3388 auth_data->timeout =
3389 round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
3390 auth_data->timeout_started = true;
3391 run_again(sdata, auth_data->timeout);
3392 }
3393
3394 return 0;
3395 }
3396
3397 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
3398 {
3399 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3400 struct ieee80211_local *local = sdata->local;
3401
3402 sdata_assert_lock(sdata);
3403
3404 assoc_data->tries++;
3405 if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
3406 sdata_info(sdata, "association with %pM timed out\n",
3407 assoc_data->bss->bssid);
3408
3409 /*
3410 * Most likely AP is not in the range so remove the
3411 * bss struct for that AP.
3412 */
3413 cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);
3414
3415 return -ETIMEDOUT;
3416 }
3417
3418 sdata_info(sdata, "associate with %pM (try %d/%d)\n",
3419 assoc_data->bss->bssid, assoc_data->tries,
3420 IEEE80211_ASSOC_MAX_TRIES);
3421 ieee80211_send_assoc(sdata);
3422
3423 if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
3424 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3425 assoc_data->timeout_started = true;
3426 run_again(sdata, assoc_data->timeout);
3427 } else {
3428 assoc_data->timeout =
3429 round_jiffies_up(jiffies +
3430 IEEE80211_ASSOC_TIMEOUT_LONG);
3431 assoc_data->timeout_started = true;
3432 run_again(sdata, assoc_data->timeout);
3433 }
3434
3435 return 0;
3436 }
3437
3438 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
3439 __le16 fc, bool acked)
3440 {
3441 struct ieee80211_local *local = sdata->local;
3442
3443 sdata->u.mgd.status_fc = fc;
3444 sdata->u.mgd.status_acked = acked;
3445 sdata->u.mgd.status_received = true;
3446
3447 ieee80211_queue_work(&local->hw, &sdata->work);
3448 }
3449
3450 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
3451 {
3452 struct ieee80211_local *local = sdata->local;
3453 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3454
3455 sdata_lock(sdata);
3456
3457 if (ifmgd->status_received) {
3458 __le16 fc = ifmgd->status_fc;
3459 bool status_acked = ifmgd->status_acked;
3460
3461 ifmgd->status_received = false;
3462 if (ifmgd->auth_data &&
3463 (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
3464 if (status_acked) {
3465 ifmgd->auth_data->timeout =
3466 jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3467 run_again(sdata, ifmgd->auth_data->timeout);
3468 } else {
3469 ifmgd->auth_data->timeout = jiffies - 1;
3470 }
3471 ifmgd->auth_data->timeout_started = true;
3472 } else if (ifmgd->assoc_data &&
3473 (ieee80211_is_assoc_req(fc) ||
3474 ieee80211_is_reassoc_req(fc))) {
3475 if (status_acked) {
3476 ifmgd->assoc_data->timeout =
3477 jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3478 run_again(sdata, ifmgd->assoc_data->timeout);
3479 } else {
3480 ifmgd->assoc_data->timeout = jiffies - 1;
3481 }
3482 ifmgd->assoc_data->timeout_started = true;
3483 }
3484 }
3485
3486 if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
3487 time_after(jiffies, ifmgd->auth_data->timeout)) {
3488 if (ifmgd->auth_data->done) {
3489 /*
3490 * ok ... we waited for assoc but userspace didn't,
3491 * so let's just kill the auth data
3492 */
3493 ieee80211_destroy_auth_data(sdata, false);
3494 } else if (ieee80211_probe_auth(sdata)) {
3495 u8 bssid[ETH_ALEN];
3496
3497 memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
3498
3499 ieee80211_destroy_auth_data(sdata, false);
3500
3501 cfg80211_auth_timeout(sdata->dev, bssid);
3502 }
3503 } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3504 run_again(sdata, ifmgd->auth_data->timeout);
3505
3506 if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
3507 time_after(jiffies, ifmgd->assoc_data->timeout)) {
3508 if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
3509 ieee80211_do_assoc(sdata)) {
3510 struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
3511
3512 ieee80211_destroy_assoc_data(sdata, false);
3513 cfg80211_assoc_timeout(sdata->dev, bss);
3514 }
3515 } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3516 run_again(sdata, ifmgd->assoc_data->timeout);
3517
3518 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
3519 ifmgd->associated) {
3520 u8 bssid[ETH_ALEN];
3521 int max_tries;
3522
3523 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3524
3525 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3526 max_tries = max_nullfunc_tries;
3527 else
3528 max_tries = max_probe_tries;
3529
3530 /* ACK received for nullfunc probing frame */
3531 if (!ifmgd->probe_send_count)
3532 ieee80211_reset_ap_probe(sdata);
3533 else if (ifmgd->nullfunc_failed) {
3534 if (ifmgd->probe_send_count < max_tries) {
3535 mlme_dbg(sdata,
3536 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
3537 bssid, ifmgd->probe_send_count,
3538 max_tries);
3539 ieee80211_mgd_probe_ap_send(sdata);
3540 } else {
3541 mlme_dbg(sdata,
3542 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
3543 bssid);
3544 ieee80211_sta_connection_lost(sdata, bssid,
3545 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3546 false);
3547 }
3548 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
3549 run_again(sdata, ifmgd->probe_timeout);
3550 else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
3551 mlme_dbg(sdata,
3552 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
3553 bssid, probe_wait_ms);
3554 ieee80211_sta_connection_lost(sdata, bssid,
3555 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3556 } else if (ifmgd->probe_send_count < max_tries) {
3557 mlme_dbg(sdata,
3558 "No probe response from AP %pM after %dms, try %d/%i\n",
3559 bssid, probe_wait_ms,
3560 ifmgd->probe_send_count, max_tries);
3561 ieee80211_mgd_probe_ap_send(sdata);
3562 } else {
3563 /*
3564 * We actually lost the connection ... or did we?
3565 * Let's make sure!
3566 */
3567 wiphy_debug(local->hw.wiphy,
3568 "%s: No probe response from AP %pM"
3569 " after %dms, disconnecting.\n",
3570 sdata->name,
3571 bssid, probe_wait_ms);
3572
3573 ieee80211_sta_connection_lost(sdata, bssid,
3574 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3575 }
3576 }
3577
3578 sdata_unlock(sdata);
3579 }
3580
3581 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
3582 {
3583 struct ieee80211_sub_if_data *sdata =
3584 (struct ieee80211_sub_if_data *) data;
3585 struct ieee80211_local *local = sdata->local;
3586
3587 if (local->quiescing)
3588 return;
3589
3590 if (sdata->vif.csa_active)
3591 return;
3592
3593 sdata->u.mgd.connection_loss = false;
3594 ieee80211_queue_work(&sdata->local->hw,
3595 &sdata->u.mgd.beacon_connection_loss_work);
3596 }
3597
3598 static void ieee80211_sta_conn_mon_timer(unsigned long data)
3599 {
3600 struct ieee80211_sub_if_data *sdata =
3601 (struct ieee80211_sub_if_data *) data;
3602 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3603 struct ieee80211_local *local = sdata->local;
3604
3605 if (local->quiescing)
3606 return;
3607
3608 if (sdata->vif.csa_active)
3609 return;
3610
3611 ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
3612 }
3613
3614 static void ieee80211_sta_monitor_work(struct work_struct *work)
3615 {
3616 struct ieee80211_sub_if_data *sdata =
3617 container_of(work, struct ieee80211_sub_if_data,
3618 u.mgd.monitor_work);
3619
3620 ieee80211_mgd_probe_ap(sdata, false);
3621 }
3622
3623 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
3624 {
3625 u32 flags;
3626
3627 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3628 __ieee80211_stop_poll(sdata);
3629
3630 /* let's probe the connection once */
3631 flags = sdata->local->hw.flags;
3632 if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
3633 ieee80211_queue_work(&sdata->local->hw,
3634 &sdata->u.mgd.monitor_work);
3635 /* and do all the other regular work too */
3636 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3637 }
3638 }
3639
3640 #ifdef CONFIG_PM
3641 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
3642 {
3643 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3644 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3645
3646 sdata_lock(sdata);
3647
3648 if (ifmgd->auth_data || ifmgd->assoc_data) {
3649 const u8 *bssid = ifmgd->auth_data ?
3650 ifmgd->auth_data->bss->bssid :
3651 ifmgd->assoc_data->bss->bssid;
3652
3653 /*
3654 * If we are trying to authenticate / associate while suspending,
3655 * cfg80211 won't know and won't actually abort those attempts,
3656 * thus we need to do that ourselves.
3657 */
3658 ieee80211_send_deauth_disassoc(sdata, bssid,
3659 IEEE80211_STYPE_DEAUTH,
3660 WLAN_REASON_DEAUTH_LEAVING,
3661 false, frame_buf);
3662 if (ifmgd->assoc_data)
3663 ieee80211_destroy_assoc_data(sdata, false);
3664 if (ifmgd->auth_data)
3665 ieee80211_destroy_auth_data(sdata, false);
3666 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
3667 IEEE80211_DEAUTH_FRAME_LEN);
3668 }
3669
3670 sdata_unlock(sdata);
3671 }
3672
3673 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
3674 {
3675 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3676
3677 sdata_lock(sdata);
3678 if (!ifmgd->associated) {
3679 sdata_unlock(sdata);
3680 return;
3681 }
3682
3683 if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
3684 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
3685 mlme_dbg(sdata, "driver requested disconnect after resume\n");
3686 ieee80211_sta_connection_lost(sdata,
3687 ifmgd->associated->bssid,
3688 WLAN_REASON_UNSPECIFIED,
3689 true);
3690 sdata_unlock(sdata);
3691 return;
3692 }
3693 sdata_unlock(sdata);
3694 }
3695 #endif
3696
3697 /* interface setup */
3698 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
3699 {
3700 struct ieee80211_if_managed *ifmgd;
3701
3702 ifmgd = &sdata->u.mgd;
3703 INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
3704 INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
3705 INIT_WORK(&ifmgd->beacon_connection_loss_work,
3706 ieee80211_beacon_connection_loss_work);
3707 INIT_WORK(&ifmgd->csa_connection_drop_work,
3708 ieee80211_csa_connection_drop_work);
3709 INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
3710 INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
3711 ieee80211_tdls_peer_del_work);
3712 setup_timer(&ifmgd->timer, ieee80211_sta_timer,
3713 (unsigned long) sdata);
3714 setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
3715 (unsigned long) sdata);
3716 setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
3717 (unsigned long) sdata);
3718 setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
3719 (unsigned long) sdata);
3720
3721 ifmgd->flags = 0;
3722 ifmgd->powersave = sdata->wdev.ps;
3723 ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
3724 ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
3725 ifmgd->p2p_noa_index = -1;
3726
3727 if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
3728 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
3729 else
3730 ifmgd->req_smps = IEEE80211_SMPS_OFF;
3731 }
3732
3733 /* scan finished notification */
3734 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3735 {
3736 struct ieee80211_sub_if_data *sdata;
3737
3738 /* Restart STA timers */
3739 rcu_read_lock();
3740 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3741 if (ieee80211_sdata_running(sdata))
3742 ieee80211_restart_sta_timer(sdata);
3743 }
3744 rcu_read_unlock();
3745 }
3746
3747 int ieee80211_max_network_latency(struct notifier_block *nb,
3748 unsigned long data, void *dummy)
3749 {
3750 s32 latency_usec = (s32) data;
3751 struct ieee80211_local *local =
3752 container_of(nb, struct ieee80211_local,
3753 network_latency_notifier);
3754
3755 mutex_lock(&local->iflist_mtx);
3756 ieee80211_recalc_ps(local, latency_usec);
3757 mutex_unlock(&local->iflist_mtx);
3758
3759 return NOTIFY_OK;
3760 }
3761
3762 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
3763 struct cfg80211_bss *cbss)
3764 {
3765 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3766 const u8 *ht_cap_ie, *vht_cap_ie;
3767 const struct ieee80211_ht_cap *ht_cap;
3768 const struct ieee80211_vht_cap *vht_cap;
3769 u8 chains = 1;
3770
3771 if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
3772 return chains;
3773
3774 ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3775 if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
3776 ht_cap = (void *)(ht_cap_ie + 2);
3777 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
3778 /*
3779 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
3780 * "Tx Unequal Modulation Supported" fields.
3781 */
3782 }
3783
3784 if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
3785 return chains;
3786
3787 vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3788 if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
3789 u8 nss;
3790 u16 tx_mcs_map;
3791
3792 vht_cap = (void *)(vht_cap_ie + 2);
3793 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
3794 for (nss = 8; nss > 0; nss--) {
3795 if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
3796 IEEE80211_VHT_MCS_NOT_SUPPORTED)
3797 break;
3798 }
3799 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
3800 chains = max(chains, nss);
3801 }
3802
3803 return chains;
3804 }
3805
3806 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
3807 struct cfg80211_bss *cbss)
3808 {
3809 struct ieee80211_local *local = sdata->local;
3810 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3811 const struct ieee80211_ht_operation *ht_oper = NULL;
3812 const struct ieee80211_vht_operation *vht_oper = NULL;
3813 struct ieee80211_supported_band *sband;
3814 struct cfg80211_chan_def chandef;
3815 int ret;
3816
3817 sband = local->hw.wiphy->bands[cbss->channel->band];
3818
3819 ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
3820 IEEE80211_STA_DISABLE_80P80MHZ |
3821 IEEE80211_STA_DISABLE_160MHZ);
3822
3823 rcu_read_lock();
3824
3825 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3826 sband->ht_cap.ht_supported) {
3827 const u8 *ht_oper_ie, *ht_cap;
3828
3829 ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
3830 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
3831 ht_oper = (void *)(ht_oper_ie + 2);
3832
3833 ht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3834 if (!ht_cap || ht_cap[1] < sizeof(struct ieee80211_ht_cap)) {
3835 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3836 ht_oper = NULL;
3837 }
3838 }
3839
3840 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3841 sband->vht_cap.vht_supported) {
3842 const u8 *vht_oper_ie, *vht_cap;
3843
3844 vht_oper_ie = ieee80211_bss_get_ie(cbss,
3845 WLAN_EID_VHT_OPERATION);
3846 if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
3847 vht_oper = (void *)(vht_oper_ie + 2);
3848 if (vht_oper && !ht_oper) {
3849 vht_oper = NULL;
3850 sdata_info(sdata,
3851 "AP advertised VHT without HT, disabling both\n");
3852 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3853 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3854 }
3855
3856 vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3857 if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
3858 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3859 vht_oper = NULL;
3860 }
3861 }
3862
3863 ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
3864 cbss->channel,
3865 ht_oper, vht_oper,
3866 &chandef, false);
3867
3868 sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
3869 local->rx_chains);
3870
3871 rcu_read_unlock();
3872
3873 /* will change later if needed */
3874 sdata->smps_mode = IEEE80211_SMPS_OFF;
3875
3876 mutex_lock(&local->mtx);
3877 /*
3878 * If this fails (possibly due to channel context sharing
3879 * on incompatible channels, e.g. 80+80 and 160 sharing the
3880 * same control channel) try to use a smaller bandwidth.
3881 */
3882 ret = ieee80211_vif_use_channel(sdata, &chandef,
3883 IEEE80211_CHANCTX_SHARED);
3884
3885 /* don't downgrade for 5 and 10 MHz channels, though. */
3886 if (chandef.width == NL80211_CHAN_WIDTH_5 ||
3887 chandef.width == NL80211_CHAN_WIDTH_10)
3888 goto out;
3889
3890 while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
3891 ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
3892 ret = ieee80211_vif_use_channel(sdata, &chandef,
3893 IEEE80211_CHANCTX_SHARED);
3894 }
3895 out:
3896 mutex_unlock(&local->mtx);
3897 return ret;
3898 }
3899
3900 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
3901 struct cfg80211_bss *cbss, bool assoc)
3902 {
3903 struct ieee80211_local *local = sdata->local;
3904 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3905 struct ieee80211_bss *bss = (void *)cbss->priv;
3906 struct sta_info *new_sta = NULL;
3907 bool have_sta = false;
3908 int err;
3909
3910 if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
3911 return -EINVAL;
3912
3913 if (assoc) {
3914 rcu_read_lock();
3915 have_sta = sta_info_get(sdata, cbss->bssid);
3916 rcu_read_unlock();
3917 }
3918
3919 if (!have_sta) {
3920 new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
3921 if (!new_sta)
3922 return -ENOMEM;
3923 }
3924 if (new_sta) {
3925 u32 rates = 0, basic_rates = 0;
3926 bool have_higher_than_11mbit;
3927 int min_rate = INT_MAX, min_rate_index = -1;
3928 struct ieee80211_chanctx_conf *chanctx_conf;
3929 struct ieee80211_supported_band *sband;
3930 const struct cfg80211_bss_ies *ies;
3931 int shift;
3932 u32 rate_flags;
3933
3934 sband = local->hw.wiphy->bands[cbss->channel->band];
3935
3936 err = ieee80211_prep_channel(sdata, cbss);
3937 if (err) {
3938 sta_info_free(local, new_sta);
3939 return -EINVAL;
3940 }
3941 shift = ieee80211_vif_get_shift(&sdata->vif);
3942
3943 rcu_read_lock();
3944 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3945 if (WARN_ON(!chanctx_conf)) {
3946 rcu_read_unlock();
3947 sta_info_free(local, new_sta);
3948 return -EINVAL;
3949 }
3950 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
3951 rcu_read_unlock();
3952
3953 ieee80211_get_rates(sband, bss->supp_rates,
3954 bss->supp_rates_len,
3955 &rates, &basic_rates,
3956 &have_higher_than_11mbit,
3957 &min_rate, &min_rate_index,
3958 shift, rate_flags);
3959
3960 /*
3961 * This used to be a workaround for basic rates missing
3962 * in the association response frame. Now that we no
3963 * longer use the basic rates from there, it probably
3964 * doesn't happen any more, but keep the workaround so
3965 * in case some *other* APs are buggy in different ways
3966 * we can connect -- with a warning.
3967 */
3968 if (!basic_rates && min_rate_index >= 0) {
3969 sdata_info(sdata,
3970 "No basic rates, using min rate instead\n");
3971 basic_rates = BIT(min_rate_index);
3972 }
3973
3974 new_sta->sta.supp_rates[cbss->channel->band] = rates;
3975 sdata->vif.bss_conf.basic_rates = basic_rates;
3976
3977 /* cf. IEEE 802.11 9.2.12 */
3978 if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
3979 have_higher_than_11mbit)
3980 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
3981 else
3982 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
3983
3984 memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
3985
3986 /* set timing information */
3987 sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
3988 rcu_read_lock();
3989 ies = rcu_dereference(cbss->beacon_ies);
3990 if (ies) {
3991 const u8 *tim_ie;
3992
3993 sdata->vif.bss_conf.sync_tsf = ies->tsf;
3994 sdata->vif.bss_conf.sync_device_ts =
3995 bss->device_ts_beacon;
3996 tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
3997 ies->data, ies->len);
3998 if (tim_ie && tim_ie[1] >= 2)
3999 sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
4000 else
4001 sdata->vif.bss_conf.sync_dtim_count = 0;
4002 } else if (!(local->hw.flags &
4003 IEEE80211_HW_TIMING_BEACON_ONLY)) {
4004 ies = rcu_dereference(cbss->proberesp_ies);
4005 /* must be non-NULL since beacon IEs were NULL */
4006 sdata->vif.bss_conf.sync_tsf = ies->tsf;
4007 sdata->vif.bss_conf.sync_device_ts =
4008 bss->device_ts_presp;
4009 sdata->vif.bss_conf.sync_dtim_count = 0;
4010 } else {
4011 sdata->vif.bss_conf.sync_tsf = 0;
4012 sdata->vif.bss_conf.sync_device_ts = 0;
4013 sdata->vif.bss_conf.sync_dtim_count = 0;
4014 }
4015 rcu_read_unlock();
4016
4017 /* tell driver about BSSID, basic rates and timing */
4018 ieee80211_bss_info_change_notify(sdata,
4019 BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
4020 BSS_CHANGED_BEACON_INT);
4021
4022 if (assoc)
4023 sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
4024
4025 err = sta_info_insert(new_sta);
4026 new_sta = NULL;
4027 if (err) {
4028 sdata_info(sdata,
4029 "failed to insert STA entry for the AP (error %d)\n",
4030 err);
4031 return err;
4032 }
4033 } else
4034 WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4035
4036 return 0;
4037 }
4038
4039 /* config hooks */
4040 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
4041 struct cfg80211_auth_request *req)
4042 {
4043 struct ieee80211_local *local = sdata->local;
4044 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4045 struct ieee80211_mgd_auth_data *auth_data;
4046 u16 auth_alg;
4047 int err;
4048
4049 /* prepare auth data structure */
4050
4051 switch (req->auth_type) {
4052 case NL80211_AUTHTYPE_OPEN_SYSTEM:
4053 auth_alg = WLAN_AUTH_OPEN;
4054 break;
4055 case NL80211_AUTHTYPE_SHARED_KEY:
4056 if (IS_ERR(local->wep_tx_tfm))
4057 return -EOPNOTSUPP;
4058 auth_alg = WLAN_AUTH_SHARED_KEY;
4059 break;
4060 case NL80211_AUTHTYPE_FT:
4061 auth_alg = WLAN_AUTH_FT;
4062 break;
4063 case NL80211_AUTHTYPE_NETWORK_EAP:
4064 auth_alg = WLAN_AUTH_LEAP;
4065 break;
4066 case NL80211_AUTHTYPE_SAE:
4067 auth_alg = WLAN_AUTH_SAE;
4068 break;
4069 default:
4070 return -EOPNOTSUPP;
4071 }
4072
4073 auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
4074 req->ie_len, GFP_KERNEL);
4075 if (!auth_data)
4076 return -ENOMEM;
4077
4078 auth_data->bss = req->bss;
4079
4080 if (req->sae_data_len >= 4) {
4081 __le16 *pos = (__le16 *) req->sae_data;
4082 auth_data->sae_trans = le16_to_cpu(pos[0]);
4083 auth_data->sae_status = le16_to_cpu(pos[1]);
4084 memcpy(auth_data->data, req->sae_data + 4,
4085 req->sae_data_len - 4);
4086 auth_data->data_len += req->sae_data_len - 4;
4087 }
4088
4089 if (req->ie && req->ie_len) {
4090 memcpy(&auth_data->data[auth_data->data_len],
4091 req->ie, req->ie_len);
4092 auth_data->data_len += req->ie_len;
4093 }
4094
4095 if (req->key && req->key_len) {
4096 auth_data->key_len = req->key_len;
4097 auth_data->key_idx = req->key_idx;
4098 memcpy(auth_data->key, req->key, req->key_len);
4099 }
4100
4101 auth_data->algorithm = auth_alg;
4102
4103 /* try to authenticate/probe */
4104
4105 if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
4106 ifmgd->assoc_data) {
4107 err = -EBUSY;
4108 goto err_free;
4109 }
4110
4111 if (ifmgd->auth_data)
4112 ieee80211_destroy_auth_data(sdata, false);
4113
4114 /* prep auth_data so we don't go into idle on disassoc */
4115 ifmgd->auth_data = auth_data;
4116
4117 if (ifmgd->associated) {
4118 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4119
4120 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4121 WLAN_REASON_UNSPECIFIED,
4122 false, frame_buf);
4123
4124 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4125 sizeof(frame_buf));
4126 }
4127
4128 sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4129
4130 err = ieee80211_prep_connection(sdata, req->bss, false);
4131 if (err)
4132 goto err_clear;
4133
4134 err = ieee80211_probe_auth(sdata);
4135 if (err) {
4136 sta_info_destroy_addr(sdata, req->bss->bssid);
4137 goto err_clear;
4138 }
4139
4140 /* hold our own reference */
4141 cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4142 return 0;
4143
4144 err_clear:
4145 memset(ifmgd->bssid, 0, ETH_ALEN);
4146 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4147 ifmgd->auth_data = NULL;
4148 err_free:
4149 kfree(auth_data);
4150 return err;
4151 }
4152
4153 static bool ieee80211_usable_wmm_params(struct ieee80211_sub_if_data *sdata,
4154 const u8 *wmm_param, int len)
4155 {
4156 const u8 *pos;
4157 size_t left;
4158
4159 if (len < 8)
4160 return false;
4161
4162 if (wmm_param[5] != 1 /* version */)
4163 return false;
4164
4165 pos = wmm_param + 8;
4166 left = len - 8;
4167
4168 for (; left >= 4; left -= 4, pos += 4) {
4169 u8 aifsn = pos[0] & 0x0f;
4170 u8 ecwmin = pos[1] & 0x0f;
4171 u8 ecwmax = (pos[1] & 0xf0) >> 4;
4172 int aci = (pos[0] >> 5) & 0x03;
4173
4174 if (aifsn < 2) {
4175 sdata_info(sdata,
4176 "AP has invalid WMM params (AIFSN=%d for ACI %d), disabling WMM\n",
4177 aifsn, aci);
4178 return false;
4179 }
4180 if (ecwmin > ecwmax) {
4181 sdata_info(sdata,
4182 "AP has invalid WMM params (ECWmin/max=%d/%d for ACI %d), disabling WMM\n",
4183 ecwmin, ecwmax, aci);
4184 return false;
4185 }
4186 }
4187
4188 return true;
4189 }
4190
4191 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
4192 struct cfg80211_assoc_request *req)
4193 {
4194 struct ieee80211_local *local = sdata->local;
4195 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4196 struct ieee80211_bss *bss = (void *)req->bss->priv;
4197 struct ieee80211_mgd_assoc_data *assoc_data;
4198 const struct cfg80211_bss_ies *beacon_ies;
4199 struct ieee80211_supported_band *sband;
4200 const u8 *ssidie, *ht_ie, *vht_ie;
4201 int i, err;
4202
4203 assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
4204 if (!assoc_data)
4205 return -ENOMEM;
4206
4207 rcu_read_lock();
4208 ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
4209 if (!ssidie) {
4210 rcu_read_unlock();
4211 kfree(assoc_data);
4212 return -EINVAL;
4213 }
4214 memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
4215 assoc_data->ssid_len = ssidie[1];
4216 rcu_read_unlock();
4217
4218 if (ifmgd->associated) {
4219 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4220
4221 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4222 WLAN_REASON_UNSPECIFIED,
4223 false, frame_buf);
4224
4225 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4226 sizeof(frame_buf));
4227 }
4228
4229 if (ifmgd->auth_data && !ifmgd->auth_data->done) {
4230 err = -EBUSY;
4231 goto err_free;
4232 }
4233
4234 if (ifmgd->assoc_data) {
4235 err = -EBUSY;
4236 goto err_free;
4237 }
4238
4239 if (ifmgd->auth_data) {
4240 bool match;
4241
4242 /* keep sta info, bssid if matching */
4243 match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
4244 ieee80211_destroy_auth_data(sdata, match);
4245 }
4246
4247 /* prepare assoc data */
4248
4249 ifmgd->beacon_crc_valid = false;
4250
4251 assoc_data->wmm = bss->wmm_used &&
4252 (local->hw.queues >= IEEE80211_NUM_ACS);
4253 if (assoc_data->wmm) {
4254 /* try to check validity of WMM params IE */
4255 const struct cfg80211_bss_ies *ies;
4256 const u8 *wp, *start, *end;
4257
4258 rcu_read_lock();
4259 ies = rcu_dereference(req->bss->ies);
4260 start = ies->data;
4261 end = start + ies->len;
4262
4263 while (true) {
4264 wp = cfg80211_find_vendor_ie(
4265 WLAN_OUI_MICROSOFT,
4266 WLAN_OUI_TYPE_MICROSOFT_WMM,
4267 start, end - start);
4268 if (!wp)
4269 break;
4270 start = wp + wp[1] + 2;
4271 /* if this IE is too short, try the next */
4272 if (wp[1] <= 4)
4273 continue;
4274 /* if this IE is WMM params, we found what we wanted */
4275 if (wp[6] == 1)
4276 break;
4277 }
4278
4279 if (!wp || !ieee80211_usable_wmm_params(sdata, wp + 2,
4280 wp[1] - 2)) {
4281 assoc_data->wmm = false;
4282 ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
4283 }
4284 rcu_read_unlock();
4285 }
4286
4287 /*
4288 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
4289 * We still associate in non-HT mode (11a/b/g) if any one of these
4290 * ciphers is configured as pairwise.
4291 * We can set this to true for non-11n hardware, that'll be checked
4292 * separately along with the peer capabilities.
4293 */
4294 for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4295 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
4296 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4297 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4298 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4299 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4300 netdev_info(sdata->dev,
4301 "disabling HT/VHT due to WEP/TKIP use\n");
4302 }
4303 }
4304
4305 if (req->flags & ASSOC_REQ_DISABLE_HT) {
4306 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4307 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4308 }
4309
4310 if (req->flags & ASSOC_REQ_DISABLE_VHT)
4311 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4312
4313 /* Also disable HT if we don't support it or the AP doesn't use WMM */
4314 sband = local->hw.wiphy->bands[req->bss->channel->band];
4315 if (!sband->ht_cap.ht_supported ||
4316 local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
4317 ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4318 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4319 if (!bss->wmm_used &&
4320 !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4321 netdev_info(sdata->dev,
4322 "disabling HT as WMM/QoS is not supported by the AP\n");
4323 }
4324
4325 /* disable VHT if we don't support it or the AP doesn't use WMM */
4326 if (!sband->vht_cap.vht_supported ||
4327 local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
4328 ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4329 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4330 if (!bss->wmm_used &&
4331 !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4332 netdev_info(sdata->dev,
4333 "disabling VHT as WMM/QoS is not supported by the AP\n");
4334 }
4335
4336 memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
4337 memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
4338 sizeof(ifmgd->ht_capa_mask));
4339
4340 memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
4341 memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
4342 sizeof(ifmgd->vht_capa_mask));
4343
4344 if (req->ie && req->ie_len) {
4345 memcpy(assoc_data->ie, req->ie, req->ie_len);
4346 assoc_data->ie_len = req->ie_len;
4347 }
4348
4349 assoc_data->bss = req->bss;
4350
4351 if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
4352 if (ifmgd->powersave)
4353 sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
4354 else
4355 sdata->smps_mode = IEEE80211_SMPS_OFF;
4356 } else
4357 sdata->smps_mode = ifmgd->req_smps;
4358
4359 assoc_data->capability = req->bss->capability;
4360 assoc_data->supp_rates = bss->supp_rates;
4361 assoc_data->supp_rates_len = bss->supp_rates_len;
4362
4363 rcu_read_lock();
4364 ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
4365 if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
4366 assoc_data->ap_ht_param =
4367 ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
4368 else
4369 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4370 vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
4371 if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
4372 memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
4373 sizeof(struct ieee80211_vht_cap));
4374 else
4375 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4376 rcu_read_unlock();
4377
4378 if (bss->wmm_used && bss->uapsd_supported &&
4379 (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
4380 assoc_data->uapsd = true;
4381 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
4382 } else {
4383 assoc_data->uapsd = false;
4384 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
4385 }
4386
4387 if (req->prev_bssid)
4388 memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4389
4390 if (req->use_mfp) {
4391 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
4392 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
4393 } else {
4394 ifmgd->mfp = IEEE80211_MFP_DISABLED;
4395 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
4396 }
4397
4398 if (req->crypto.control_port)
4399 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
4400 else
4401 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
4402
4403 sdata->control_port_protocol = req->crypto.control_port_ethertype;
4404 sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4405 sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
4406 sdata->vif.type);
4407
4408 /* kick off associate process */
4409
4410 ifmgd->assoc_data = assoc_data;
4411 ifmgd->dtim_period = 0;
4412 ifmgd->have_beacon = false;
4413
4414 err = ieee80211_prep_connection(sdata, req->bss, true);
4415 if (err)
4416 goto err_clear;
4417
4418 rcu_read_lock();
4419 beacon_ies = rcu_dereference(req->bss->beacon_ies);
4420
4421 if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC &&
4422 !beacon_ies) {
4423 /*
4424 * Wait up to one beacon interval ...
4425 * should this be more if we miss one?
4426 */
4427 sdata_info(sdata, "waiting for beacon from %pM\n",
4428 ifmgd->bssid);
4429 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4430 assoc_data->timeout_started = true;
4431 assoc_data->need_beacon = true;
4432 } else if (beacon_ies) {
4433 const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
4434 beacon_ies->data,
4435 beacon_ies->len);
4436 u8 dtim_count = 0;
4437
4438 if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
4439 const struct ieee80211_tim_ie *tim;
4440 tim = (void *)(tim_ie + 2);
4441 ifmgd->dtim_period = tim->dtim_period;
4442 dtim_count = tim->dtim_count;
4443 }
4444 ifmgd->have_beacon = true;
4445 assoc_data->timeout = jiffies;
4446 assoc_data->timeout_started = true;
4447
4448 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
4449 sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
4450 sdata->vif.bss_conf.sync_device_ts =
4451 bss->device_ts_beacon;
4452 sdata->vif.bss_conf.sync_dtim_count = dtim_count;
4453 }
4454 } else {
4455 assoc_data->timeout = jiffies;
4456 assoc_data->timeout_started = true;
4457 }
4458 rcu_read_unlock();
4459
4460 run_again(sdata, assoc_data->timeout);
4461
4462 if (bss->corrupt_data) {
4463 char *corrupt_type = "data";
4464 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
4465 if (bss->corrupt_data &
4466 IEEE80211_BSS_CORRUPT_PROBE_RESP)
4467 corrupt_type = "beacon and probe response";
4468 else
4469 corrupt_type = "beacon";
4470 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
4471 corrupt_type = "probe response";
4472 sdata_info(sdata, "associating with AP with corrupt %s\n",
4473 corrupt_type);
4474 }
4475
4476 return 0;
4477 err_clear:
4478 memset(ifmgd->bssid, 0, ETH_ALEN);
4479 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4480 ifmgd->assoc_data = NULL;
4481 err_free:
4482 kfree(assoc_data);
4483 return err;
4484 }
4485
4486 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4487 struct cfg80211_deauth_request *req)
4488 {
4489 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4490 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4491 bool tx = !req->local_state_change;
4492
4493 if (ifmgd->auth_data &&
4494 ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
4495 sdata_info(sdata,
4496 "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
4497 req->bssid, req->reason_code,
4498 ieee80211_get_reason_code_string(req->reason_code));
4499
4500 drv_mgd_prepare_tx(sdata->local, sdata);
4501 ieee80211_send_deauth_disassoc(sdata, req->bssid,
4502 IEEE80211_STYPE_DEAUTH,
4503 req->reason_code, tx,
4504 frame_buf);
4505 ieee80211_destroy_auth_data(sdata, false);
4506 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4507 IEEE80211_DEAUTH_FRAME_LEN);
4508
4509 return 0;
4510 }
4511
4512 if (ifmgd->associated &&
4513 ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4514 sdata_info(sdata,
4515 "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
4516 req->bssid, req->reason_code,
4517 ieee80211_get_reason_code_string(req->reason_code));
4518
4519 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4520 req->reason_code, tx, frame_buf);
4521 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4522 IEEE80211_DEAUTH_FRAME_LEN);
4523 return 0;
4524 }
4525
4526 return -ENOTCONN;
4527 }
4528
4529 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4530 struct cfg80211_disassoc_request *req)
4531 {
4532 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4533 u8 bssid[ETH_ALEN];
4534 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4535
4536 /*
4537 * cfg80211 should catch this ... but it's racy since
4538 * we can receive a disassoc frame, process it, hand it
4539 * to cfg80211 while that's in a locked section already
4540 * trying to tell us that the user wants to disconnect.
4541 */
4542 if (ifmgd->associated != req->bss)
4543 return -ENOLINK;
4544
4545 sdata_info(sdata,
4546 "disassociating from %pM by local choice (Reason: %u=%s)\n",
4547 req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
4548
4549 memcpy(bssid, req->bss->bssid, ETH_ALEN);
4550 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
4551 req->reason_code, !req->local_state_change,
4552 frame_buf);
4553
4554 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4555 IEEE80211_DEAUTH_FRAME_LEN);
4556
4557 return 0;
4558 }
4559
4560 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4561 {
4562 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4563
4564 /*
4565 * Make sure some work items will not run after this,
4566 * they will not do anything but might not have been
4567 * cancelled when disconnecting.
4568 */
4569 cancel_work_sync(&ifmgd->monitor_work);
4570 cancel_work_sync(&ifmgd->beacon_connection_loss_work);
4571 cancel_work_sync(&ifmgd->request_smps_work);
4572 cancel_work_sync(&ifmgd->csa_connection_drop_work);
4573 cancel_work_sync(&ifmgd->chswitch_work);
4574 cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
4575
4576 sdata_lock(sdata);
4577 if (ifmgd->assoc_data) {
4578 struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4579 ieee80211_destroy_assoc_data(sdata, false);
4580 cfg80211_assoc_timeout(sdata->dev, bss);
4581 }
4582 if (ifmgd->auth_data)
4583 ieee80211_destroy_auth_data(sdata, false);
4584 del_timer_sync(&ifmgd->timer);
4585 sdata_unlock(sdata);
4586 }
4587
4588 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
4589 enum nl80211_cqm_rssi_threshold_event rssi_event,
4590 gfp_t gfp)
4591 {
4592 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4593
4594 trace_api_cqm_rssi_notify(sdata, rssi_event);
4595
4596 cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
4597 }
4598 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
ubuntu-bionic-kernel mirror