net/mac80211/mlme.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  * Copyright 2013-2014  Intel Mobile Communications GmbH
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License version 2 as
  12  * published by the Free Software Foundation.
  13  */
  14
  15 #include <linux/delay.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/etherdevice.h>
  20 #include <linux/moduleparam.h>
  21 #include <linux/rtnetlink.h>
  22 #include <linux/pm_qos.h>
  23 #include <linux/crc32.h>
  24 #include <linux/slab.h>
  25 #include <linux/export.h>
  26 #include <net/mac80211.h>
  27 #include <asm/unaligned.h>
  28
  29 #include "ieee80211_i.h"
  30 #include "driver-ops.h"
  31 #include "rate.h"
  32 #include "led.h"
  33
  34 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
  35 #define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
  36 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
  37 #define IEEE80211_AUTH_TIMEOUT_SAE      (HZ * 2)
  38 #define IEEE80211_AUTH_MAX_TRIES        3
  39 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
  40 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
  41 #define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
  42 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
  43 #define IEEE80211_ASSOC_MAX_TRIES       3
  44
  45 static int max_nullfunc_tries = 2;
  46 module_param(max_nullfunc_tries, int, 0644);
  47 MODULE_PARM_DESC(max_nullfunc_tries,
  48                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
  49
  50 static int max_probe_tries = 5;
  51 module_param(max_probe_tries, int, 0644);
  52 MODULE_PARM_DESC(max_probe_tries,
  53                  "Maximum probe tries before disconnecting (reason 4).");
  54
  55 /*
  56  * Beacon loss timeout is calculated as N frames times the
  57  * advertised beacon interval.  This may need to be somewhat
  58  * higher than what hardware might detect to account for
  59  * delays in the host processing frames. But since we also
  60  * probe on beacon miss before declaring the connection lost
  61  * default to what we want.
  62  */
  63 static int beacon_loss_count = 7;
  64 module_param(beacon_loss_count, int, 0644);
  65 MODULE_PARM_DESC(beacon_loss_count,
  66                  "Number of beacon intervals before we decide beacon was lost.");
  67
  68 /*
  69  * Time the connection can be idle before we probe
  70  * it to see if we can still talk to the AP.
  71  */
  72 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
  73 /*
  74  * Time we wait for a probe response after sending
  75  * a probe request because of beacon loss or for
  76  * checking the connection still works.
  77  */
  78 static int probe_wait_ms = 500;
  79 module_param(probe_wait_ms, int, 0644);
  80 MODULE_PARM_DESC(probe_wait_ms,
  81                  "Maximum time(ms) to wait for probe response"
  82                  " before disconnecting (reason 4).");
  83
  84 /*
  85  * Weight given to the latest Beacon frame when calculating average signal
  86  * strength for Beacon frames received in the current BSS. This must be
  87  * between 1 and 15.
  88  */
  89 #define IEEE80211_SIGNAL_AVE_WEIGHT     3
  90
  91 /*
  92  * How many Beacon frames need to have been used in average signal strength
  93  * before starting to indicate signal change events.
  94  */
  95 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
  96
  97 /*
  98  * We can have multiple work items (and connection probing)
  99  * scheduling this timer, but we need to take care to only
 100  * reschedule it when it should fire _earlier_ than it was
 101  * asked for before, or if it's not pending right now. This
 102  * function ensures that. Note that it then is required to
 103  * run this function for all timeouts after the first one
 104  * has happened -- the work that runs from this timer will
 105  * do that.
 106  */
 107 static void run_again(struct ieee80211_sub_if_data *sdata,
 108                       unsigned long timeout)
 109 {
 110         sdata_assert_lock(sdata);
 111
 112         if (!timer_pending(&sdata->u.mgd.timer) ||
 113             time_before(timeout, sdata->u.mgd.timer.expires))
 114                 mod_timer(&sdata->u.mgd.timer, timeout);
 115 }
 116
 117 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 118 {
 119         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
 120                 return;
 121
 122         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
 123                 return;
 124
 125         mod_timer(&sdata->u.mgd.bcn_mon_timer,
 126                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 127 }
 128
 129 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 130 {
 131         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 132
 133         if (unlikely(!sdata->u.mgd.associated))
 134                 return;
 135
 136         ifmgd->probe_send_count = 0;
 137
 138         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
 139                 return;
 140
 141         mod_timer(&sdata->u.mgd.conn_mon_timer,
 142                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 143 }
 144
 145 static int ecw2cw(int ecw)
 146 {
 147         return (1 << ecw) - 1;
 148 }
 149
 150 static u32
 151 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 152                              struct ieee80211_supported_band *sband,
 153                              struct ieee80211_channel *channel,
 154                              const struct ieee80211_ht_cap *ht_cap,
 155                              const struct ieee80211_ht_operation *ht_oper,
 156                              const struct ieee80211_vht_operation *vht_oper,
 157                              struct cfg80211_chan_def *chandef, bool tracking)
 158 {
 159         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 160         struct cfg80211_chan_def vht_chandef;
 161         u32 ht_cfreq, ret;
 162
 163         chandef->chan = channel;
 164         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
 165         chandef->center_freq1 = channel->center_freq;
 166         chandef->center_freq2 = 0;
 167
 168         if (!ht_cap || !ht_oper || !sband->ht_cap.ht_supported) {
 169                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
 170                 goto out;
 171         }
 172
 173         chandef->width = NL80211_CHAN_WIDTH_20;
 174
 175         if (!(ht_cap->cap_info &
 176               cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
 177                 ret = IEEE80211_STA_DISABLE_40MHZ;
 178                 vht_chandef = *chandef;
 179                 goto out;
 180         }
 181
 182         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
 183                                                   channel->band);
 184         /* check that channel matches the right operating channel */
 185         if (!tracking && channel->center_freq != ht_cfreq) {
 186                 /*
 187                  * It's possible that some APs are confused here;
 188                  * Netgear WNDR3700 sometimes reports 4 higher than
 189                  * the actual channel in association responses, but
 190                  * since we look at probe response/beacon data here
 191                  * it should be OK.
 192                  */
 193                 sdata_info(sdata,
 194                            "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
 195                            channel->center_freq, ht_cfreq,
 196                            ht_oper->primary_chan, channel->band);
 197                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
 198                 goto out;
 199         }
 200
 201         /* check 40 MHz support, if we have it */
 202         if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
 203                 switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 204                 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 205                         chandef->width = NL80211_CHAN_WIDTH_40;
 206                         chandef->center_freq1 += 10;
 207                         break;
 208                 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 209                         chandef->width = NL80211_CHAN_WIDTH_40;
 210                         chandef->center_freq1 -= 10;
 211                         break;
 212                 }
 213         } else {
 214                 /* 40 MHz (and 80 MHz) must be supported for VHT */
 215                 ret = IEEE80211_STA_DISABLE_VHT;
 216                 /* also mark 40 MHz disabled */
 217                 ret |= IEEE80211_STA_DISABLE_40MHZ;
 218                 goto out;
 219         }
 220
 221         if (!vht_oper || !sband->vht_cap.vht_supported) {
 222                 ret = IEEE80211_STA_DISABLE_VHT;
 223                 goto out;
 224         }
 225
 226         vht_chandef.chan = channel;
 227         vht_chandef.center_freq1 =
 228                 ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
 229                                                channel->band);
 230         vht_chandef.center_freq2 = 0;
 231
 232         switch (vht_oper->chan_width) {
 233         case IEEE80211_VHT_CHANWIDTH_USE_HT:
 234                 vht_chandef.width = chandef->width;
 235                 vht_chandef.center_freq1 = chandef->center_freq1;
 236                 break;
 237         case IEEE80211_VHT_CHANWIDTH_80MHZ:
 238                 vht_chandef.width = NL80211_CHAN_WIDTH_80;
 239                 break;
 240         case IEEE80211_VHT_CHANWIDTH_160MHZ:
 241                 vht_chandef.width = NL80211_CHAN_WIDTH_160;
 242                 break;
 243         case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
 244                 vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
 245                 vht_chandef.center_freq2 =
 246                         ieee80211_channel_to_frequency(
 247                                 vht_oper->center_freq_seg2_idx,
 248                                 channel->band);
 249                 break;
 250         default:
 251                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 252                         sdata_info(sdata,
 253                                    "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
 254                                    vht_oper->chan_width);
 255                 ret = IEEE80211_STA_DISABLE_VHT;
 256                 goto out;
 257         }
 258
 259         if (!cfg80211_chandef_valid(&vht_chandef)) {
 260                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 261                         sdata_info(sdata,
 262                                    "AP VHT information is invalid, disable VHT\n");
 263                 ret = IEEE80211_STA_DISABLE_VHT;
 264                 goto out;
 265         }
 266
 267         if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
 268                 ret = 0;
 269                 goto out;
 270         }
 271
 272         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
 273                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 274                         sdata_info(sdata,
 275                                    "AP VHT information doesn't match HT, disable VHT\n");
 276                 ret = IEEE80211_STA_DISABLE_VHT;
 277                 goto out;
 278         }
 279
 280         *chandef = vht_chandef;
 281
 282         ret = 0;
 283
 284 out:
 285         /*
 286          * When tracking the current AP, don't do any further checks if the
 287          * new chandef is identical to the one we're currently using for the
 288          * connection. This keeps us from playing ping-pong with regulatory,
 289          * without it the following can happen (for example):
 290          *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
 291          *  - AP advertises regdom US
 292          *  - CRDA loads regdom US with 80 MHz prohibited (old database)
 293          *  - the code below detects an unsupported channel, downgrades, and
 294          *    we disconnect from the AP in the caller
 295          *  - disconnect causes CRDA to reload world regdomain and the game
 296          *    starts anew.
 297          * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
 298          *
 299          * It seems possible that there are still scenarios with CSA or real
 300          * bandwidth changes where a this could happen, but those cases are
 301          * less common and wouldn't completely prevent using the AP.
 302          */
 303         if (tracking &&
 304             cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
 305                 return ret;
 306
 307         /* don't print the message below for VHT mismatch if VHT is disabled */
 308         if (ret & IEEE80211_STA_DISABLE_VHT)
 309                 vht_chandef = *chandef;
 310
 311         /*
 312          * Ignore the DISABLED flag when we're already connected and only
 313          * tracking the APs beacon for bandwidth changes - otherwise we
 314          * might get disconnected here if we connect to an AP, update our
 315          * regulatory information based on the AP's country IE and the
 316          * information we have is wrong/outdated and disables the channel
 317          * that we're actually using for the connection to the AP.
 318          */
 319         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
 320                                         tracking ? 0 :
 321                                                    IEEE80211_CHAN_DISABLED)) {
 322                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
 323                         ret = IEEE80211_STA_DISABLE_HT |
 324                               IEEE80211_STA_DISABLE_VHT;
 325                         break;
 326                 }
 327
 328                 ret |= ieee80211_chandef_downgrade(chandef);
 329         }
 330
 331         if (chandef->width != vht_chandef.width && !tracking)
 332                 sdata_info(sdata,
 333                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 334
 335         WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
 336         return ret;
 337 }
 338
 339 static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
 340                                struct sta_info *sta,
 341                                const struct ieee80211_ht_cap *ht_cap,
 342                                const struct ieee80211_ht_operation *ht_oper,
 343                                const struct ieee80211_vht_operation *vht_oper,
 344                                const u8 *bssid, u32 *changed)
 345 {
 346         struct ieee80211_local *local = sdata->local;
 347         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 348         struct ieee80211_supported_band *sband;
 349         struct ieee80211_channel *chan;
 350         struct cfg80211_chan_def chandef;
 351         u16 ht_opmode;
 352         u32 flags;
 353         enum ieee80211_sta_rx_bandwidth new_sta_bw;
 354         int ret;
 355
 356         /* if HT was/is disabled, don't track any bandwidth changes */
 357         if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
 358                 return 0;
 359
 360         /* don't check VHT if we associated as non-VHT station */
 361         if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
 362                 vht_oper = NULL;
 363
 364         if (WARN_ON_ONCE(!sta))
 365                 return -EINVAL;
 366
 367         /*
 368          * if bss configuration changed store the new one -
 369          * this may be applicable even if channel is identical
 370          */
 371         ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 372         if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
 373                 *changed |= BSS_CHANGED_HT;
 374                 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
 375         }
 376
 377         chan = sdata->vif.bss_conf.chandef.chan;
 378         sband = local->hw.wiphy->bands[chan->band];
 379
 380         /* calculate new channel (type) based on HT/VHT operation IEs */
 381         flags = ieee80211_determine_chantype(sdata, sband, chan,
 382                                              ht_cap, ht_oper, vht_oper,
 383                                              &chandef, true);
 384
 385         /*
 386          * Downgrade the new channel if we associated with restricted
 387          * capabilities. For example, if we associated as a 20 MHz STA
 388          * to a 40 MHz AP (due to regulatory, capabilities or config
 389          * reasons) then switching to a 40 MHz channel now won't do us
 390          * any good -- we couldn't use it with the AP.
 391          */
 392         if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
 393             chandef.width == NL80211_CHAN_WIDTH_80P80)
 394                 flags |= ieee80211_chandef_downgrade(&chandef);
 395         if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
 396             chandef.width == NL80211_CHAN_WIDTH_160)
 397                 flags |= ieee80211_chandef_downgrade(&chandef);
 398         if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
 399             chandef.width > NL80211_CHAN_WIDTH_20)
 400                 flags |= ieee80211_chandef_downgrade(&chandef);
 401
 402         if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
 403                 return 0;
 404
 405         sdata_info(sdata,
 406                    "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
 407                    ifmgd->bssid, chandef.chan->center_freq, chandef.width,
 408                    chandef.center_freq1, chandef.center_freq2);
 409
 410         if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
 411                                       IEEE80211_STA_DISABLE_VHT |
 412                                       IEEE80211_STA_DISABLE_40MHZ |
 413                                       IEEE80211_STA_DISABLE_80P80MHZ |
 414                                       IEEE80211_STA_DISABLE_160MHZ)) ||
 415             !cfg80211_chandef_valid(&chandef)) {
 416                 sdata_info(sdata,
 417                            "AP %pM changed bandwidth in a way we can't support - disconnect\n",
 418                            ifmgd->bssid);
 419                 return -EINVAL;
 420         }
 421
 422         switch (chandef.width) {
 423         case NL80211_CHAN_WIDTH_20_NOHT:
 424         case NL80211_CHAN_WIDTH_20:
 425                 new_sta_bw = IEEE80211_STA_RX_BW_20;
 426                 break;
 427         case NL80211_CHAN_WIDTH_40:
 428                 new_sta_bw = IEEE80211_STA_RX_BW_40;
 429                 break;
 430         case NL80211_CHAN_WIDTH_80:
 431                 new_sta_bw = IEEE80211_STA_RX_BW_80;
 432                 break;
 433         case NL80211_CHAN_WIDTH_80P80:
 434         case NL80211_CHAN_WIDTH_160:
 435                 new_sta_bw = IEEE80211_STA_RX_BW_160;
 436                 break;
 437         default:
 438                 return -EINVAL;
 439         }
 440
 441         if (new_sta_bw > sta->cur_max_bandwidth)
 442                 new_sta_bw = sta->cur_max_bandwidth;
 443
 444         if (new_sta_bw < sta->sta.bandwidth) {
 445                 sta->sta.bandwidth = new_sta_bw;
 446                 rate_control_rate_update(local, sband, sta,
 447                                          IEEE80211_RC_BW_CHANGED);
 448         }
 449
 450         ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
 451         if (ret) {
 452                 sdata_info(sdata,
 453                            "AP %pM changed bandwidth to incompatible one - disconnect\n",
 454                            ifmgd->bssid);
 455                 return ret;
 456         }
 457
 458         if (new_sta_bw > sta->sta.bandwidth) {
 459                 sta->sta.bandwidth = new_sta_bw;
 460                 rate_control_rate_update(local, sband, sta,
 461                                          IEEE80211_RC_BW_CHANGED);
 462         }
 463
 464         return 0;
 465 }
 466
 467 /* frame sending functions */
 468
 469 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 470                                 struct sk_buff *skb, u8 ap_ht_param,
 471                                 struct ieee80211_supported_band *sband,
 472                                 struct ieee80211_channel *channel,
 473                                 enum ieee80211_smps_mode smps)
 474 {
 475         u8 *pos;
 476         u32 flags = channel->flags;
 477         u16 cap;
 478         struct ieee80211_sta_ht_cap ht_cap;
 479
 480         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 481
 482         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
 483         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 484
 485         /* determine capability flags */
 486         cap = ht_cap.cap;
 487
 488         switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 489         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 490                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
 491                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 492                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 493                 }
 494                 break;
 495         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 496                 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
 497                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 498                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 499                 }
 500                 break;
 501         }
 502
 503         /*
 504          * If 40 MHz was disabled associate as though we weren't
 505          * capable of 40 MHz -- some broken APs will never fall
 506          * back to trying to transmit in 20 MHz.
 507          */
 508         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
 509                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 510                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 511         }
 512
 513         /* set SM PS mode properly */
 514         cap &= ~IEEE80211_HT_CAP_SM_PS;
 515         switch (smps) {
 516         case IEEE80211_SMPS_AUTOMATIC:
 517         case IEEE80211_SMPS_NUM_MODES:
 518                 WARN_ON(1);
 519         case IEEE80211_SMPS_OFF:
 520                 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
 521                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 522                 break;
 523         case IEEE80211_SMPS_STATIC:
 524                 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
 525                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 526                 break;
 527         case IEEE80211_SMPS_DYNAMIC:
 528                 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
 529                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 530                 break;
 531         }
 532
 533         /* reserve and fill IE */
 534         pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
 535         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 536 }
 537
 538 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
 539                                  struct sk_buff *skb,
 540                                  struct ieee80211_supported_band *sband,
 541                                  struct ieee80211_vht_cap *ap_vht_cap)
 542 {
 543         u8 *pos;
 544         u32 cap;
 545         struct ieee80211_sta_vht_cap vht_cap;
 546         u32 mask, ap_bf_sts, our_bf_sts;
 547
 548         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 549
 550         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
 551         ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
 552
 553         /* determine capability flags */
 554         cap = vht_cap.cap;
 555
 556         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
 557                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
 558                 cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
 559         }
 560
 561         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
 562                 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
 563                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
 564         }
 565
 566         /*
 567          * Some APs apparently get confused if our capabilities are better
 568          * than theirs, so restrict what we advertise in the assoc request.
 569          */
 570         if (!(ap_vht_cap->vht_cap_info &
 571                         cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
 572                 cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
 573
 574         mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
 575
 576         ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
 577         our_bf_sts = cap & mask;
 578
 579         if (ap_bf_sts < our_bf_sts) {
 580                 cap &= ~mask;
 581                 cap |= ap_bf_sts;
 582         }
 583
 584         /* reserve and fill IE */
 585         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
 586         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
 587 }
 588
 589 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 590 {
 591         struct ieee80211_local *local = sdata->local;
 592         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 593         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
 594         struct sk_buff *skb;
 595         struct ieee80211_mgmt *mgmt;
 596         u8 *pos, qos_info;
 597         size_t offset = 0, noffset;
 598         int i, count, rates_len, supp_rates_len, shift;
 599         u16 capab;
 600         struct ieee80211_supported_band *sband;
 601         struct ieee80211_chanctx_conf *chanctx_conf;
 602         struct ieee80211_channel *chan;
 603         u32 rate_flags, rates = 0;
 604
 605         sdata_assert_lock(sdata);
 606
 607         rcu_read_lock();
 608         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 609         if (WARN_ON(!chanctx_conf)) {
 610                 rcu_read_unlock();
 611                 return;
 612         }
 613         chan = chanctx_conf->def.chan;
 614         rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
 615         rcu_read_unlock();
 616         sband = local->hw.wiphy->bands[chan->band];
 617         shift = ieee80211_vif_get_shift(&sdata->vif);
 618
 619         if (assoc_data->supp_rates_len) {
 620                 /*
 621                  * Get all rates supported by the device and the AP as
 622                  * some APs don't like getting a superset of their rates
 623                  * in the association request (e.g. D-Link DAP 1353 in
 624                  * b-only mode)...
 625                  */
 626                 rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
 627                                                      assoc_data->supp_rates,
 628                                                      assoc_data->supp_rates_len,
 629                                                      &rates);
 630         } else {
 631                 /*
 632                  * In case AP not provide any supported rates information
 633                  * before association, we send information element(s) with
 634                  * all rates that we support.
 635                  */
 636                 rates_len = 0;
 637                 for (i = 0; i < sband->n_bitrates; i++) {
 638                         if ((rate_flags & sband->bitrates[i].flags)
 639                             != rate_flags)
 640                                 continue;
 641                         rates |= BIT(i);
 642                         rates_len++;
 643                 }
 644         }
 645
 646         skb = alloc_skb(local->hw.extra_tx_headroom +
 647                         sizeof(*mgmt) + /* bit too much but doesn't matter */
 648                         2 + assoc_data->ssid_len + /* SSID */
 649                         4 + rates_len + /* (extended) rates */
 650                         4 + /* power capability */
 651                         2 + 2 * sband->n_channels + /* supported channels */
 652                         2 + sizeof(struct ieee80211_ht_cap) + /* HT */
 653                         2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
 654                         assoc_data->ie_len + /* extra IEs */
 655                         9, /* WMM */
 656                         GFP_KERNEL);
 657         if (!skb)
 658                 return;
 659
 660         skb_reserve(skb, local->hw.extra_tx_headroom);
 661
 662         capab = WLAN_CAPABILITY_ESS;
 663
 664         if (sband->band == IEEE80211_BAND_2GHZ) {
 665                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
 666                         capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 667                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
 668                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 669         }
 670
 671         if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
 672                 capab |= WLAN_CAPABILITY_PRIVACY;
 673
 674         if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
 675             (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
 676                 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 677
 678         if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
 679                 capab |= WLAN_CAPABILITY_RADIO_MEASURE;
 680
 681         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 682         memset(mgmt, 0, 24);
 683         memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
 684         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
 685         memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
 686
 687         if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
 688                 skb_put(skb, 10);
 689                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 690                                                   IEEE80211_STYPE_REASSOC_REQ);
 691                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 692                 mgmt->u.reassoc_req.listen_interval =
 693                                 cpu_to_le16(local->hw.conf.listen_interval);
 694                 memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
 695                        ETH_ALEN);
 696         } else {
 697                 skb_put(skb, 4);
 698                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 699                                                   IEEE80211_STYPE_ASSOC_REQ);
 700                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 701                 mgmt->u.assoc_req.listen_interval =
 702                                 cpu_to_le16(local->hw.conf.listen_interval);
 703         }
 704
 705         /* SSID */
 706         pos = skb_put(skb, 2 + assoc_data->ssid_len);
 707         *pos++ = WLAN_EID_SSID;
 708         *pos++ = assoc_data->ssid_len;
 709         memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
 710
 711         /* add all rates which were marked to be used above */
 712         supp_rates_len = rates_len;
 713         if (supp_rates_len > 8)
 714                 supp_rates_len = 8;
 715
 716         pos = skb_put(skb, supp_rates_len + 2);
 717         *pos++ = WLAN_EID_SUPP_RATES;
 718         *pos++ = supp_rates_len;
 719
 720         count = 0;
 721         for (i = 0; i < sband->n_bitrates; i++) {
 722                 if (BIT(i) & rates) {
 723                         int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 724                                                 5 * (1 << shift));
 725                         *pos++ = (u8) rate;
 726                         if (++count == 8)
 727                                 break;
 728                 }
 729         }
 730
 731         if (rates_len > count) {
 732                 pos = skb_put(skb, rates_len - count + 2);
 733                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 734                 *pos++ = rates_len - count;
 735
 736                 for (i++; i < sband->n_bitrates; i++) {
 737                         if (BIT(i) & rates) {
 738                                 int rate;
 739                                 rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 740                                                     5 * (1 << shift));
 741                                 *pos++ = (u8) rate;
 742                         }
 743                 }
 744         }
 745
 746         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
 747             capab & WLAN_CAPABILITY_RADIO_MEASURE) {
 748                 pos = skb_put(skb, 4);
 749                 *pos++ = WLAN_EID_PWR_CAPABILITY;
 750                 *pos++ = 2;
 751                 *pos++ = 0; /* min tx power */
 752                  /* max tx power */
 753                 *pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
 754         }
 755
 756         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
 757                 /* TODO: get this in reg domain format */
 758                 pos = skb_put(skb, 2 * sband->n_channels + 2);
 759                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
 760                 *pos++ = 2 * sband->n_channels;
 761                 for (i = 0; i < sband->n_channels; i++) {
 762                         *pos++ = ieee80211_frequency_to_channel(
 763                                         sband->channels[i].center_freq);
 764                         *pos++ = 1; /* one channel in the subband*/
 765                 }
 766         }
 767
 768         /* if present, add any custom IEs that go before HT */
 769         if (assoc_data->ie_len) {
 770                 static const u8 before_ht[] = {
 771                         WLAN_EID_SSID,
 772                         WLAN_EID_SUPP_RATES,
 773                         WLAN_EID_EXT_SUPP_RATES,
 774                         WLAN_EID_PWR_CAPABILITY,
 775                         WLAN_EID_SUPPORTED_CHANNELS,
 776                         WLAN_EID_RSN,
 777                         WLAN_EID_QOS_CAPA,
 778                         WLAN_EID_RRM_ENABLED_CAPABILITIES,
 779                         WLAN_EID_MOBILITY_DOMAIN,
 780                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 781                 };
 782                 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
 783                                              before_ht, ARRAY_SIZE(before_ht),
 784                                              offset);
 785                 pos = skb_put(skb, noffset - offset);
 786                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
 787                 offset = noffset;
 788         }
 789
 790         if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
 791                          !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
 792                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
 793
 794         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
 795                 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
 796                                     sband, chan, sdata->smps_mode);
 797
 798         /* if present, add any custom IEs that go before VHT */
 799         if (assoc_data->ie_len) {
 800                 static const u8 before_vht[] = {
 801                         WLAN_EID_SSID,
 802                         WLAN_EID_SUPP_RATES,
 803                         WLAN_EID_EXT_SUPP_RATES,
 804                         WLAN_EID_PWR_CAPABILITY,
 805                         WLAN_EID_SUPPORTED_CHANNELS,
 806                         WLAN_EID_RSN,
 807                         WLAN_EID_QOS_CAPA,
 808                         WLAN_EID_RRM_ENABLED_CAPABILITIES,
 809                         WLAN_EID_MOBILITY_DOMAIN,
 810                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 811                         WLAN_EID_HT_CAPABILITY,
 812                         WLAN_EID_BSS_COEX_2040,
 813                         WLAN_EID_EXT_CAPABILITY,
 814                         WLAN_EID_QOS_TRAFFIC_CAPA,
 815                         WLAN_EID_TIM_BCAST_REQ,
 816                         WLAN_EID_INTERWORKING,
 817                 };
 818                 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
 819                                              before_vht, ARRAY_SIZE(before_vht),
 820                                              offset);
 821                 pos = skb_put(skb, noffset - offset);
 822                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
 823                 offset = noffset;
 824         }
 825
 826         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 827                 ieee80211_add_vht_ie(sdata, skb, sband,
 828                                      &assoc_data->ap_vht_cap);
 829
 830         /* if present, add any custom non-vendor IEs that go after HT */
 831         if (assoc_data->ie_len) {
 832                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
 833                                                     assoc_data->ie_len,
 834                                                     offset);
 835                 pos = skb_put(skb, noffset - offset);
 836                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
 837                 offset = noffset;
 838         }
 839
 840         if (assoc_data->wmm) {
 841                 if (assoc_data->uapsd) {
 842                         qos_info = ifmgd->uapsd_queues;
 843                         qos_info |= (ifmgd->uapsd_max_sp_len <<
 844                                      IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
 845                 } else {
 846                         qos_info = 0;
 847                 }
 848
 849                 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
 850         }
 851
 852         /* add any remaining custom (i.e. vendor specific here) IEs */
 853         if (assoc_data->ie_len) {
 854                 noffset = assoc_data->ie_len;
 855                 pos = skb_put(skb, noffset - offset);
 856                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
 857         }
 858
 859         drv_mgd_prepare_tx(local, sdata);
 860
 861         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 862         if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
 863                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
 864                                                 IEEE80211_TX_INTFL_MLME_CONN_TX;
 865         ieee80211_tx_skb(sdata, skb);
 866 }
 867
 868 void ieee80211_send_pspoll(struct ieee80211_local *local,
 869                            struct ieee80211_sub_if_data *sdata)
 870 {
 871         struct ieee80211_pspoll *pspoll;
 872         struct sk_buff *skb;
 873
 874         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
 875         if (!skb)
 876                 return;
 877
 878         pspoll = (struct ieee80211_pspoll *) skb->data;
 879         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 880
 881         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 882         ieee80211_tx_skb(sdata, skb);
 883 }
 884
 885 void ieee80211_send_nullfunc(struct ieee80211_local *local,
 886                              struct ieee80211_sub_if_data *sdata,
 887                              int powersave)
 888 {
 889         struct sk_buff *skb;
 890         struct ieee80211_hdr_3addr *nullfunc;
 891         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 892
 893         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
 894         if (!skb)
 895                 return;
 896
 897         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
 898         if (powersave)
 899                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 900
 901         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
 902                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
 903
 904         if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
 905                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 906
 907         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
 908                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
 909
 910         ieee80211_tx_skb(sdata, skb);
 911 }
 912
 913 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
 914                                           struct ieee80211_sub_if_data *sdata)
 915 {
 916         struct sk_buff *skb;
 917         struct ieee80211_hdr *nullfunc;
 918         __le16 fc;
 919
 920         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
 921                 return;
 922
 923         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
 924         if (!skb)
 925                 return;
 926
 927         skb_reserve(skb, local->hw.extra_tx_headroom);
 928
 929         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
 930         memset(nullfunc, 0, 30);
 931         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
 932                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
 933         nullfunc->frame_control = fc;
 934         memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
 935         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
 936         memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
 937         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
 938
 939         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 940         ieee80211_tx_skb(sdata, skb);
 941 }
 942
 943 /* spectrum management related things */
 944 static void ieee80211_chswitch_work(struct work_struct *work)
 945 {
 946         struct ieee80211_sub_if_data *sdata =
 947                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
 948         struct ieee80211_local *local = sdata->local;
 949         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 950         int ret;
 951
 952         if (!ieee80211_sdata_running(sdata))
 953                 return;
 954
 955         sdata_lock(sdata);
 956         mutex_lock(&local->mtx);
 957         mutex_lock(&local->chanctx_mtx);
 958
 959         if (!ifmgd->associated)
 960                 goto out;
 961
 962         if (!sdata->vif.csa_active)
 963                 goto out;
 964
 965         /*
 966          * using reservation isn't immediate as it may be deferred until later
 967          * with multi-vif. once reservation is complete it will re-schedule the
 968          * work with no reserved_chanctx so verify chandef to check if it
 969          * completed successfully
 970          */
 971
 972         if (sdata->reserved_chanctx) {
 973                 struct ieee80211_supported_band *sband = NULL;
 974                 struct sta_info *mgd_sta = NULL;
 975                 enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
 976
 977                 /*
 978                  * with multi-vif csa driver may call ieee80211_csa_finish()
 979                  * many times while waiting for other interfaces to use their
 980                  * reservations
 981                  */
 982                 if (sdata->reserved_ready)
 983                         goto out;
 984
 985                 if (sdata->vif.bss_conf.chandef.width !=
 986                     sdata->csa_chandef.width) {
 987                         /*
 988                          * For managed interface, we need to also update the AP
 989                          * station bandwidth and align the rate scale algorithm
 990                          * on the bandwidth change. Here we only consider the
 991                          * bandwidth of the new channel definition (as channel
 992                          * switch flow does not have the full HT/VHT/HE
 993                          * information), assuming that if additional changes are
 994                          * required they would be done as part of the processing
 995                          * of the next beacon from the AP.
 996                          */
 997                         switch (sdata->csa_chandef.width) {
 998                         case NL80211_CHAN_WIDTH_20_NOHT:
 999                         case NL80211_CHAN_WIDTH_20:
1000                         default:
1001                                 bw = IEEE80211_STA_RX_BW_20;
1002                                 break;
1003                         case NL80211_CHAN_WIDTH_40:
1004                                 bw = IEEE80211_STA_RX_BW_40;
1005                                 break;
1006                         case NL80211_CHAN_WIDTH_80:
1007                                 bw = IEEE80211_STA_RX_BW_80;
1008                                 break;
1009                         case NL80211_CHAN_WIDTH_80P80:
1010                         case NL80211_CHAN_WIDTH_160:
1011                                 bw = IEEE80211_STA_RX_BW_160;
1012                                 break;
1013                         }
1014
1015                         mgd_sta = sta_info_get(sdata, ifmgd->bssid);
1016                         sband =
1017                                 local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
1018                 }
1019
1020                 if (sdata->vif.bss_conf.chandef.width >
1021                     sdata->csa_chandef.width) {
1022                         mgd_sta->sta.bandwidth = bw;
1023                         rate_control_rate_update(local, sband, mgd_sta,
1024                                                  IEEE80211_RC_BW_CHANGED);
1025                 }
1026
1027                 ret = ieee80211_vif_use_reserved_context(sdata);
1028                 if (ret) {
1029                         sdata_info(sdata,
1030                                    "failed to use reserved channel context, disconnecting (err=%d)\n",
1031                                    ret);
1032                         ieee80211_queue_work(&sdata->local->hw,
1033                                              &ifmgd->csa_connection_drop_work);
1034                         goto out;
1035                 }
1036
1037                 if (sdata->vif.bss_conf.chandef.width <
1038                     sdata->csa_chandef.width) {
1039                         mgd_sta->sta.bandwidth = bw;
1040                         rate_control_rate_update(local, sband, mgd_sta,
1041                                                  IEEE80211_RC_BW_CHANGED);
1042                 }
1043
1044                 goto out;
1045         }
1046
1047         if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
1048                                         &sdata->csa_chandef)) {
1049                 sdata_info(sdata,
1050                            "failed to finalize channel switch, disconnecting\n");
1051                 ieee80211_queue_work(&sdata->local->hw,
1052                                      &ifmgd->csa_connection_drop_work);
1053                 goto out;
1054         }
1055
1056         /* XXX: shouldn't really modify cfg80211-owned data! */
1057         ifmgd->associated->channel = sdata->csa_chandef.chan;
1058
1059         sdata->vif.csa_active = false;
1060
1061         /* XXX: wait for a beacon first? */
1062         if (sdata->csa_block_tx) {
1063                 ieee80211_wake_vif_queues(local, sdata,
1064                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1065                 sdata->csa_block_tx = false;
1066         }
1067
1068         ieee80211_sta_reset_beacon_monitor(sdata);
1069         ieee80211_sta_reset_conn_monitor(sdata);
1070
1071 out:
1072         mutex_unlock(&local->chanctx_mtx);
1073         mutex_unlock(&local->mtx);
1074         sdata_unlock(sdata);
1075 }
1076
1077 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1078 {
1079         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1080         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1081
1082         trace_api_chswitch_done(sdata, success);
1083         if (!success) {
1084                 sdata_info(sdata,
1085                            "driver channel switch failed, disconnecting\n");
1086                 ieee80211_queue_work(&sdata->local->hw,
1087                                      &ifmgd->csa_connection_drop_work);
1088         } else {
1089                 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1090         }
1091 }
1092 EXPORT_SYMBOL(ieee80211_chswitch_done);
1093
1094 static void ieee80211_chswitch_timer(unsigned long data)
1095 {
1096         struct ieee80211_sub_if_data *sdata =
1097                 (struct ieee80211_sub_if_data *) data;
1098
1099         ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1100 }
1101
1102 static void
1103 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1104                                  u64 timestamp, struct ieee802_11_elems *elems,
1105                                  bool beacon)
1106 {
1107         struct ieee80211_local *local = sdata->local;
1108         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1109         struct cfg80211_bss *cbss = ifmgd->associated;
1110         struct ieee80211_chanctx_conf *conf;
1111         struct ieee80211_chanctx *chanctx;
1112         enum ieee80211_band current_band;
1113         struct ieee80211_csa_ie csa_ie;
1114         int res;
1115
1116         sdata_assert_lock(sdata);
1117
1118         if (!cbss)
1119                 return;
1120
1121         if (local->scanning)
1122                 return;
1123
1124         /* disregard subsequent announcements if we are already processing */
1125         if (sdata->vif.csa_active)
1126                 return;
1127
1128         current_band = cbss->channel->band;
1129         memset(&csa_ie, 0, sizeof(csa_ie));
1130         res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1131                                            ifmgd->flags,
1132                                            ifmgd->associated->bssid, &csa_ie);
1133         if (res < 0)
1134                 ieee80211_queue_work(&local->hw,
1135                                      &ifmgd->csa_connection_drop_work);
1136         if (res)
1137                 return;
1138
1139         if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1140                                      IEEE80211_CHAN_DISABLED)) {
1141                 sdata_info(sdata,
1142                            "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1143                            ifmgd->associated->bssid,
1144                            csa_ie.chandef.chan->center_freq,
1145                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1146                            csa_ie.chandef.center_freq2);
1147                 ieee80211_queue_work(&local->hw,
1148                                      &ifmgd->csa_connection_drop_work);
1149                 return;
1150         }
1151
1152         mutex_lock(&local->mtx);
1153         mutex_lock(&local->chanctx_mtx);
1154         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
1155                                          lockdep_is_held(&local->chanctx_mtx));
1156         if (!conf) {
1157                 sdata_info(sdata,
1158                            "no channel context assigned to vif?, disconnecting\n");
1159                 ieee80211_queue_work(&local->hw,
1160                                      &ifmgd->csa_connection_drop_work);
1161                 mutex_unlock(&local->chanctx_mtx);
1162                 mutex_unlock(&local->mtx);
1163                 return;
1164         }
1165
1166         chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1167
1168         if (local->use_chanctx) {
1169                 u32 num_chanctx = 0;
1170                 list_for_each_entry(chanctx, &local->chanctx_list, list)
1171                        num_chanctx++;
1172
1173                 if (num_chanctx > 1 ||
1174                     !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
1175                         sdata_info(sdata,
1176                                    "not handling chan-switch with channel contexts\n");
1177                         ieee80211_queue_work(&local->hw,
1178                                              &ifmgd->csa_connection_drop_work);
1179                         mutex_unlock(&local->chanctx_mtx);
1180                         mutex_unlock(&local->mtx);
1181                         return;
1182                 }
1183         }
1184
1185         res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
1186                                             chanctx->mode, false);
1187         if (res) {
1188                 sdata_info(sdata,
1189                            "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1190                            res);
1191                 ieee80211_queue_work(&local->hw,
1192                                      &ifmgd->csa_connection_drop_work);
1193                 mutex_unlock(&local->chanctx_mtx);
1194                 mutex_unlock(&local->mtx);
1195                 return;
1196         }
1197         mutex_unlock(&local->chanctx_mtx);
1198
1199         sdata->vif.csa_active = true;
1200         sdata->csa_chandef = csa_ie.chandef;
1201         sdata->csa_block_tx = csa_ie.mode;
1202
1203         if (sdata->csa_block_tx)
1204                 ieee80211_stop_vif_queues(local, sdata,
1205                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1206         mutex_unlock(&local->mtx);
1207
1208         if (local->ops->channel_switch) {
1209                 /* use driver's channel switch callback */
1210                 struct ieee80211_channel_switch ch_switch = {
1211                         .timestamp = timestamp,
1212                         .block_tx = csa_ie.mode,
1213                         .chandef = csa_ie.chandef,
1214                         .count = csa_ie.count,
1215                 };
1216
1217                 drv_channel_switch(local, &ch_switch);
1218                 return;
1219         }
1220
1221         /* channel switch handled in software */
1222         if (csa_ie.count <= 1)
1223                 ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1224         else
1225                 mod_timer(&ifmgd->chswitch_timer,
1226                           TU_TO_EXP_TIME((csa_ie.count - 1) *
1227                                          cbss->beacon_interval));
1228 }
1229
1230 static bool
1231 ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
1232                                  struct ieee80211_channel *channel,
1233                                  const u8 *country_ie, u8 country_ie_len,
1234                                  const u8 *pwr_constr_elem,
1235                                  int *chan_pwr, int *pwr_reduction)
1236 {
1237         struct ieee80211_country_ie_triplet *triplet;
1238         int chan = ieee80211_frequency_to_channel(channel->center_freq);
1239         int i, chan_increment;
1240         bool have_chan_pwr = false;
1241
1242         /* Invalid IE */
1243         if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1244                 return false;
1245
1246         triplet = (void *)(country_ie + 3);
1247         country_ie_len -= 3;
1248
1249         switch (channel->band) {
1250         default:
1251                 WARN_ON_ONCE(1);
1252                 /* fall through */
1253         case IEEE80211_BAND_2GHZ:
1254         case IEEE80211_BAND_60GHZ:
1255                 chan_increment = 1;
1256                 break;
1257         case IEEE80211_BAND_5GHZ:
1258                 chan_increment = 4;
1259                 break;
1260         }
1261
1262         /* find channel */
1263         while (country_ie_len >= 3) {
1264                 u8 first_channel = triplet->chans.first_channel;
1265
1266                 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
1267                         goto next;
1268
1269                 for (i = 0; i < triplet->chans.num_channels; i++) {
1270                         if (first_channel + i * chan_increment == chan) {
1271                                 have_chan_pwr = true;
1272                                 *chan_pwr = triplet->chans.max_power;
1273                                 break;
1274                         }
1275                 }
1276                 if (have_chan_pwr)
1277                         break;
1278
1279  next:
1280                 triplet++;
1281                 country_ie_len -= 3;
1282         }
1283
1284         if (have_chan_pwr)
1285                 *pwr_reduction = *pwr_constr_elem;
1286         return have_chan_pwr;
1287 }
1288
1289 static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
1290                                       struct ieee80211_channel *channel,
1291                                       const u8 *cisco_dtpc_ie,
1292                                       int *pwr_level)
1293 {
1294         /* From practical testing, the first data byte of the DTPC element
1295          * seems to contain the requested dBm level, and the CLI on Cisco
1296          * APs clearly state the range is -127 to 127 dBm, which indicates
1297          * a signed byte, although it seemingly never actually goes negative.
1298          * The other byte seems to always be zero.
1299          */
1300         *pwr_level = (__s8)cisco_dtpc_ie[4];
1301 }
1302
1303 static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
1304                                        struct ieee80211_channel *channel,
1305                                        struct ieee80211_mgmt *mgmt,
1306                                        const u8 *country_ie, u8 country_ie_len,
1307                                        const u8 *pwr_constr_ie,
1308                                        const u8 *cisco_dtpc_ie)
1309 {
1310         bool has_80211h_pwr = false, has_cisco_pwr = false;
1311         int chan_pwr = 0, pwr_reduction_80211h = 0;
1312         int pwr_level_cisco, pwr_level_80211h;
1313         int new_ap_level;
1314
1315         if (country_ie && pwr_constr_ie &&
1316             mgmt->u.probe_resp.capab_info &
1317                 cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT)) {
1318                 has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
1319                         sdata, channel, country_ie, country_ie_len,
1320                         pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1321                 pwr_level_80211h =
1322                         max_t(int, 0, chan_pwr - pwr_reduction_80211h);
1323         }
1324
1325         if (cisco_dtpc_ie) {
1326                 ieee80211_find_cisco_dtpc(
1327                         sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
1328                 has_cisco_pwr = true;
1329         }
1330
1331         if (!has_80211h_pwr && !has_cisco_pwr)
1332                 return 0;
1333
1334         /* If we have both 802.11h and Cisco DTPC, apply both limits
1335          * by picking the smallest of the two power levels advertised.
1336          */
1337         if (has_80211h_pwr &&
1338             (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1339                 sdata_info(sdata,
1340                            "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
1341                            pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
1342                            sdata->u.mgd.bssid);
1343                 new_ap_level = pwr_level_80211h;
1344         } else {  /* has_cisco_pwr is always true here. */
1345                 sdata_info(sdata,
1346                            "Limiting TX power to %d dBm as advertised by %pM\n",
1347                            pwr_level_cisco, sdata->u.mgd.bssid);
1348                 new_ap_level = pwr_level_cisco;
1349         }
1350
1351         if (sdata->ap_power_level == new_ap_level)
1352                 return 0;
1353
1354         sdata->ap_power_level = new_ap_level;
1355         if (__ieee80211_recalc_txpower(sdata))
1356                 return BSS_CHANGED_TXPOWER;
1357         return 0;
1358 }
1359
1360 /* powersave */
1361 static void ieee80211_enable_ps(struct ieee80211_local *local,
1362                                 struct ieee80211_sub_if_data *sdata)
1363 {
1364         struct ieee80211_conf *conf = &local->hw.conf;
1365
1366         /*
1367          * If we are scanning right now then the parameters will
1368          * take effect when scan finishes.
1369          */
1370         if (local->scanning)
1371                 return;
1372
1373         if (conf->dynamic_ps_timeout > 0 &&
1374             !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
1375                 mod_timer(&local->dynamic_ps_timer, jiffies +
1376                           msecs_to_jiffies(conf->dynamic_ps_timeout));
1377         } else {
1378                 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1379                         ieee80211_send_nullfunc(local, sdata, 1);
1380
1381                 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1382                     (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
1383                         return;
1384
1385                 conf->flags |= IEEE80211_CONF_PS;
1386                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1387         }
1388 }
1389
1390 static void ieee80211_change_ps(struct ieee80211_local *local)
1391 {
1392         struct ieee80211_conf *conf = &local->hw.conf;
1393
1394         if (local->ps_sdata) {
1395                 ieee80211_enable_ps(local, local->ps_sdata);
1396         } else if (conf->flags & IEEE80211_CONF_PS) {
1397                 conf->flags &= ~IEEE80211_CONF_PS;
1398                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1399                 del_timer_sync(&local->dynamic_ps_timer);
1400                 cancel_work_sync(&local->dynamic_ps_enable_work);
1401         }
1402 }
1403
1404 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
1405 {
1406         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
1407         struct sta_info *sta = NULL;
1408         bool authorized = false;
1409
1410         if (!mgd->powersave)
1411                 return false;
1412
1413         if (mgd->broken_ap)
1414                 return false;
1415
1416         if (!mgd->associated)
1417                 return false;
1418
1419         if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1420                 return false;
1421
1422         if (!mgd->have_beacon)
1423                 return false;
1424
1425         rcu_read_lock();
1426         sta = sta_info_get(sdata, mgd->bssid);
1427         if (sta)
1428                 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1429         rcu_read_unlock();
1430
1431         return authorized;
1432 }
1433
1434 /* need to hold RTNL or interface lock */
1435 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1436 {
1437         struct ieee80211_sub_if_data *sdata, *found = NULL;
1438         int count = 0;
1439         int timeout;
1440
1441         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
1442                 local->ps_sdata = NULL;
1443                 return;
1444         }
1445
1446         list_for_each_entry(sdata, &local->interfaces, list) {
1447                 if (!ieee80211_sdata_running(sdata))
1448                         continue;
1449                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
1450                         /* If an AP vif is found, then disable PS
1451                          * by setting the count to zero thereby setting
1452                          * ps_sdata to NULL.
1453                          */
1454                         count = 0;
1455                         break;
1456                 }
1457                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1458                         continue;
1459                 found = sdata;
1460                 count++;
1461         }
1462
1463         if (count == 1 && ieee80211_powersave_allowed(found)) {
1464                 s32 beaconint_us;
1465
1466                 if (latency < 0)
1467                         latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1468
1469                 beaconint_us = ieee80211_tu_to_usec(
1470                                         found->vif.bss_conf.beacon_int);
1471
1472                 timeout = local->dynamic_ps_forced_timeout;
1473                 if (timeout < 0) {
1474                         /*
1475                          * Go to full PSM if the user configures a very low
1476                          * latency requirement.
1477                          * The 2000 second value is there for compatibility
1478                          * until the PM_QOS_NETWORK_LATENCY is configured
1479                          * with real values.
1480                          */
1481                         if (latency > (1900 * USEC_PER_MSEC) &&
1482                             latency != (2000 * USEC_PER_SEC))
1483                                 timeout = 0;
1484                         else
1485                                 timeout = 100;
1486                 }
1487                 local->hw.conf.dynamic_ps_timeout = timeout;
1488
1489                 if (beaconint_us > latency) {
1490                         local->ps_sdata = NULL;
1491                 } else {
1492                         int maxslp = 1;
1493                         u8 dtimper = found->u.mgd.dtim_period;
1494
1495                         /* If the TIM IE is invalid, pretend the value is 1 */
1496                         if (!dtimper)
1497                                 dtimper = 1;
1498                         else if (dtimper > 1)
1499                                 maxslp = min_t(int, dtimper,
1500                                                     latency / beaconint_us);
1501
1502                         local->hw.conf.max_sleep_period = maxslp;
1503                         local->hw.conf.ps_dtim_period = dtimper;
1504                         local->ps_sdata = found;
1505                 }
1506         } else {
1507                 local->ps_sdata = NULL;
1508         }
1509
1510         ieee80211_change_ps(local);
1511 }
1512
1513 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
1514 {
1515         bool ps_allowed = ieee80211_powersave_allowed(sdata);
1516
1517         if (sdata->vif.bss_conf.ps != ps_allowed) {
1518                 sdata->vif.bss_conf.ps = ps_allowed;
1519                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
1520         }
1521 }
1522
1523 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
1524 {
1525         struct ieee80211_local *local =
1526                 container_of(work, struct ieee80211_local,
1527                              dynamic_ps_disable_work);
1528
1529         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1530                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1531                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1532         }
1533
1534         ieee80211_wake_queues_by_reason(&local->hw,
1535                                         IEEE80211_MAX_QUEUE_MAP,
1536                                         IEEE80211_QUEUE_STOP_REASON_PS,
1537                                         false);
1538 }
1539
1540 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
1541 {
1542         struct ieee80211_local *local =
1543                 container_of(work, struct ieee80211_local,
1544                              dynamic_ps_enable_work);
1545         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1546         struct ieee80211_if_managed *ifmgd;
1547         unsigned long flags;
1548         int q;
1549
1550         /* can only happen when PS was just disabled anyway */
1551         if (!sdata)
1552                 return;
1553
1554         ifmgd = &sdata->u.mgd;
1555
1556         if (local->hw.conf.flags & IEEE80211_CONF_PS)
1557                 return;
1558
1559         if (local->hw.conf.dynamic_ps_timeout > 0) {
1560                 /* don't enter PS if TX frames are pending */
1561                 if (drv_tx_frames_pending(local)) {
1562                         mod_timer(&local->dynamic_ps_timer, jiffies +
1563                                   msecs_to_jiffies(
1564                                   local->hw.conf.dynamic_ps_timeout));
1565                         return;
1566                 }
1567
1568                 /*
1569                  * transmission can be stopped by others which leads to
1570                  * dynamic_ps_timer expiry. Postpone the ps timer if it
1571                  * is not the actual idle state.
1572                  */
1573                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1574                 for (q = 0; q < local->hw.queues; q++) {
1575                         if (local->queue_stop_reasons[q]) {
1576                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1577                                                        flags);
1578                                 mod_timer(&local->dynamic_ps_timer, jiffies +
1579                                           msecs_to_jiffies(
1580                                           local->hw.conf.dynamic_ps_timeout));
1581                                 return;
1582                         }
1583                 }
1584                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1585         }
1586
1587         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1588             !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1589                 if (drv_tx_frames_pending(local)) {
1590                         mod_timer(&local->dynamic_ps_timer, jiffies +
1591                                   msecs_to_jiffies(
1592                                   local->hw.conf.dynamic_ps_timeout));
1593                 } else {
1594                         ieee80211_send_nullfunc(local, sdata, 1);
1595                         /* Flush to get the tx status of nullfunc frame */
1596                         ieee80211_flush_queues(local, sdata);
1597                 }
1598         }
1599
1600         if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
1601               (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
1602             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1603                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
1604                 local->hw.conf.flags |= IEEE80211_CONF_PS;
1605                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1606         }
1607 }
1608
1609 void ieee80211_dynamic_ps_timer(unsigned long data)
1610 {
1611         struct ieee80211_local *local = (void *) data;
1612
1613         if (local->quiescing || local->suspended)
1614                 return;
1615
1616         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1617 }
1618
1619 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
1620 {
1621         struct delayed_work *delayed_work =
1622                 container_of(work, struct delayed_work, work);
1623         struct ieee80211_sub_if_data *sdata =
1624                 container_of(delayed_work, struct ieee80211_sub_if_data,
1625                              dfs_cac_timer_work);
1626         struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1627
1628         mutex_lock(&sdata->local->mtx);
1629         if (sdata->wdev.cac_started) {
1630                 ieee80211_vif_release_channel(sdata);
1631                 cfg80211_cac_event(sdata->dev, &chandef,
1632                                    NL80211_RADAR_CAC_FINISHED,
1633                                    GFP_KERNEL);
1634         }
1635         mutex_unlock(&sdata->local->mtx);
1636 }
1637
1638 /* MLME */
1639 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1640                                      struct ieee80211_sub_if_data *sdata,
1641                                      const u8 *wmm_param, size_t wmm_param_len)
1642 {
1643         struct ieee80211_tx_queue_params params;
1644         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1645         size_t left;
1646         int count;
1647         const u8 *pos;
1648         u8 uapsd_queues = 0;
1649
1650         if (!local->ops->conf_tx)
1651                 return false;
1652
1653         if (local->hw.queues < IEEE80211_NUM_ACS)
1654                 return false;
1655
1656         if (!wmm_param)
1657                 return false;
1658
1659         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1660                 return false;
1661
1662         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1663                 uapsd_queues = ifmgd->uapsd_queues;
1664
1665         count = wmm_param[6] & 0x0f;
1666         if (count == ifmgd->wmm_last_param_set)
1667                 return false;
1668         ifmgd->wmm_last_param_set = count;
1669
1670         pos = wmm_param + 8;
1671         left = wmm_param_len - 8;
1672
1673         memset(&params, 0, sizeof(params));
1674
1675         sdata->wmm_acm = 0;
1676         for (; left >= 4; left -= 4, pos += 4) {
1677                 int aci = (pos[0] >> 5) & 0x03;
1678                 int acm = (pos[0] >> 4) & 0x01;
1679                 bool uapsd = false;
1680                 int queue;
1681
1682                 switch (aci) {
1683                 case 1: /* AC_BK */
1684                         queue = 3;
1685                         if (acm)
1686                                 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
1687                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
1688                                 uapsd = true;
1689                         break;
1690                 case 2: /* AC_VI */
1691                         queue = 1;
1692                         if (acm)
1693                                 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
1694                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
1695                                 uapsd = true;
1696                         break;
1697                 case 3: /* AC_VO */
1698                         queue = 0;
1699                         if (acm)
1700                                 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
1701                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
1702                                 uapsd = true;
1703                         break;
1704                 case 0: /* AC_BE */
1705                 default:
1706                         queue = 2;
1707                         if (acm)
1708                                 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
1709                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
1710                                 uapsd = true;
1711                         break;
1712                 }
1713
1714                 params.aifs = pos[0] & 0x0f;
1715                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
1716                 params.cw_min = ecw2cw(pos[1] & 0x0f);
1717                 params.txop = get_unaligned_le16(pos + 2);
1718                 params.acm = acm;
1719                 params.uapsd = uapsd;
1720
1721                 mlme_dbg(sdata,
1722                          "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
1723                          queue, aci, acm,
1724                          params.aifs, params.cw_min, params.cw_max,
1725                          params.txop, params.uapsd);
1726                 sdata->tx_conf[queue] = params;
1727                 if (drv_conf_tx(local, sdata, queue, &params))
1728                         sdata_err(sdata,
1729                                   "failed to set TX queue parameters for queue %d\n",
1730                                   queue);
1731         }
1732
1733         /* enable WMM or activate new settings */
1734         sdata->vif.bss_conf.qos = true;
1735         return true;
1736 }
1737
1738 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1739 {
1740         lockdep_assert_held(&sdata->local->mtx);
1741
1742         sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1743         ieee80211_run_deferred_scan(sdata->local);
1744 }
1745
1746 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1747 {
1748         mutex_lock(&sdata->local->mtx);
1749         __ieee80211_stop_poll(sdata);
1750         mutex_unlock(&sdata->local->mtx);
1751 }
1752
1753 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
1754                                            u16 capab, bool erp_valid, u8 erp)
1755 {
1756         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1757         u32 changed = 0;
1758         bool use_protection;
1759         bool use_short_preamble;
1760         bool use_short_slot;
1761
1762         if (erp_valid) {
1763                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
1764                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
1765         } else {
1766                 use_protection = false;
1767                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
1768         }
1769
1770         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
1771         if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1772                 use_short_slot = true;
1773
1774         if (use_protection != bss_conf->use_cts_prot) {
1775                 bss_conf->use_cts_prot = use_protection;
1776                 changed |= BSS_CHANGED_ERP_CTS_PROT;
1777         }
1778
1779         if (use_short_preamble != bss_conf->use_short_preamble) {
1780                 bss_conf->use_short_preamble = use_short_preamble;
1781                 changed |= BSS_CHANGED_ERP_PREAMBLE;
1782         }
1783
1784         if (use_short_slot != bss_conf->use_short_slot) {
1785                 bss_conf->use_short_slot = use_short_slot;
1786                 changed |= BSS_CHANGED_ERP_SLOT;
1787         }
1788
1789         return changed;
1790 }
1791
1792 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1793                                      struct cfg80211_bss *cbss,
1794                                      u32 bss_info_changed)
1795 {
1796         struct ieee80211_bss *bss = (void *)cbss->priv;
1797         struct ieee80211_local *local = sdata->local;
1798         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1799
1800         bss_info_changed |= BSS_CHANGED_ASSOC;
1801         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1802                 bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1803
1804         sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1805                 beacon_loss_count * bss_conf->beacon_int));
1806
1807         sdata->u.mgd.associated = cbss;
1808         memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1809
1810         sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
1811
1812         if (sdata->vif.p2p) {
1813                 const struct cfg80211_bss_ies *ies;
1814
1815                 rcu_read_lock();
1816                 ies = rcu_dereference(cbss->ies);
1817                 if (ies) {
1818                         int ret;
1819
1820                         ret = cfg80211_get_p2p_attr(
1821                                         ies->data, ies->len,
1822                                         IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
1823                                         (u8 *) &bss_conf->p2p_noa_attr,
1824                                         sizeof(bss_conf->p2p_noa_attr));
1825                         if (ret >= 2) {
1826                                 sdata->u.mgd.p2p_noa_index =
1827                                         bss_conf->p2p_noa_attr.index;
1828                                 bss_info_changed |= BSS_CHANGED_P2P_PS;
1829                         }
1830                 }
1831                 rcu_read_unlock();
1832         }
1833
1834         /* just to be sure */
1835         ieee80211_stop_poll(sdata);
1836
1837         ieee80211_led_assoc(local, 1);
1838
1839         if (sdata->u.mgd.have_beacon) {
1840                 /*
1841                  * If the AP is buggy we may get here with no DTIM period
1842                  * known, so assume it's 1 which is the only safe assumption
1843                  * in that case, although if the TIM IE is broken powersave
1844                  * probably just won't work at all.
1845                  */
1846                 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1847                 bss_conf->beacon_rate = bss->beacon_rate;
1848                 bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1849         } else {
1850                 bss_conf->beacon_rate = NULL;
1851                 bss_conf->dtim_period = 0;
1852         }
1853
1854         bss_conf->assoc = 1;
1855
1856         /* Tell the driver to monitor connection quality (if supported) */
1857         if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1858             bss_conf->cqm_rssi_thold)
1859                 bss_info_changed |= BSS_CHANGED_CQM;
1860
1861         /* Enable ARP filtering */
1862         if (bss_conf->arp_addr_cnt)
1863                 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
1864
1865         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1866
1867         mutex_lock(&local->iflist_mtx);
1868         ieee80211_recalc_ps(local, -1);
1869         mutex_unlock(&local->iflist_mtx);
1870
1871         ieee80211_recalc_smps(sdata);
1872         ieee80211_recalc_ps_vif(sdata);
1873
1874         netif_carrier_on(sdata->dev);
1875 }
1876
1877 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1878                                    u16 stype, u16 reason, bool tx,
1879                                    u8 *frame_buf)
1880 {
1881         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1882         struct ieee80211_local *local = sdata->local;
1883         u32 changed = 0;
1884
1885         sdata_assert_lock(sdata);
1886
1887         if (WARN_ON_ONCE(tx && !frame_buf))
1888                 return;
1889
1890         if (WARN_ON(!ifmgd->associated))
1891                 return;
1892
1893         ieee80211_stop_poll(sdata);
1894
1895         ifmgd->associated = NULL;
1896         netif_carrier_off(sdata->dev);
1897
1898         /*
1899          * if we want to get out of ps before disassoc (why?) we have
1900          * to do it before sending disassoc, as otherwise the null-packet
1901          * won't be valid.
1902          */
1903         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1904                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1905                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1906         }
1907         local->ps_sdata = NULL;
1908
1909         /* disable per-vif ps */
1910         ieee80211_recalc_ps_vif(sdata);
1911
1912         /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
1913         if (tx)
1914                 ieee80211_flush_queues(local, sdata);
1915
1916         /* deauthenticate/disassociate now */
1917         if (tx || frame_buf)
1918                 ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
1919                                                reason, tx, frame_buf);
1920
1921         /* flush out frame */
1922         if (tx)
1923                 ieee80211_flush_queues(local, sdata);
1924
1925         /* clear bssid only after building the needed mgmt frames */
1926         memset(ifmgd->bssid, 0, ETH_ALEN);
1927
1928         /* remove AP and TDLS peers */
1929         sta_info_flush(sdata);
1930
1931         /* finally reset all BSS / config parameters */
1932         changed |= ieee80211_reset_erp_info(sdata);
1933
1934         ieee80211_led_assoc(local, 0);
1935         changed |= BSS_CHANGED_ASSOC;
1936         sdata->vif.bss_conf.assoc = false;
1937
1938         ifmgd->p2p_noa_index = -1;
1939         memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
1940                sizeof(sdata->vif.bss_conf.p2p_noa_attr));
1941
1942         /* on the next assoc, re-program HT/VHT parameters */
1943         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
1944         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
1945         memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
1946         memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
1947
1948         sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
1949
1950         del_timer_sync(&local->dynamic_ps_timer);
1951         cancel_work_sync(&local->dynamic_ps_enable_work);
1952
1953         /* Disable ARP filtering */
1954         if (sdata->vif.bss_conf.arp_addr_cnt)
1955                 changed |= BSS_CHANGED_ARP_FILTER;
1956
1957         sdata->vif.bss_conf.qos = false;
1958         changed |= BSS_CHANGED_QOS;
1959
1960         /* The BSSID (not really interesting) and HT changed */
1961         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
1962         ieee80211_bss_info_change_notify(sdata, changed);
1963
1964         /* disassociated - set to defaults now */
1965         ieee80211_set_wmm_default(sdata, false);
1966
1967         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
1968         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
1969         del_timer_sync(&sdata->u.mgd.timer);
1970         del_timer_sync(&sdata->u.mgd.chswitch_timer);
1971
1972         sdata->vif.bss_conf.dtim_period = 0;
1973         sdata->vif.bss_conf.beacon_rate = NULL;
1974
1975         ifmgd->have_beacon = false;
1976
1977         ifmgd->flags = 0;
1978         mutex_lock(&local->mtx);
1979         ieee80211_vif_release_channel(sdata);
1980
1981         sdata->vif.csa_active = false;
1982         if (sdata->csa_block_tx) {
1983                 ieee80211_wake_vif_queues(local, sdata,
1984                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1985                 sdata->csa_block_tx = false;
1986         }
1987         mutex_unlock(&local->mtx);
1988
1989         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
1990 }
1991
1992 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
1993                              struct ieee80211_hdr *hdr)
1994 {
1995         /*
1996          * We can postpone the mgd.timer whenever receiving unicast frames
1997          * from AP because we know that the connection is working both ways
1998          * at that time. But multicast frames (and hence also beacons) must
1999          * be ignored here, because we need to trigger the timer during
2000          * data idle periods for sending the periodic probe request to the
2001          * AP we're connected to.
2002          */
2003         if (is_multicast_ether_addr(hdr->addr1))
2004                 return;
2005
2006         ieee80211_sta_reset_conn_monitor(sdata);
2007 }
2008
2009 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
2010 {
2011         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2012         struct ieee80211_local *local = sdata->local;
2013
2014         mutex_lock(&local->mtx);
2015         if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
2016                 goto out;
2017
2018         __ieee80211_stop_poll(sdata);
2019
2020         mutex_lock(&local->iflist_mtx);
2021         ieee80211_recalc_ps(local, -1);
2022         mutex_unlock(&local->iflist_mtx);
2023
2024         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
2025                 goto out;
2026
2027         /*
2028          * We've received a probe response, but are not sure whether
2029          * we have or will be receiving any beacons or data, so let's
2030          * schedule the timers again, just in case.
2031          */
2032         ieee80211_sta_reset_beacon_monitor(sdata);
2033
2034         mod_timer(&ifmgd->conn_mon_timer,
2035                   round_jiffies_up(jiffies +
2036                                    IEEE80211_CONNECTION_IDLE_TIME));
2037 out:
2038         mutex_unlock(&local->mtx);
2039 }
2040
2041 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2042                              struct ieee80211_hdr *hdr, bool ack)
2043 {
2044         if (!ieee80211_is_data(hdr->frame_control))
2045             return;
2046
2047         if (ieee80211_is_nullfunc(hdr->frame_control) &&
2048             sdata->u.mgd.probe_send_count > 0) {
2049                 if (ack)
2050                         ieee80211_sta_reset_conn_monitor(sdata);
2051                 else
2052                         sdata->u.mgd.nullfunc_failed = true;
2053                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2054                 return;
2055         }
2056
2057         if (ack)
2058                 ieee80211_sta_reset_conn_monitor(sdata);
2059 }
2060
2061 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
2062 {
2063         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2064         const u8 *ssid;
2065         u8 *dst = ifmgd->associated->bssid;
2066         u8 unicast_limit = max(1, max_probe_tries - 3);
2067
2068         /*
2069          * Try sending broadcast probe requests for the last three
2070          * probe requests after the first ones failed since some
2071          * buggy APs only support broadcast probe requests.
2072          */
2073         if (ifmgd->probe_send_count >= unicast_limit)
2074                 dst = NULL;
2075
2076         /*
2077          * When the hardware reports an accurate Tx ACK status, it's
2078          * better to send a nullfunc frame instead of a probe request,
2079          * as it will kick us off the AP quickly if we aren't associated
2080          * anymore. The timeout will be reset if the frame is ACKed by
2081          * the AP.
2082          */
2083         ifmgd->probe_send_count++;
2084
2085         if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
2086                 ifmgd->nullfunc_failed = false;
2087                 ieee80211_send_nullfunc(sdata->local, sdata, 0);
2088         } else {
2089                 int ssid_len;
2090
2091                 rcu_read_lock();
2092                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2093                 if (WARN_ON_ONCE(ssid == NULL))
2094                         ssid_len = 0;
2095                 else
2096                         ssid_len = ssid[1];
2097
2098                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
2099                                          0, (u32) -1, true, 0,
2100                                          ifmgd->associated->channel, false);
2101                 rcu_read_unlock();
2102         }
2103
2104         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2105         run_again(sdata, ifmgd->probe_timeout);
2106         if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2107                 ieee80211_flush_queues(sdata->local, sdata);
2108 }
2109
2110 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
2111                                    bool beacon)
2112 {
2113         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2114         bool already = false;
2115
2116         if (!ieee80211_sdata_running(sdata))
2117                 return;
2118
2119         sdata_lock(sdata);
2120
2121         if (!ifmgd->associated)
2122                 goto out;
2123
2124         mutex_lock(&sdata->local->mtx);
2125
2126         if (sdata->local->tmp_channel || sdata->local->scanning) {
2127                 mutex_unlock(&sdata->local->mtx);
2128                 goto out;
2129         }
2130
2131         if (beacon) {
2132                 mlme_dbg_ratelimited(sdata,
2133                                      "detected beacon loss from AP (missed %d beacons) - probing\n",
2134                                      beacon_loss_count);
2135
2136                 ieee80211_cqm_rssi_notify(&sdata->vif,
2137                                           NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
2138                                           GFP_KERNEL);
2139         }
2140
2141         /*
2142          * The driver/our work has already reported this event or the
2143          * connection monitoring has kicked in and we have already sent
2144          * a probe request. Or maybe the AP died and the driver keeps
2145          * reporting until we disassociate...
2146          *
2147          * In either case we have to ignore the current call to this
2148          * function (except for setting the correct probe reason bit)
2149          * because otherwise we would reset the timer every time and
2150          * never check whether we received a probe response!
2151          */
2152         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
2153                 already = true;
2154
2155         ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
2156
2157         mutex_unlock(&sdata->local->mtx);
2158
2159         if (already)
2160                 goto out;
2161
2162         mutex_lock(&sdata->local->iflist_mtx);
2163         ieee80211_recalc_ps(sdata->local, -1);
2164         mutex_unlock(&sdata->local->iflist_mtx);
2165
2166         ifmgd->probe_send_count = 0;
2167         ieee80211_mgd_probe_ap_send(sdata);
2168  out:
2169         sdata_unlock(sdata);
2170 }
2171
2172 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
2173                                           struct ieee80211_vif *vif)
2174 {
2175         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2176         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2177         struct cfg80211_bss *cbss;
2178         struct sk_buff *skb;
2179         const u8 *ssid;
2180         int ssid_len;
2181
2182         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2183                 return NULL;
2184
2185         sdata_assert_lock(sdata);
2186
2187         if (ifmgd->associated)
2188                 cbss = ifmgd->associated;
2189         else if (ifmgd->auth_data)
2190                 cbss = ifmgd->auth_data->bss;
2191         else if (ifmgd->assoc_data)
2192                 cbss = ifmgd->assoc_data->bss;
2193         else
2194                 return NULL;
2195
2196         rcu_read_lock();
2197         ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2198         if (WARN_ON_ONCE(ssid == NULL))
2199                 ssid_len = 0;
2200         else
2201                 ssid_len = ssid[1];
2202
2203         skb = ieee80211_build_probe_req(sdata, cbss->bssid,
2204                                         (u32) -1, cbss->channel,
2205                                         ssid + 2, ssid_len,
2206                                         NULL, 0, true);
2207         rcu_read_unlock();
2208
2209         return skb;
2210 }
2211 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
2212
2213 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2214 {
2215         struct ieee80211_local *local = sdata->local;
2216         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2217         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2218
2219         sdata_lock(sdata);
2220         if (!ifmgd->associated) {
2221                 sdata_unlock(sdata);
2222                 return;
2223         }
2224
2225         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
2226                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2227                                true, frame_buf);
2228         mutex_lock(&local->mtx);
2229         sdata->vif.csa_active = false;
2230         if (sdata->csa_block_tx) {
2231                 ieee80211_wake_vif_queues(local, sdata,
2232                                           IEEE80211_QUEUE_STOP_REASON_CSA);
2233                 sdata->csa_block_tx = false;
2234         }
2235         mutex_unlock(&local->mtx);
2236
2237         cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
2238                               IEEE80211_DEAUTH_FRAME_LEN);
2239         sdata_unlock(sdata);
2240 }
2241
2242 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
2243 {
2244         struct ieee80211_sub_if_data *sdata =
2245                 container_of(work, struct ieee80211_sub_if_data,
2246                              u.mgd.beacon_connection_loss_work);
2247         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2248         struct sta_info *sta;
2249
2250         if (ifmgd->associated) {
2251                 rcu_read_lock();
2252                 sta = sta_info_get(sdata, ifmgd->bssid);
2253                 if (sta)
2254                         sta->beacon_loss_count++;
2255                 rcu_read_unlock();
2256         }
2257
2258         if (ifmgd->connection_loss) {
2259                 sdata_info(sdata, "Connection to AP %pM lost\n",
2260                            ifmgd->bssid);
2261                 __ieee80211_disconnect(sdata);
2262         } else {
2263                 ieee80211_mgd_probe_ap(sdata, true);
2264         }
2265 }
2266
2267 static void ieee80211_csa_connection_drop_work(struct work_struct *work)
2268 {
2269         struct ieee80211_sub_if_data *sdata =
2270                 container_of(work, struct ieee80211_sub_if_data,
2271                              u.mgd.csa_connection_drop_work);
2272
2273         __ieee80211_disconnect(sdata);
2274 }
2275
2276 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
2277 {
2278         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2279         struct ieee80211_hw *hw = &sdata->local->hw;
2280
2281         trace_api_beacon_loss(sdata);
2282
2283         sdata->u.mgd.connection_loss = false;
2284         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2285 }
2286 EXPORT_SYMBOL(ieee80211_beacon_loss);
2287
2288 void ieee80211_connection_loss(struct ieee80211_vif *vif)
2289 {
2290         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2291         struct ieee80211_hw *hw = &sdata->local->hw;
2292
2293         trace_api_connection_loss(sdata);
2294
2295         sdata->u.mgd.connection_loss = true;
2296         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2297 }
2298 EXPORT_SYMBOL(ieee80211_connection_loss);
2299
2300
2301 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
2302                                         bool assoc)
2303 {
2304         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2305
2306         sdata_assert_lock(sdata);
2307
2308         if (!assoc) {
2309                 sta_info_destroy_addr(sdata, auth_data->bss->bssid);
2310
2311                 memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2312                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2313                 sdata->u.mgd.flags = 0;
2314                 mutex_lock(&sdata->local->mtx);
2315                 ieee80211_vif_release_channel(sdata);
2316                 mutex_unlock(&sdata->local->mtx);
2317         }
2318
2319         cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
2320         kfree(auth_data);
2321         sdata->u.mgd.auth_data = NULL;
2322 }
2323
2324 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
2325                                      struct ieee80211_mgmt *mgmt, size_t len)
2326 {
2327         struct ieee80211_local *local = sdata->local;
2328         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2329         u8 *pos;
2330         struct ieee802_11_elems elems;
2331         u32 tx_flags = 0;
2332
2333         pos = mgmt->u.auth.variable;
2334         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2335         if (!elems.challenge)
2336                 return;
2337         auth_data->expected_transaction = 4;
2338         drv_mgd_prepare_tx(sdata->local, sdata);
2339         if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2340                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2341                            IEEE80211_TX_INTFL_MLME_CONN_TX;
2342         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
2343                             elems.challenge - 2, elems.challenge_len + 2,
2344                             auth_data->bss->bssid, auth_data->bss->bssid,
2345                             auth_data->key, auth_data->key_len,
2346                             auth_data->key_idx, tx_flags);
2347 }
2348
2349 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
2350                                    struct ieee80211_mgmt *mgmt, size_t len)
2351 {
2352         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2353         u8 bssid[ETH_ALEN];
2354         u16 auth_alg, auth_transaction, status_code;
2355         struct sta_info *sta;
2356
2357         sdata_assert_lock(sdata);
2358
2359         if (len < 24 + 6)
2360                 return;
2361
2362         if (!ifmgd->auth_data || ifmgd->auth_data->done)
2363                 return;
2364
2365         memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
2366
2367         if (!ether_addr_equal(bssid, mgmt->bssid))
2368                 return;
2369
2370         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
2371         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
2372         status_code = le16_to_cpu(mgmt->u.auth.status_code);
2373
2374         if (auth_alg != ifmgd->auth_data->algorithm ||
2375             auth_transaction != ifmgd->auth_data->expected_transaction) {
2376                 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
2377                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
2378                            auth_transaction,
2379                            ifmgd->auth_data->expected_transaction);
2380                 return;
2381         }
2382
2383         if (status_code != WLAN_STATUS_SUCCESS) {
2384                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
2385                            mgmt->sa, status_code);
2386                 ieee80211_destroy_auth_data(sdata, false);
2387                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2388                 return;
2389         }
2390
2391         switch (ifmgd->auth_data->algorithm) {
2392         case WLAN_AUTH_OPEN:
2393         case WLAN_AUTH_LEAP:
2394         case WLAN_AUTH_FT:
2395         case WLAN_AUTH_SAE:
2396                 break;
2397         case WLAN_AUTH_SHARED_KEY:
2398                 if (ifmgd->auth_data->expected_transaction != 4) {
2399                         ieee80211_auth_challenge(sdata, mgmt, len);
2400                         /* need another frame */
2401                         return;
2402                 }
2403                 break;
2404         default:
2405                 WARN_ONCE(1, "invalid auth alg %d",
2406                           ifmgd->auth_data->algorithm);
2407                 return;
2408         }
2409
2410         sdata_info(sdata, "authenticated\n");
2411         ifmgd->auth_data->done = true;
2412         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2413         ifmgd->auth_data->timeout_started = true;
2414         run_again(sdata, ifmgd->auth_data->timeout);
2415
2416         if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
2417             ifmgd->auth_data->expected_transaction != 2) {
2418                 /*
2419                  * Report auth frame to user space for processing since another
2420                  * round of Authentication frames is still needed.
2421                  */
2422                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2423                 return;
2424         }
2425
2426         /* move station state to auth */
2427         mutex_lock(&sdata->local->sta_mtx);
2428         sta = sta_info_get(sdata, bssid);
2429         if (!sta) {
2430                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2431                 goto out_err;
2432         }
2433         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
2434                 sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2435                 goto out_err;
2436         }
2437         mutex_unlock(&sdata->local->sta_mtx);
2438
2439         cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2440         return;
2441  out_err:
2442         mutex_unlock(&sdata->local->sta_mtx);
2443         /* ignore frame -- wait for timeout */
2444 }
2445
2446 #define case_WLAN(type) \
2447         case WLAN_REASON_##type: return #type
2448
2449 static const char *ieee80211_get_reason_code_string(u16 reason_code)
2450 {
2451         switch (reason_code) {
2452         case_WLAN(UNSPECIFIED);
2453         case_WLAN(PREV_AUTH_NOT_VALID);
2454         case_WLAN(DEAUTH_LEAVING);
2455         case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
2456         case_WLAN(DISASSOC_AP_BUSY);
2457         case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
2458         case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
2459         case_WLAN(DISASSOC_STA_HAS_LEFT);
2460         case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
2461         case_WLAN(DISASSOC_BAD_POWER);
2462         case_WLAN(DISASSOC_BAD_SUPP_CHAN);
2463         case_WLAN(INVALID_IE);
2464         case_WLAN(MIC_FAILURE);
2465         case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
2466         case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
2467         case_WLAN(IE_DIFFERENT);
2468         case_WLAN(INVALID_GROUP_CIPHER);
2469         case_WLAN(INVALID_PAIRWISE_CIPHER);
2470         case_WLAN(INVALID_AKMP);
2471         case_WLAN(UNSUPP_RSN_VERSION);
2472         case_WLAN(INVALID_RSN_IE_CAP);
2473         case_WLAN(IEEE8021X_FAILED);
2474         case_WLAN(CIPHER_SUITE_REJECTED);
2475         case_WLAN(DISASSOC_UNSPECIFIED_QOS);
2476         case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
2477         case_WLAN(DISASSOC_LOW_ACK);
2478         case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
2479         case_WLAN(QSTA_LEAVE_QBSS);
2480         case_WLAN(QSTA_NOT_USE);
2481         case_WLAN(QSTA_REQUIRE_SETUP);
2482         case_WLAN(QSTA_TIMEOUT);
2483         case_WLAN(QSTA_CIPHER_NOT_SUPP);
2484         case_WLAN(MESH_PEER_CANCELED);
2485         case_WLAN(MESH_MAX_PEERS);
2486         case_WLAN(MESH_CONFIG);
2487         case_WLAN(MESH_CLOSE);
2488         case_WLAN(MESH_MAX_RETRIES);
2489         case_WLAN(MESH_CONFIRM_TIMEOUT);
2490         case_WLAN(MESH_INVALID_GTK);
2491         case_WLAN(MESH_INCONSISTENT_PARAM);
2492         case_WLAN(MESH_INVALID_SECURITY);
2493         case_WLAN(MESH_PATH_ERROR);
2494         case_WLAN(MESH_PATH_NOFORWARD);
2495         case_WLAN(MESH_PATH_DEST_UNREACHABLE);
2496         case_WLAN(MAC_EXISTS_IN_MBSS);
2497         case_WLAN(MESH_CHAN_REGULATORY);
2498         case_WLAN(MESH_CHAN);
2499         default: return "<unknown>";
2500         }
2501 }
2502
2503 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
2504                                      struct ieee80211_mgmt *mgmt, size_t len)
2505 {
2506         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2507         const u8 *bssid = NULL;
2508         u16 reason_code;
2509
2510         sdata_assert_lock(sdata);
2511
2512         if (len < 24 + 2)
2513                 return;
2514
2515         if (!ifmgd->associated ||
2516             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2517                 return;
2518
2519         bssid = ifmgd->associated->bssid;
2520
2521         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2522
2523         sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
2524                    bssid, reason_code, ieee80211_get_reason_code_string(reason_code));
2525
2526         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2527
2528         cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2529 }
2530
2531
2532 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
2533                                        struct ieee80211_mgmt *mgmt, size_t len)
2534 {
2535         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2536         u16 reason_code;
2537
2538         sdata_assert_lock(sdata);
2539
2540         if (len < 24 + 2)
2541                 return;
2542
2543         if (!ifmgd->associated ||
2544             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2545                 return;
2546
2547         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
2548
2549         sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
2550                    mgmt->sa, reason_code);
2551
2552         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2553
2554         cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2555 }
2556
2557 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
2558                                 u8 *supp_rates, unsigned int supp_rates_len,
2559                                 u32 *rates, u32 *basic_rates,
2560                                 bool *have_higher_than_11mbit,
2561                                 int *min_rate, int *min_rate_index,
2562                                 int shift, u32 rate_flags)
2563 {
2564         int i, j;
2565
2566         for (i = 0; i < supp_rates_len; i++) {
2567                 int rate = supp_rates[i] & 0x7f;
2568                 bool is_basic = !!(supp_rates[i] & 0x80);
2569
2570                 if ((rate * 5 * (1 << shift)) > 110)
2571                         *have_higher_than_11mbit = true;
2572
2573                 /*
2574                  * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
2575                  * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
2576                  *
2577                  * Note: Even through the membership selector and the basic
2578                  *       rate flag share the same bit, they are not exactly
2579                  *       the same.
2580                  */
2581                 if (!!(supp_rates[i] & 0x80) &&
2582                     (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
2583                         continue;
2584
2585                 for (j = 0; j < sband->n_bitrates; j++) {
2586                         struct ieee80211_rate *br;
2587                         int brate;
2588
2589                         br = &sband->bitrates[j];
2590                         if ((rate_flags & br->flags) != rate_flags)
2591                                 continue;
2592
2593                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
2594                         if (brate == rate) {
2595                                 *rates |= BIT(j);
2596                                 if (is_basic)
2597                                         *basic_rates |= BIT(j);
2598                                 if ((rate * 5) < *min_rate) {
2599                                         *min_rate = rate * 5;
2600                                         *min_rate_index = j;
2601                                 }
2602                                 break;
2603                         }
2604                 }
2605         }
2606 }
2607
2608 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2609                                          bool assoc)
2610 {
2611         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2612
2613         sdata_assert_lock(sdata);
2614
2615         if (!assoc) {
2616                 sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
2617
2618                 memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2619                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2620                 sdata->u.mgd.flags = 0;
2621                 mutex_lock(&sdata->local->mtx);
2622                 ieee80211_vif_release_channel(sdata);
2623                 mutex_unlock(&sdata->local->mtx);
2624         }
2625
2626         kfree(assoc_data);
2627         sdata->u.mgd.assoc_data = NULL;
2628 }
2629
2630 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
2631                                     struct cfg80211_bss *cbss,
2632                                     struct ieee80211_mgmt *mgmt, size_t len)
2633 {
2634         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2635         struct ieee80211_local *local = sdata->local;
2636         struct ieee80211_supported_band *sband;
2637         struct sta_info *sta;
2638         u8 *pos;
2639         u16 capab_info, aid;
2640         struct ieee802_11_elems elems;
2641         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2642         const struct cfg80211_bss_ies *bss_ies = NULL;
2643         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2644         u32 changed = 0;
2645         int err;
2646         bool ret;
2647
2648         /* AssocResp and ReassocResp have identical structure */
2649
2650         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2651         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2652
2653         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
2654                 sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
2655                            aid);
2656         aid &= ~(BIT(15) | BIT(14));
2657
2658         ifmgd->broken_ap = false;
2659
2660         if (aid == 0 || aid > IEEE80211_MAX_AID) {
2661                 sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
2662                            aid);
2663                 aid = 0;
2664                 ifmgd->broken_ap = true;
2665         }
2666
2667         pos = mgmt->u.assoc_resp.variable;
2668         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2669
2670         if (!elems.supp_rates) {
2671                 sdata_info(sdata, "no SuppRates element in AssocResp\n");
2672                 return false;
2673         }
2674
2675         ifmgd->aid = aid;
2676
2677         /*
2678          * Some APs are erroneously not including some information in their
2679          * (re)association response frames. Try to recover by using the data
2680          * from the beacon or probe response. This seems to afflict mobile
2681          * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
2682          * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
2683          */
2684         if ((assoc_data->wmm && !elems.wmm_param) ||
2685             (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2686              (!elems.ht_cap_elem || !elems.ht_operation)) ||
2687             (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2688              (!elems.vht_cap_elem || !elems.vht_operation))) {
2689                 const struct cfg80211_bss_ies *ies;
2690                 struct ieee802_11_elems bss_elems;
2691
2692                 rcu_read_lock();
2693                 ies = rcu_dereference(cbss->ies);
2694                 if (ies)
2695                         bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
2696                                           GFP_ATOMIC);
2697                 rcu_read_unlock();
2698                 if (!bss_ies)
2699                         return false;
2700
2701                 ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
2702                                        false, &bss_elems);
2703                 if (assoc_data->wmm &&
2704                     !elems.wmm_param && bss_elems.wmm_param) {
2705                         elems.wmm_param = bss_elems.wmm_param;
2706                         sdata_info(sdata,
2707                                    "AP bug: WMM param missing from AssocResp\n");
2708                 }
2709
2710                 /*
2711                  * Also check if we requested HT/VHT, otherwise the AP doesn't
2712                  * have to include the IEs in the (re)association response.
2713                  */
2714                 if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
2715                     !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2716                         elems.ht_cap_elem = bss_elems.ht_cap_elem;
2717                         sdata_info(sdata,
2718                                    "AP bug: HT capability missing from AssocResp\n");
2719                 }
2720                 if (!elems.ht_operation && bss_elems.ht_operation &&
2721                     !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2722                         elems.ht_operation = bss_elems.ht_operation;
2723                         sdata_info(sdata,
2724                                    "AP bug: HT operation missing from AssocResp\n");
2725                 }
2726                 if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
2727                     !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2728                         elems.vht_cap_elem = bss_elems.vht_cap_elem;
2729                         sdata_info(sdata,
2730                                    "AP bug: VHT capa missing from AssocResp\n");
2731                 }
2732                 if (!elems.vht_operation && bss_elems.vht_operation &&
2733                     !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2734                         elems.vht_operation = bss_elems.vht_operation;
2735                         sdata_info(sdata,
2736                                    "AP bug: VHT operation missing from AssocResp\n");
2737                 }
2738         }
2739
2740         /*
2741          * We previously checked these in the beacon/probe response, so
2742          * they should be present here. This is just a safety net.
2743          */
2744         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2745             (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
2746                 sdata_info(sdata,
2747                            "HT AP is missing WMM params or HT capability/operation\n");
2748                 ret = false;
2749                 goto out;
2750         }
2751
2752         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2753             (!elems.vht_cap_elem || !elems.vht_operation)) {
2754                 sdata_info(sdata,
2755                            "VHT AP is missing VHT capability/operation\n");
2756                 ret = false;
2757                 goto out;
2758         }
2759
2760         mutex_lock(&sdata->local->sta_mtx);
2761         /*
2762          * station info was already allocated and inserted before
2763          * the association and should be available to us
2764          */
2765         sta = sta_info_get(sdata, cbss->bssid);
2766         if (WARN_ON(!sta)) {
2767                 mutex_unlock(&sdata->local->sta_mtx);
2768                 ret = false;
2769                 goto out;
2770         }
2771
2772         sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2773
2774         /* Set up internal HT/VHT capabilities */
2775         if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
2776                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2777                                                   elems.ht_cap_elem, sta);
2778
2779         if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
2780                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2781                                                     elems.vht_cap_elem, sta);
2782
2783         /*
2784          * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
2785          * in their association response, so ignore that data for our own
2786          * configuration. If it changed since the last beacon, we'll get the
2787          * next beacon and update then.
2788          */
2789
2790         /*
2791          * If an operating mode notification IE is present, override the
2792          * NSS calculation (that would be done in rate_control_rate_init())
2793          * and use the # of streams from that element.
2794          */
2795         if (elems.opmode_notif &&
2796             !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
2797                 u8 nss;
2798
2799                 nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
2800                 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
2801                 nss += 1;
2802                 sta->sta.rx_nss = nss;
2803         }
2804
2805         rate_control_rate_init(sta);
2806
2807         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
2808                 set_sta_flag(sta, WLAN_STA_MFP);
2809
2810         sta->sta.wme = elems.wmm_param;
2811
2812         err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
2813         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
2814                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
2815         if (err) {
2816                 sdata_info(sdata,
2817                            "failed to move station %pM to desired state\n",
2818                            sta->sta.addr);
2819                 WARN_ON(__sta_info_destroy(sta));
2820                 mutex_unlock(&sdata->local->sta_mtx);
2821                 ret = false;
2822                 goto out;
2823         }
2824
2825         mutex_unlock(&sdata->local->sta_mtx);
2826
2827         /*
2828          * Always handle WMM once after association regardless
2829          * of the first value the AP uses. Setting -1 here has
2830          * that effect because the AP values is an unsigned
2831          * 4-bit value.
2832          */
2833         ifmgd->wmm_last_param_set = -1;
2834
2835         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) && elems.wmm_param)
2836                 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
2837                                          elems.wmm_param_len);
2838         else
2839                 ieee80211_set_wmm_default(sdata, false);
2840         changed |= BSS_CHANGED_QOS;
2841
2842         /* set AID and assoc capability,
2843          * ieee80211_set_associated() will tell the driver */
2844         bss_conf->aid = aid;
2845         bss_conf->assoc_capability = capab_info;
2846         ieee80211_set_associated(sdata, cbss, changed);
2847
2848         /*
2849          * If we're using 4-addr mode, let the AP know that we're
2850          * doing so, so that it can create the STA VLAN on its side
2851          */
2852         if (ifmgd->use_4addr)
2853                 ieee80211_send_4addr_nullfunc(local, sdata);
2854
2855         /*
2856          * Start timer to probe the connection to the AP now.
2857          * Also start the timer that will detect beacon loss.
2858          */
2859         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
2860         ieee80211_sta_reset_beacon_monitor(sdata);
2861
2862         ret = true;
2863  out:
2864         kfree(bss_ies);
2865         return ret;
2866 }
2867
2868 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
2869                                          struct ieee80211_mgmt *mgmt,
2870                                          size_t len)
2871 {
2872         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2873         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2874         u16 capab_info, status_code, aid;
2875         struct ieee802_11_elems elems;
2876         int ac, uapsd_queues = -1;
2877         u8 *pos;
2878         bool reassoc;
2879         struct cfg80211_bss *bss;
2880
2881         sdata_assert_lock(sdata);
2882
2883         if (!assoc_data)
2884                 return;
2885         if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
2886                 return;
2887
2888         /*
2889          * AssocResp and ReassocResp have identical structure, so process both
2890          * of them in this function.
2891          */
2892
2893         if (len < 24 + 6)
2894                 return;
2895
2896         reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
2897         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2898         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
2899         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2900
2901         sdata_info(sdata,
2902                    "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
2903                    reassoc ? "Rea" : "A", mgmt->sa,
2904                    capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
2905
2906         pos = mgmt->u.assoc_resp.variable;
2907         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2908
2909         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
2910             elems.timeout_int &&
2911             elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
2912                 u32 tu, ms;
2913                 tu = le32_to_cpu(elems.timeout_int->value);
2914                 ms = tu * 1024 / 1000;
2915                 sdata_info(sdata,
2916                            "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
2917                            mgmt->sa, tu, ms);
2918                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
2919                 assoc_data->timeout_started = true;
2920                 if (ms > IEEE80211_ASSOC_TIMEOUT)
2921                         run_again(sdata, assoc_data->timeout);
2922                 return;
2923         }
2924
2925         bss = assoc_data->bss;
2926
2927         if (status_code != WLAN_STATUS_SUCCESS) {
2928                 sdata_info(sdata, "%pM denied association (code=%d)\n",
2929                            mgmt->sa, status_code);
2930                 ieee80211_destroy_assoc_data(sdata, false);
2931         } else {
2932                 if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
2933                         /* oops -- internal error -- send timeout for now */
2934                         ieee80211_destroy_assoc_data(sdata, false);
2935                         cfg80211_assoc_timeout(sdata->dev, bss);
2936                         return;
2937                 }
2938                 sdata_info(sdata, "associated\n");
2939
2940                 /*
2941                  * destroy assoc_data afterwards, as otherwise an idle
2942                  * recalc after assoc_data is NULL but before associated
2943                  * is set can cause the interface to go idle
2944                  */
2945                 ieee80211_destroy_assoc_data(sdata, true);
2946
2947                 /* get uapsd queues configuration */
2948                 uapsd_queues = 0;
2949                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2950                         if (sdata->tx_conf[ac].uapsd)
2951                                 uapsd_queues |= BIT(ac);
2952         }
2953
2954         cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues);
2955 }
2956
2957 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2958                                   struct ieee80211_mgmt *mgmt, size_t len,
2959                                   struct ieee80211_rx_status *rx_status,
2960                                   struct ieee802_11_elems *elems)
2961 {
2962         struct ieee80211_local *local = sdata->local;
2963         struct ieee80211_bss *bss;
2964         struct ieee80211_channel *channel;
2965
2966         sdata_assert_lock(sdata);
2967
2968         channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
2969         if (!channel)
2970                 return;
2971
2972         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
2973                                         channel);
2974         if (bss) {
2975                 sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
2976                 ieee80211_rx_bss_put(local, bss);
2977         }
2978 }
2979
2980
2981 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
2982                                          struct sk_buff *skb)
2983 {
2984         struct ieee80211_mgmt *mgmt = (void *)skb->data;
2985         struct ieee80211_if_managed *ifmgd;
2986         struct ieee80211_rx_status *rx_status = (void *) skb->cb;
2987         size_t baselen, len = skb->len;
2988         struct ieee802_11_elems elems;
2989
2990         ifmgd = &sdata->u.mgd;
2991
2992         sdata_assert_lock(sdata);
2993
2994         if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
2995                 return; /* ignore ProbeResp to foreign address */
2996
2997         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
2998         if (baselen > len)
2999                 return;
3000
3001         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
3002                                false, &elems);
3003
3004         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3005
3006         if (ifmgd->associated &&
3007             ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3008                 ieee80211_reset_ap_probe(sdata);
3009
3010         if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
3011             ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
3012                 /* got probe response, continue with auth */
3013                 sdata_info(sdata, "direct probe responded\n");
3014                 ifmgd->auth_data->tries = 0;
3015                 ifmgd->auth_data->timeout = jiffies;
3016                 ifmgd->auth_data->timeout_started = true;
3017                 run_again(sdata, ifmgd->auth_data->timeout);
3018         }
3019 }
3020
3021 /*
3022  * This is the canonical list of information elements we care about,
3023  * the filter code also gives us all changes to the Microsoft OUI
3024  * (00:50:F2) vendor IE which is used for WMM which we need to track,
3025  * as well as the DTPC IE (part of the Cisco OUI) used for signaling
3026  * changes to requested client power.
3027  *
3028  * We implement beacon filtering in software since that means we can
3029  * avoid processing the frame here and in cfg80211, and userspace
3030  * will not be able to tell whether the hardware supports it or not.
3031  *
3032  * XXX: This list needs to be dynamic -- userspace needs to be able to
3033  *      add items it requires. It also needs to be able to tell us to
3034  *      look out for other vendor IEs.
3035  */
3036 static const u64 care_about_ies =
3037         (1ULL << WLAN_EID_COUNTRY) |
3038         (1ULL << WLAN_EID_ERP_INFO) |
3039         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
3040         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
3041         (1ULL << WLAN_EID_HT_CAPABILITY) |
3042         (1ULL << WLAN_EID_HT_OPERATION);
3043
3044 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
3045                                      struct ieee80211_mgmt *mgmt, size_t len,
3046                                      struct ieee80211_rx_status *rx_status)
3047 {
3048         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3049         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3050         size_t baselen;
3051         struct ieee802_11_elems elems;
3052         struct ieee80211_local *local = sdata->local;
3053         struct ieee80211_chanctx_conf *chanctx_conf;
3054         struct ieee80211_channel *chan;
3055         struct sta_info *sta;
3056         u32 changed = 0;
3057         bool erp_valid;
3058         u8 erp_value = 0;
3059         u32 ncrc;
3060         u8 *bssid;
3061         u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
3062
3063         sdata_assert_lock(sdata);
3064
3065         /* Process beacon from the current BSS */
3066         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
3067         if (baselen > len)
3068                 return;
3069
3070         rcu_read_lock();
3071         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3072         if (!chanctx_conf) {
3073                 rcu_read_unlock();
3074                 return;
3075         }
3076
3077         if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
3078                 rcu_read_unlock();
3079                 return;
3080         }
3081         chan = chanctx_conf->def.chan;
3082         rcu_read_unlock();
3083
3084         if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
3085             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
3086                 ieee802_11_parse_elems(mgmt->u.beacon.variable,
3087                                        len - baselen, false, &elems);
3088
3089                 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3090                 if (elems.tim && !elems.parse_error) {
3091                         const struct ieee80211_tim_ie *tim_ie = elems.tim;
3092                         ifmgd->dtim_period = tim_ie->dtim_period;
3093                 }
3094                 ifmgd->have_beacon = true;
3095                 ifmgd->assoc_data->need_beacon = false;
3096                 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
3097                         sdata->vif.bss_conf.sync_tsf =
3098                                 le64_to_cpu(mgmt->u.beacon.timestamp);
3099                         sdata->vif.bss_conf.sync_device_ts =
3100                                 rx_status->device_timestamp;
3101                         if (elems.tim)
3102                                 sdata->vif.bss_conf.sync_dtim_count =
3103                                         elems.tim->dtim_count;
3104                         else
3105                                 sdata->vif.bss_conf.sync_dtim_count = 0;
3106                 }
3107                 /* continue assoc process */
3108                 ifmgd->assoc_data->timeout = jiffies;
3109                 ifmgd->assoc_data->timeout_started = true;
3110                 run_again(sdata, ifmgd->assoc_data->timeout);
3111                 return;
3112         }
3113
3114         if (!ifmgd->associated ||
3115             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3116                 return;
3117         bssid = ifmgd->associated->bssid;
3118
3119         /* Track average RSSI from the Beacon frames of the current AP */
3120         ifmgd->last_beacon_signal = rx_status->signal;
3121         if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
3122                 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3123                 ifmgd->ave_beacon_signal = rx_status->signal * 16;
3124                 ifmgd->last_cqm_event_signal = 0;
3125                 ifmgd->count_beacon_signal = 1;
3126                 ifmgd->last_ave_beacon_signal = 0;
3127         } else {
3128                 ifmgd->ave_beacon_signal =
3129                         (IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
3130                          (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
3131                          ifmgd->ave_beacon_signal) / 16;
3132                 ifmgd->count_beacon_signal++;
3133         }
3134
3135         if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
3136             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3137                 int sig = ifmgd->ave_beacon_signal;
3138                 int last_sig = ifmgd->last_ave_beacon_signal;
3139
3140                 /*
3141                  * if signal crosses either of the boundaries, invoke callback
3142                  * with appropriate parameters
3143                  */
3144                 if (sig > ifmgd->rssi_max_thold &&
3145                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
3146                         ifmgd->last_ave_beacon_signal = sig;
3147                         drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
3148                 } else if (sig < ifmgd->rssi_min_thold &&
3149                            (last_sig >= ifmgd->rssi_max_thold ||
3150                            last_sig == 0)) {
3151                         ifmgd->last_ave_beacon_signal = sig;
3152                         drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
3153                 }
3154         }
3155
3156         if (bss_conf->cqm_rssi_thold &&
3157             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3158             !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3159                 int sig = ifmgd->ave_beacon_signal / 16;
3160                 int last_event = ifmgd->last_cqm_event_signal;
3161                 int thold = bss_conf->cqm_rssi_thold;
3162                 int hyst = bss_conf->cqm_rssi_hyst;
3163                 if (sig < thold &&
3164                     (last_event == 0 || sig < last_event - hyst)) {
3165                         ifmgd->last_cqm_event_signal = sig;
3166                         ieee80211_cqm_rssi_notify(
3167                                 &sdata->vif,
3168                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3169                                 GFP_KERNEL);
3170                 } else if (sig > thold &&
3171                            (last_event == 0 || sig > last_event + hyst)) {
3172                         ifmgd->last_cqm_event_signal = sig;
3173                         ieee80211_cqm_rssi_notify(
3174                                 &sdata->vif,
3175                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3176                                 GFP_KERNEL);
3177                 }
3178         }
3179
3180         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
3181                 mlme_dbg_ratelimited(sdata,
3182                                      "cancelling AP probe due to a received beacon\n");
3183                 ieee80211_reset_ap_probe(sdata);
3184         }
3185
3186         /*
3187          * Push the beacon loss detection into the future since
3188          * we are processing a beacon from the AP just now.
3189          */
3190         ieee80211_sta_reset_beacon_monitor(sdata);
3191
3192         ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
3193         ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3194                                           len - baselen, false, &elems,
3195                                           care_about_ies, ncrc);
3196
3197         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
3198                 bool directed_tim = ieee80211_check_tim(elems.tim,
3199                                                         elems.tim_len,
3200                                                         ifmgd->aid);
3201                 if (directed_tim) {
3202                         if (local->hw.conf.dynamic_ps_timeout > 0) {
3203                                 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
3204                                         local->hw.conf.flags &= ~IEEE80211_CONF_PS;
3205                                         ieee80211_hw_config(local,
3206                                                             IEEE80211_CONF_CHANGE_PS);
3207                                 }
3208                                 ieee80211_send_nullfunc(local, sdata, 0);
3209                         } else if (!local->pspolling && sdata->u.mgd.powersave) {
3210                                 local->pspolling = true;
3211
3212                                 /*
3213                                  * Here is assumed that the driver will be
3214                                  * able to send ps-poll frame and receive a
3215                                  * response even though power save mode is
3216                                  * enabled, but some drivers might require
3217                                  * to disable power save here. This needs
3218                                  * to be investigated.
3219                                  */
3220                                 ieee80211_send_pspoll(local, sdata);
3221                         }
3222                 }
3223         }
3224
3225         if (sdata->vif.p2p) {
3226                 struct ieee80211_p2p_noa_attr noa = {};
3227                 int ret;
3228
3229                 ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
3230                                             len - baselen,
3231                                             IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3232                                             (u8 *) &noa, sizeof(noa));
3233                 if (ret >= 2) {
3234                         if (sdata->u.mgd.p2p_noa_index != noa.index) {
3235                                 /* valid noa_attr and index changed */
3236                                 sdata->u.mgd.p2p_noa_index = noa.index;
3237                                 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
3238                                 changed |= BSS_CHANGED_P2P_PS;
3239                                 /*
3240                                  * make sure we update all information, the CRC
3241                                  * mechanism doesn't look at P2P attributes.
3242                                  */
3243                                 ifmgd->beacon_crc_valid = false;
3244                         }
3245                 } else if (sdata->u.mgd.p2p_noa_index != -1) {
3246                         /* noa_attr not found and we had valid noa_attr before */
3247                         sdata->u.mgd.p2p_noa_index = -1;
3248                         memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3249                         changed |= BSS_CHANGED_P2P_PS;
3250                         ifmgd->beacon_crc_valid = false;
3251                 }
3252         }
3253
3254         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3255                 return;
3256         ifmgd->beacon_crc = ncrc;
3257         ifmgd->beacon_crc_valid = true;
3258
3259         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3260
3261         ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
3262                                          &elems, true);
3263
3264         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
3265             ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3266                                      elems.wmm_param_len))
3267                 changed |= BSS_CHANGED_QOS;
3268
3269         /*
3270          * If we haven't had a beacon before, tell the driver about the
3271          * DTIM period (and beacon timing if desired) now.
3272          */
3273         if (!ifmgd->have_beacon) {
3274                 /* a few bogus AP send dtim_period = 0 or no TIM IE */
3275                 if (elems.tim)
3276                         bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
3277                 else
3278                         bss_conf->dtim_period = 1;
3279
3280                 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
3281                         sdata->vif.bss_conf.sync_tsf =
3282                                 le64_to_cpu(mgmt->u.beacon.timestamp);
3283                         sdata->vif.bss_conf.sync_device_ts =
3284                                 rx_status->device_timestamp;
3285                         if (elems.tim)
3286                                 sdata->vif.bss_conf.sync_dtim_count =
3287                                         elems.tim->dtim_count;
3288                         else
3289                                 sdata->vif.bss_conf.sync_dtim_count = 0;
3290                 }
3291
3292                 changed |= BSS_CHANGED_BEACON_INFO;
3293                 ifmgd->have_beacon = true;
3294
3295                 mutex_lock(&local->iflist_mtx);
3296                 ieee80211_recalc_ps(local, -1);
3297                 mutex_unlock(&local->iflist_mtx);
3298
3299                 ieee80211_recalc_ps_vif(sdata);
3300         }
3301
3302         if (elems.erp_info) {
3303                 erp_valid = true;
3304                 erp_value = elems.erp_info[0];
3305         } else {
3306                 erp_valid = false;
3307         }
3308         changed |= ieee80211_handle_bss_capability(sdata,
3309                         le16_to_cpu(mgmt->u.beacon.capab_info),
3310                         erp_valid, erp_value);
3311
3312         mutex_lock(&local->sta_mtx);
3313         sta = sta_info_get(sdata, bssid);
3314
3315         if (ieee80211_config_bw(sdata, sta,
3316                                 elems.ht_cap_elem, elems.ht_operation,
3317                                 elems.vht_operation, bssid, &changed)) {
3318                 mutex_unlock(&local->sta_mtx);
3319                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3320                                        WLAN_REASON_DEAUTH_LEAVING,
3321                                        true, deauth_buf);
3322                 cfg80211_tx_mlme_mgmt(sdata->dev, deauth_buf,
3323                                       sizeof(deauth_buf));
3324                 return;
3325         }
3326
3327         if (sta && elems.opmode_notif)
3328                 ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
3329                                             rx_status->band, true);
3330         mutex_unlock(&local->sta_mtx);
3331
3332         changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
3333                                                elems.country_elem,
3334                                                elems.country_elem_len,
3335                                                elems.pwr_constr_elem,
3336                                                elems.cisco_dtpc_elem);
3337
3338         ieee80211_bss_info_change_notify(sdata, changed);
3339 }
3340
3341 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
3342                                   struct sk_buff *skb)
3343 {
3344         struct ieee80211_rx_status *rx_status;
3345         struct ieee80211_mgmt *mgmt;
3346         u16 fc;
3347         struct ieee802_11_elems elems;
3348         int ies_len;
3349
3350         rx_status = (struct ieee80211_rx_status *) skb->cb;
3351         mgmt = (struct ieee80211_mgmt *) skb->data;
3352         fc = le16_to_cpu(mgmt->frame_control);
3353
3354         sdata_lock(sdata);
3355
3356         switch (fc & IEEE80211_FCTL_STYPE) {
3357         case IEEE80211_STYPE_BEACON:
3358                 ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
3359                 break;
3360         case IEEE80211_STYPE_PROBE_RESP:
3361                 ieee80211_rx_mgmt_probe_resp(sdata, skb);
3362                 break;
3363         case IEEE80211_STYPE_AUTH:
3364                 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
3365                 break;
3366         case IEEE80211_STYPE_DEAUTH:
3367                 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
3368                 break;
3369         case IEEE80211_STYPE_DISASSOC:
3370                 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
3371                 break;
3372         case IEEE80211_STYPE_ASSOC_RESP:
3373         case IEEE80211_STYPE_REASSOC_RESP:
3374                 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
3375                 break;
3376         case IEEE80211_STYPE_ACTION:
3377                 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3378                         ies_len = skb->len -
3379                                   offsetof(struct ieee80211_mgmt,
3380                                            u.action.u.chan_switch.variable);
3381
3382                         if (ies_len < 0)
3383                                 break;
3384
3385                         ieee802_11_parse_elems(
3386                                 mgmt->u.action.u.chan_switch.variable,
3387                                 ies_len, true, &elems);
3388
3389                         if (elems.parse_error)
3390                                 break;
3391
3392                         ieee80211_sta_process_chanswitch(sdata,
3393                                                          rx_status->mactime,
3394                                                          &elems, false);
3395                 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
3396                         ies_len = skb->len -
3397                                   offsetof(struct ieee80211_mgmt,
3398                                            u.action.u.ext_chan_switch.variable);
3399
3400                         if (ies_len < 0)
3401                                 break;
3402
3403                         ieee802_11_parse_elems(
3404                                 mgmt->u.action.u.ext_chan_switch.variable,
3405                                 ies_len, true, &elems);
3406
3407                         if (elems.parse_error)
3408                                 break;
3409
3410                         /* for the handling code pretend this was also an IE */
3411                         elems.ext_chansw_ie =
3412                                 &mgmt->u.action.u.ext_chan_switch.data;
3413
3414                         ieee80211_sta_process_chanswitch(sdata,
3415                                                          rx_status->mactime,
3416                                                          &elems, false);
3417                 }
3418                 break;
3419         }
3420         sdata_unlock(sdata);
3421 }
3422
3423 static void ieee80211_sta_timer(unsigned long data)
3424 {
3425         struct ieee80211_sub_if_data *sdata =
3426                 (struct ieee80211_sub_if_data *) data;
3427
3428         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3429 }
3430
3431 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3432                                           u8 *bssid, u8 reason, bool tx)
3433 {
3434         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3435
3436         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3437                                tx, frame_buf);
3438
3439         cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
3440                               IEEE80211_DEAUTH_FRAME_LEN);
3441 }
3442
3443 static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
3444 {
3445         struct ieee80211_local *local = sdata->local;
3446         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3447         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3448         u32 tx_flags = 0;
3449
3450         sdata_assert_lock(sdata);
3451
3452         if (WARN_ON_ONCE(!auth_data))
3453                 return -EINVAL;
3454
3455         auth_data->tries++;
3456
3457         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
3458                 sdata_info(sdata, "authentication with %pM timed out\n",
3459                            auth_data->bss->bssid);
3460
3461                 /*
3462                  * Most likely AP is not in the range so remove the
3463                  * bss struct for that AP.
3464                  */
3465                 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
3466
3467                 return -ETIMEDOUT;
3468         }
3469
3470         drv_mgd_prepare_tx(local, sdata);
3471
3472         if (auth_data->bss->proberesp_ies) {
3473                 u16 trans = 1;
3474                 u16 status = 0;
3475
3476                 sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
3477                            auth_data->bss->bssid, auth_data->tries,
3478                            IEEE80211_AUTH_MAX_TRIES);
3479
3480                 auth_data->expected_transaction = 2;
3481
3482                 if (auth_data->algorithm == WLAN_AUTH_SAE) {
3483                         trans = auth_data->sae_trans;
3484                         status = auth_data->sae_status;
3485                         auth_data->expected_transaction = trans;
3486                 }
3487
3488                 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3489                         tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3490                                    IEEE80211_TX_INTFL_MLME_CONN_TX;
3491
3492                 ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
3493                                     auth_data->data, auth_data->data_len,
3494                                     auth_data->bss->bssid,
3495                                     auth_data->bss->bssid, NULL, 0, 0,
3496                                     tx_flags);
3497         } else {
3498                 const u8 *ssidie;
3499
3500                 sdata_info(sdata, "direct probe to %pM (try %d/%i)\n",
3501                            auth_data->bss->bssid, auth_data->tries,
3502                            IEEE80211_AUTH_MAX_TRIES);
3503
3504                 rcu_read_lock();
3505                 ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
3506                 if (!ssidie) {
3507                         rcu_read_unlock();
3508                         return -EINVAL;
3509                 }
3510                 /*
3511                  * Direct probe is sent to broadcast address as some APs
3512                  * will not answer to direct packet in unassociated state.
3513                  */
3514                 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
3515                                          NULL, 0, (u32) -1, true, 0,
3516                                          auth_data->bss->channel, false);
3517                 rcu_read_unlock();
3518         }
3519
3520         if (tx_flags == 0) {
3521                 if (auth_data->algorithm == WLAN_AUTH_SAE)
3522                         auth_data->timeout = jiffies +
3523                                 IEEE80211_AUTH_TIMEOUT_SAE;
3524                 else
3525                         auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3526         } else {
3527                 auth_data->timeout =
3528                         round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
3529         }
3530
3531         auth_data->timeout_started = true;
3532         run_again(sdata, auth_data->timeout);
3533
3534         return 0;
3535 }
3536
3537 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
3538 {
3539         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3540         struct ieee80211_local *local = sdata->local;
3541
3542         sdata_assert_lock(sdata);
3543
3544         assoc_data->tries++;
3545         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
3546                 sdata_info(sdata, "association with %pM timed out\n",
3547                            assoc_data->bss->bssid);
3548
3549                 /*
3550                  * Most likely AP is not in the range so remove the
3551                  * bss struct for that AP.
3552                  */
3553                 cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);
3554
3555                 return -ETIMEDOUT;
3556         }
3557
3558         sdata_info(sdata, "associate with %pM (try %d/%d)\n",
3559                    assoc_data->bss->bssid, assoc_data->tries,
3560                    IEEE80211_ASSOC_MAX_TRIES);
3561         ieee80211_send_assoc(sdata);
3562
3563         if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
3564                 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3565                 assoc_data->timeout_started = true;
3566                 run_again(sdata, assoc_data->timeout);
3567         } else {
3568                 assoc_data->timeout =
3569                         round_jiffies_up(jiffies +
3570                                          IEEE80211_ASSOC_TIMEOUT_LONG);
3571                 assoc_data->timeout_started = true;
3572                 run_again(sdata, assoc_data->timeout);
3573         }
3574
3575         return 0;
3576 }
3577
3578 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
3579                                   __le16 fc, bool acked)
3580 {
3581         struct ieee80211_local *local = sdata->local;
3582
3583         sdata->u.mgd.status_fc = fc;
3584         sdata->u.mgd.status_acked = acked;
3585         sdata->u.mgd.status_received = true;
3586
3587         ieee80211_queue_work(&local->hw, &sdata->work);
3588 }
3589
3590 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
3591 {
3592         struct ieee80211_local *local = sdata->local;
3593         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3594
3595         sdata_lock(sdata);
3596
3597         if (ifmgd->status_received) {
3598                 __le16 fc = ifmgd->status_fc;
3599                 bool status_acked = ifmgd->status_acked;
3600
3601                 ifmgd->status_received = false;
3602                 if (ifmgd->auth_data &&
3603                     (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
3604                         if (status_acked) {
3605                                 if (ifmgd->auth_data->algorithm ==
3606                                     WLAN_AUTH_SAE)
3607                                         ifmgd->auth_data->timeout =
3608                                                 jiffies +
3609                                                 IEEE80211_AUTH_TIMEOUT_SAE;
3610                                 else
3611                                         ifmgd->auth_data->timeout =
3612                                                 jiffies +
3613                                                 IEEE80211_AUTH_TIMEOUT_SHORT;
3614                                 run_again(sdata, ifmgd->auth_data->timeout);
3615                         } else {
3616                                 ifmgd->auth_data->timeout = jiffies - 1;
3617                         }
3618                         ifmgd->auth_data->timeout_started = true;
3619                 } else if (ifmgd->assoc_data &&
3620                            (ieee80211_is_assoc_req(fc) ||
3621                             ieee80211_is_reassoc_req(fc))) {
3622                         if (status_acked) {
3623                                 ifmgd->assoc_data->timeout =
3624                                         jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3625                                 run_again(sdata, ifmgd->assoc_data->timeout);
3626                         } else {
3627                                 ifmgd->assoc_data->timeout = jiffies - 1;
3628                         }
3629                         ifmgd->assoc_data->timeout_started = true;
3630                 }
3631         }
3632
3633         if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
3634             time_after(jiffies, ifmgd->auth_data->timeout)) {
3635                 if (ifmgd->auth_data->done) {
3636                         /*
3637                          * ok ... we waited for assoc but userspace didn't,
3638                          * so let's just kill the auth data
3639                          */
3640                         ieee80211_destroy_auth_data(sdata, false);
3641                 } else if (ieee80211_probe_auth(sdata)) {
3642                         u8 bssid[ETH_ALEN];
3643
3644                         memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
3645
3646                         ieee80211_destroy_auth_data(sdata, false);
3647
3648                         cfg80211_auth_timeout(sdata->dev, bssid);
3649                 }
3650         } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3651                 run_again(sdata, ifmgd->auth_data->timeout);
3652
3653         if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
3654             time_after(jiffies, ifmgd->assoc_data->timeout)) {
3655                 if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
3656                     ieee80211_do_assoc(sdata)) {
3657                         struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
3658
3659                         ieee80211_destroy_assoc_data(sdata, false);
3660                         cfg80211_assoc_timeout(sdata->dev, bss);
3661                 }
3662         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3663                 run_again(sdata, ifmgd->assoc_data->timeout);
3664
3665         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
3666             ifmgd->associated) {
3667                 u8 bssid[ETH_ALEN];
3668                 int max_tries;
3669
3670                 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3671
3672                 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3673                         max_tries = max_nullfunc_tries;
3674                 else
3675                         max_tries = max_probe_tries;
3676
3677                 /* ACK received for nullfunc probing frame */
3678                 if (!ifmgd->probe_send_count)
3679                         ieee80211_reset_ap_probe(sdata);
3680                 else if (ifmgd->nullfunc_failed) {
3681                         if (ifmgd->probe_send_count < max_tries) {
3682                                 mlme_dbg(sdata,
3683                                          "No ack for nullfunc frame to AP %pM, try %d/%i\n",
3684                                          bssid, ifmgd->probe_send_count,
3685                                          max_tries);
3686                                 ieee80211_mgd_probe_ap_send(sdata);
3687                         } else {
3688                                 mlme_dbg(sdata,
3689                                          "No ack for nullfunc frame to AP %pM, disconnecting.\n",
3690                                          bssid);
3691                                 ieee80211_sta_connection_lost(sdata, bssid,
3692                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3693                                         false);
3694                         }
3695                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
3696                         run_again(sdata, ifmgd->probe_timeout);
3697                 else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
3698                         mlme_dbg(sdata,
3699                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
3700                                  bssid, probe_wait_ms);
3701                         ieee80211_sta_connection_lost(sdata, bssid,
3702                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3703                 } else if (ifmgd->probe_send_count < max_tries) {
3704                         mlme_dbg(sdata,
3705                                  "No probe response from AP %pM after %dms, try %d/%i\n",
3706                                  bssid, probe_wait_ms,
3707                                  ifmgd->probe_send_count, max_tries);
3708                         ieee80211_mgd_probe_ap_send(sdata);
3709                 } else {
3710                         /*
3711                          * We actually lost the connection ... or did we?
3712                          * Let's make sure!
3713                          */
3714                         wiphy_debug(local->hw.wiphy,
3715                                     "%s: No probe response from AP %pM"
3716                                     " after %dms, disconnecting.\n",
3717                                     sdata->name,
3718                                     bssid, probe_wait_ms);
3719
3720                         ieee80211_sta_connection_lost(sdata, bssid,
3721                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3722                 }
3723         }
3724
3725         sdata_unlock(sdata);
3726 }
3727
3728 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
3729 {
3730         struct ieee80211_sub_if_data *sdata =
3731                 (struct ieee80211_sub_if_data *) data;
3732         struct ieee80211_local *local = sdata->local;
3733
3734         if (local->quiescing)
3735                 return;
3736
3737         if (sdata->vif.csa_active)
3738                 return;
3739
3740         sdata->u.mgd.connection_loss = false;
3741         ieee80211_queue_work(&sdata->local->hw,
3742                              &sdata->u.mgd.beacon_connection_loss_work);
3743 }
3744
3745 static void ieee80211_sta_conn_mon_timer(unsigned long data)
3746 {
3747         struct ieee80211_sub_if_data *sdata =
3748                 (struct ieee80211_sub_if_data *) data;
3749         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3750         struct ieee80211_local *local = sdata->local;
3751
3752         if (local->quiescing)
3753                 return;
3754
3755         if (sdata->vif.csa_active)
3756                 return;
3757
3758         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
3759 }
3760
3761 static void ieee80211_sta_monitor_work(struct work_struct *work)
3762 {
3763         struct ieee80211_sub_if_data *sdata =
3764                 container_of(work, struct ieee80211_sub_if_data,
3765                              u.mgd.monitor_work);
3766
3767         ieee80211_mgd_probe_ap(sdata, false);
3768 }
3769
3770 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
3771 {
3772         u32 flags;
3773
3774         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3775                 __ieee80211_stop_poll(sdata);
3776
3777                 /* let's probe the connection once */
3778                 flags = sdata->local->hw.flags;
3779                 if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
3780                         ieee80211_queue_work(&sdata->local->hw,
3781                                              &sdata->u.mgd.monitor_work);
3782         }
3783 }
3784
3785 #ifdef CONFIG_PM
3786 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
3787 {
3788         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3789         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3790
3791         sdata_lock(sdata);
3792
3793         if (ifmgd->auth_data || ifmgd->assoc_data) {
3794                 const u8 *bssid = ifmgd->auth_data ?
3795                                 ifmgd->auth_data->bss->bssid :
3796                                 ifmgd->assoc_data->bss->bssid;
3797
3798                 /*
3799                  * If we are trying to authenticate / associate while suspending,
3800                  * cfg80211 won't know and won't actually abort those attempts,
3801                  * thus we need to do that ourselves.
3802                  */
3803                 ieee80211_send_deauth_disassoc(sdata, bssid,
3804                                                IEEE80211_STYPE_DEAUTH,
3805                                                WLAN_REASON_DEAUTH_LEAVING,
3806                                                false, frame_buf);
3807                 if (ifmgd->assoc_data)
3808                         ieee80211_destroy_assoc_data(sdata, false);
3809                 if (ifmgd->auth_data)
3810                         ieee80211_destroy_auth_data(sdata, false);
3811                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
3812                                       IEEE80211_DEAUTH_FRAME_LEN);
3813         }
3814
3815         sdata_unlock(sdata);
3816 }
3817
3818 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
3819 {
3820         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3821
3822         sdata_lock(sdata);
3823         if (!ifmgd->associated) {
3824                 sdata_unlock(sdata);
3825                 return;
3826         }
3827
3828         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
3829                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
3830                 mlme_dbg(sdata, "driver requested disconnect after resume\n");
3831                 ieee80211_sta_connection_lost(sdata,
3832                                               ifmgd->associated->bssid,
3833                                               WLAN_REASON_UNSPECIFIED,
3834                                               true);
3835                 sdata_unlock(sdata);
3836                 return;
3837         }
3838         sdata_unlock(sdata);
3839 }
3840 #endif
3841
3842 /* interface setup */
3843 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
3844 {
3845         struct ieee80211_if_managed *ifmgd;
3846
3847         ifmgd = &sdata->u.mgd;
3848         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
3849         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
3850         INIT_WORK(&ifmgd->beacon_connection_loss_work,
3851                   ieee80211_beacon_connection_loss_work);
3852         INIT_WORK(&ifmgd->csa_connection_drop_work,
3853                   ieee80211_csa_connection_drop_work);
3854         INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
3855         INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
3856                           ieee80211_tdls_peer_del_work);
3857         setup_timer(&ifmgd->timer, ieee80211_sta_timer,
3858                     (unsigned long) sdata);
3859         setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
3860                     (unsigned long) sdata);
3861         setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
3862                     (unsigned long) sdata);
3863         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
3864                     (unsigned long) sdata);
3865
3866         ifmgd->flags = 0;
3867         ifmgd->powersave = sdata->wdev.ps;
3868         ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
3869         ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
3870         ifmgd->p2p_noa_index = -1;
3871
3872         if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
3873                 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
3874         else
3875                 ifmgd->req_smps = IEEE80211_SMPS_OFF;
3876 }
3877
3878 /* scan finished notification */
3879 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3880 {
3881         struct ieee80211_sub_if_data *sdata;
3882
3883         /* Restart STA timers */
3884         rcu_read_lock();
3885         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3886                 if (ieee80211_sdata_running(sdata))
3887                         ieee80211_restart_sta_timer(sdata);
3888         }
3889         rcu_read_unlock();
3890 }
3891
3892 int ieee80211_max_network_latency(struct notifier_block *nb,
3893                                   unsigned long data, void *dummy)
3894 {
3895         s32 latency_usec = (s32) data;
3896         struct ieee80211_local *local =
3897                 container_of(nb, struct ieee80211_local,
3898                              network_latency_notifier);
3899
3900         mutex_lock(&local->iflist_mtx);
3901         ieee80211_recalc_ps(local, latency_usec);
3902         mutex_unlock(&local->iflist_mtx);
3903
3904         return NOTIFY_OK;
3905 }
3906
3907 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
3908                                      struct cfg80211_bss *cbss)
3909 {
3910         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3911         const u8 *ht_cap_ie, *vht_cap_ie;
3912         const struct ieee80211_ht_cap *ht_cap;
3913         const struct ieee80211_vht_cap *vht_cap;
3914         u8 chains = 1;
3915
3916         if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
3917                 return chains;
3918
3919         ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3920         if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
3921                 ht_cap = (void *)(ht_cap_ie + 2);
3922                 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
3923                 /*
3924                  * TODO: use "Tx Maximum Number Spatial Streams Supported" and
3925                  *       "Tx Unequal Modulation Supported" fields.
3926                  */
3927         }
3928
3929         if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
3930                 return chains;
3931
3932         vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3933         if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
3934                 u8 nss;
3935                 u16 tx_mcs_map;
3936
3937                 vht_cap = (void *)(vht_cap_ie + 2);
3938                 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
3939                 for (nss = 8; nss > 0; nss--) {
3940                         if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
3941                                         IEEE80211_VHT_MCS_NOT_SUPPORTED)
3942                                 break;
3943                 }
3944                 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
3945                 chains = max(chains, nss);
3946         }
3947
3948         return chains;
3949 }
3950
3951 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
3952                                   struct cfg80211_bss *cbss)
3953 {
3954         struct ieee80211_local *local = sdata->local;
3955         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3956         const struct ieee80211_ht_cap *ht_cap = NULL;
3957         const struct ieee80211_ht_operation *ht_oper = NULL;
3958         const struct ieee80211_vht_operation *vht_oper = NULL;
3959         struct ieee80211_supported_band *sband;
3960         struct cfg80211_chan_def chandef;
3961         int ret;
3962
3963         sband = local->hw.wiphy->bands[cbss->channel->band];
3964
3965         ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
3966                           IEEE80211_STA_DISABLE_80P80MHZ |
3967                           IEEE80211_STA_DISABLE_160MHZ);
3968
3969         rcu_read_lock();
3970
3971         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3972             sband->ht_cap.ht_supported) {
3973                 const u8 *ht_oper_ie, *ht_cap_ie;
3974
3975                 ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
3976                 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
3977                         ht_oper = (void *)(ht_oper_ie + 2);
3978
3979                 ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3980                 if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
3981                         ht_cap = (void *)(ht_cap_ie + 2);
3982
3983                 if (!ht_cap) {
3984                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3985                         ht_oper = NULL;
3986                 }
3987         }
3988
3989         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3990             sband->vht_cap.vht_supported) {
3991                 const u8 *vht_oper_ie, *vht_cap;
3992
3993                 vht_oper_ie = ieee80211_bss_get_ie(cbss,
3994                                                    WLAN_EID_VHT_OPERATION);
3995                 if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
3996                         vht_oper = (void *)(vht_oper_ie + 2);
3997                 if (vht_oper && !ht_oper) {
3998                         vht_oper = NULL;
3999                         sdata_info(sdata,
4000                                    "AP advertised VHT without HT, disabling both\n");
4001                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4002                         ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4003                 }
4004
4005                 vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
4006                 if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
4007                         ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4008                         vht_oper = NULL;
4009                 }
4010         }
4011
4012         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
4013                                                      cbss->channel,
4014                                                      ht_cap, ht_oper, vht_oper,
4015                                                      &chandef, false);
4016
4017         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
4018                                       local->rx_chains);
4019
4020         rcu_read_unlock();
4021
4022         /* will change later if needed */
4023         sdata->smps_mode = IEEE80211_SMPS_OFF;
4024
4025         mutex_lock(&local->mtx);
4026         /*
4027          * If this fails (possibly due to channel context sharing
4028          * on incompatible channels, e.g. 80+80 and 160 sharing the
4029          * same control channel) try to use a smaller bandwidth.
4030          */
4031         ret = ieee80211_vif_use_channel(sdata, &chandef,
4032                                         IEEE80211_CHANCTX_SHARED);
4033
4034         /* don't downgrade for 5 and 10 MHz channels, though. */
4035         if (chandef.width == NL80211_CHAN_WIDTH_5 ||
4036             chandef.width == NL80211_CHAN_WIDTH_10)
4037                 goto out;
4038
4039         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4040                 ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4041                 ret = ieee80211_vif_use_channel(sdata, &chandef,
4042                                                 IEEE80211_CHANCTX_SHARED);
4043         }
4044  out:
4045         mutex_unlock(&local->mtx);
4046         return ret;
4047 }
4048
4049 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
4050                                      struct cfg80211_bss *cbss, bool assoc)
4051 {
4052         struct ieee80211_local *local = sdata->local;
4053         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4054         struct ieee80211_bss *bss = (void *)cbss->priv;
4055         struct sta_info *new_sta = NULL;
4056         bool have_sta = false;
4057         int err;
4058
4059         if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
4060                 return -EINVAL;
4061
4062         /* If a reconfig is happening, bail out */
4063         if (local->in_reconfig)
4064                 return -EBUSY;
4065
4066         if (assoc) {
4067                 rcu_read_lock();
4068                 have_sta = sta_info_get(sdata, cbss->bssid);
4069                 rcu_read_unlock();
4070         }
4071
4072         if (!have_sta) {
4073                 new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
4074                 if (!new_sta)
4075                         return -ENOMEM;
4076         }
4077         if (new_sta) {
4078                 u32 rates = 0, basic_rates = 0;
4079                 bool have_higher_than_11mbit;
4080                 int min_rate = INT_MAX, min_rate_index = -1;
4081                 struct ieee80211_chanctx_conf *chanctx_conf;
4082                 struct ieee80211_supported_band *sband;
4083                 const struct cfg80211_bss_ies *ies;
4084                 int shift;
4085                 u32 rate_flags;
4086
4087                 sband = local->hw.wiphy->bands[cbss->channel->band];
4088
4089                 err = ieee80211_prep_channel(sdata, cbss);
4090                 if (err) {
4091                         sta_info_free(local, new_sta);
4092                         return -EINVAL;
4093                 }
4094                 shift = ieee80211_vif_get_shift(&sdata->vif);
4095
4096                 rcu_read_lock();
4097                 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4098                 if (WARN_ON(!chanctx_conf)) {
4099                         rcu_read_unlock();
4100                         sta_info_free(local, new_sta);
4101                         return -EINVAL;
4102                 }
4103                 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
4104                 rcu_read_unlock();
4105
4106                 ieee80211_get_rates(sband, bss->supp_rates,
4107                                     bss->supp_rates_len,
4108                                     &rates, &basic_rates,
4109                                     &have_higher_than_11mbit,
4110                                     &min_rate, &min_rate_index,
4111                                     shift, rate_flags);
4112
4113                 /*
4114                  * This used to be a workaround for basic rates missing
4115                  * in the association response frame. Now that we no
4116                  * longer use the basic rates from there, it probably
4117                  * doesn't happen any more, but keep the workaround so
4118                  * in case some *other* APs are buggy in different ways
4119                  * we can connect -- with a warning.
4120                  */
4121                 if (!basic_rates && min_rate_index >= 0) {
4122                         sdata_info(sdata,
4123                                    "No basic rates, using min rate instead\n");
4124                         basic_rates = BIT(min_rate_index);
4125                 }
4126
4127                 new_sta->sta.supp_rates[cbss->channel->band] = rates;
4128                 sdata->vif.bss_conf.basic_rates = basic_rates;
4129
4130                 /* cf. IEEE 802.11 9.2.12 */
4131                 if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
4132                     have_higher_than_11mbit)
4133                         sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
4134                 else
4135                         sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
4136
4137                 memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
4138
4139                 /* set timing information */
4140                 sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
4141                 rcu_read_lock();
4142                 ies = rcu_dereference(cbss->beacon_ies);
4143                 if (ies) {
4144                         const u8 *tim_ie;
4145
4146                         sdata->vif.bss_conf.sync_tsf = ies->tsf;
4147                         sdata->vif.bss_conf.sync_device_ts =
4148                                 bss->device_ts_beacon;
4149                         tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
4150                                                   ies->data, ies->len);
4151                         if (tim_ie && tim_ie[1] >= 2)
4152                                 sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
4153                         else
4154                                 sdata->vif.bss_conf.sync_dtim_count = 0;
4155                 } else if (!(local->hw.flags &
4156                                         IEEE80211_HW_TIMING_BEACON_ONLY)) {
4157                         ies = rcu_dereference(cbss->proberesp_ies);
4158                         /* must be non-NULL since beacon IEs were NULL */
4159                         sdata->vif.bss_conf.sync_tsf = ies->tsf;
4160                         sdata->vif.bss_conf.sync_device_ts =
4161                                 bss->device_ts_presp;
4162                         sdata->vif.bss_conf.sync_dtim_count = 0;
4163                 } else {
4164                         sdata->vif.bss_conf.sync_tsf = 0;
4165                         sdata->vif.bss_conf.sync_device_ts = 0;
4166                         sdata->vif.bss_conf.sync_dtim_count = 0;
4167                 }
4168                 rcu_read_unlock();
4169
4170                 /* tell driver about BSSID, basic rates and timing */
4171                 ieee80211_bss_info_change_notify(sdata,
4172                         BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
4173                         BSS_CHANGED_BEACON_INT);
4174
4175                 if (assoc)
4176                         sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
4177
4178                 err = sta_info_insert(new_sta);
4179                 new_sta = NULL;
4180                 if (err) {
4181                         sdata_info(sdata,
4182                                    "failed to insert STA entry for the AP (error %d)\n",
4183                                    err);
4184                         return err;
4185                 }
4186         } else
4187                 WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4188
4189         return 0;
4190 }
4191
4192 /* config hooks */
4193 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
4194                        struct cfg80211_auth_request *req)
4195 {
4196         struct ieee80211_local *local = sdata->local;
4197         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4198         struct ieee80211_mgd_auth_data *auth_data;
4199         u16 auth_alg;
4200         int err;
4201
4202         /* prepare auth data structure */
4203
4204         switch (req->auth_type) {
4205         case NL80211_AUTHTYPE_OPEN_SYSTEM:
4206                 auth_alg = WLAN_AUTH_OPEN;
4207                 break;
4208         case NL80211_AUTHTYPE_SHARED_KEY:
4209                 if (IS_ERR(local->wep_tx_tfm))
4210                         return -EOPNOTSUPP;
4211                 auth_alg = WLAN_AUTH_SHARED_KEY;
4212                 break;
4213         case NL80211_AUTHTYPE_FT:
4214                 auth_alg = WLAN_AUTH_FT;
4215                 break;
4216         case NL80211_AUTHTYPE_NETWORK_EAP:
4217                 auth_alg = WLAN_AUTH_LEAP;
4218                 break;
4219         case NL80211_AUTHTYPE_SAE:
4220                 auth_alg = WLAN_AUTH_SAE;
4221                 break;
4222         default:
4223                 return -EOPNOTSUPP;
4224         }
4225
4226         auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
4227                             req->ie_len, GFP_KERNEL);
4228         if (!auth_data)
4229                 return -ENOMEM;
4230
4231         auth_data->bss = req->bss;
4232
4233         if (req->sae_data_len >= 4) {
4234                 __le16 *pos = (__le16 *) req->sae_data;
4235                 auth_data->sae_trans = le16_to_cpu(pos[0]);
4236                 auth_data->sae_status = le16_to_cpu(pos[1]);
4237                 memcpy(auth_data->data, req->sae_data + 4,
4238                        req->sae_data_len - 4);
4239                 auth_data->data_len += req->sae_data_len - 4;
4240         }
4241
4242         if (req->ie && req->ie_len) {
4243                 memcpy(&auth_data->data[auth_data->data_len],
4244                        req->ie, req->ie_len);
4245                 auth_data->data_len += req->ie_len;
4246         }
4247
4248         if (req->key && req->key_len) {
4249                 auth_data->key_len = req->key_len;
4250                 auth_data->key_idx = req->key_idx;
4251                 memcpy(auth_data->key, req->key, req->key_len);
4252         }
4253
4254         auth_data->algorithm = auth_alg;
4255
4256         /* try to authenticate/probe */
4257
4258         if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
4259             ifmgd->assoc_data) {
4260                 err = -EBUSY;
4261                 goto err_free;
4262         }
4263
4264         if (ifmgd->auth_data)
4265                 ieee80211_destroy_auth_data(sdata, false);
4266
4267         /* prep auth_data so we don't go into idle on disassoc */
4268         ifmgd->auth_data = auth_data;
4269
4270         if (ifmgd->associated) {
4271                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4272
4273                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4274                                        WLAN_REASON_UNSPECIFIED,
4275                                        false, frame_buf);
4276
4277                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4278                                       sizeof(frame_buf));
4279         }
4280
4281         sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4282
4283         err = ieee80211_prep_connection(sdata, req->bss, false);
4284         if (err)
4285                 goto err_clear;
4286
4287         err = ieee80211_probe_auth(sdata);
4288         if (err) {
4289                 sta_info_destroy_addr(sdata, req->bss->bssid);
4290                 goto err_clear;
4291         }
4292
4293         /* hold our own reference */
4294         cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4295         return 0;
4296
4297  err_clear:
4298         memset(ifmgd->bssid, 0, ETH_ALEN);
4299         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4300         ifmgd->auth_data = NULL;
4301  err_free:
4302         kfree(auth_data);
4303         return err;
4304 }
4305
4306 static bool ieee80211_usable_wmm_params(struct ieee80211_sub_if_data *sdata,
4307                                         const u8 *wmm_param, int len)
4308 {
4309         const u8 *pos;
4310         size_t left;
4311
4312         if (len < 8)
4313                 return false;
4314
4315         if (wmm_param[5] != 1 /* version */)
4316                 return false;
4317
4318         pos = wmm_param + 8;
4319         left = len - 8;
4320
4321         for (; left >= 4; left -= 4, pos += 4) {
4322                 u8 aifsn = pos[0] & 0x0f;
4323                 u8 ecwmin = pos[1] & 0x0f;
4324                 u8 ecwmax = (pos[1] & 0xf0) >> 4;
4325                 int aci = (pos[0] >> 5) & 0x03;
4326
4327                 if (aifsn < 2) {
4328                         sdata_info(sdata,
4329                                    "AP has invalid WMM params (AIFSN=%d for ACI %d), disabling WMM\n",
4330                                    aifsn, aci);
4331                         return false;
4332                 }
4333                 if (ecwmin > ecwmax) {
4334                         sdata_info(sdata,
4335                                    "AP has invalid WMM params (ECWmin/max=%d/%d for ACI %d), disabling WMM\n",
4336                                    ecwmin, ecwmax, aci);
4337                         return false;
4338                 }
4339         }
4340
4341         return true;
4342 }
4343
4344 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
4345                         struct cfg80211_assoc_request *req)
4346 {
4347         struct ieee80211_local *local = sdata->local;
4348         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4349         struct ieee80211_bss *bss = (void *)req->bss->priv;
4350         struct ieee80211_mgd_assoc_data *assoc_data;
4351         const struct cfg80211_bss_ies *beacon_ies;
4352         struct ieee80211_supported_band *sband;
4353         const u8 *ssidie, *ht_ie, *vht_ie;
4354         int i, err;
4355
4356         assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
4357         if (!assoc_data)
4358                 return -ENOMEM;
4359
4360         rcu_read_lock();
4361         ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
4362         if (!ssidie) {
4363                 rcu_read_unlock();
4364                 kfree(assoc_data);
4365                 return -EINVAL;
4366         }
4367         memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
4368         assoc_data->ssid_len = ssidie[1];
4369         rcu_read_unlock();
4370
4371         if (ifmgd->associated) {
4372                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4373
4374                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4375                                        WLAN_REASON_UNSPECIFIED,
4376                                        false, frame_buf);
4377
4378                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4379                                       sizeof(frame_buf));
4380         }
4381
4382         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
4383                 err = -EBUSY;
4384                 goto err_free;
4385         }
4386
4387         if (ifmgd->assoc_data) {
4388                 err = -EBUSY;
4389                 goto err_free;
4390         }
4391
4392         if (ifmgd->auth_data) {
4393                 bool match;
4394
4395                 /* keep sta info, bssid if matching */
4396                 match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
4397                 ieee80211_destroy_auth_data(sdata, match);
4398         }
4399
4400         /* prepare assoc data */
4401
4402         ifmgd->beacon_crc_valid = false;
4403
4404         assoc_data->wmm = bss->wmm_used &&
4405                           (local->hw.queues >= IEEE80211_NUM_ACS);
4406         if (assoc_data->wmm) {
4407                 /* try to check validity of WMM params IE */
4408                 const struct cfg80211_bss_ies *ies;
4409                 const u8 *wp, *start, *end;
4410
4411                 rcu_read_lock();
4412                 ies = rcu_dereference(req->bss->ies);
4413                 start = ies->data;
4414                 end = start + ies->len;
4415
4416                 while (true) {
4417                         wp = cfg80211_find_vendor_ie(
4418                                 WLAN_OUI_MICROSOFT,
4419                                 WLAN_OUI_TYPE_MICROSOFT_WMM,
4420                                 start, end - start);
4421                         if (!wp)
4422                                 break;
4423                         start = wp + wp[1] + 2;
4424                         /* if this IE is too short, try the next */
4425                         if (wp[1] <= 4)
4426                                 continue;
4427                         /* if this IE is WMM params, we found what we wanted */
4428                         if (wp[6] == 1)
4429                                 break;
4430                 }
4431
4432                 if (!wp || !ieee80211_usable_wmm_params(sdata, wp + 2,
4433                                                         wp[1] - 2)) {
4434                         assoc_data->wmm = false;
4435                         ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
4436                 }
4437                 rcu_read_unlock();
4438         }
4439
4440         /*
4441          * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
4442          * We still associate in non-HT mode (11a/b/g) if any one of these
4443          * ciphers is configured as pairwise.
4444          * We can set this to true for non-11n hardware, that'll be checked
4445          * separately along with the peer capabilities.
4446          */
4447         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4448                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
4449                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4450                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4451                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4452                         ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4453                         netdev_info(sdata->dev,
4454                                     "disabling HT/VHT due to WEP/TKIP use\n");
4455                 }
4456         }
4457
4458         if (req->flags & ASSOC_REQ_DISABLE_HT) {
4459                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4460                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4461         }
4462
4463         if (req->flags & ASSOC_REQ_DISABLE_VHT)
4464                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4465
4466         /* Also disable HT if we don't support it or the AP doesn't use WMM */
4467         sband = local->hw.wiphy->bands[req->bss->channel->band];
4468         if (!sband->ht_cap.ht_supported ||
4469             local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
4470             ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4471                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4472                 if (!bss->wmm_used &&
4473                     !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4474                         netdev_info(sdata->dev,
4475                                     "disabling HT as WMM/QoS is not supported by the AP\n");
4476         }
4477
4478         /* disable VHT if we don't support it or the AP doesn't use WMM */
4479         if (!sband->vht_cap.vht_supported ||
4480             local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
4481             ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4482                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4483                 if (!bss->wmm_used &&
4484                     !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4485                         netdev_info(sdata->dev,
4486                                     "disabling VHT as WMM/QoS is not supported by the AP\n");
4487         }
4488
4489         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
4490         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
4491                sizeof(ifmgd->ht_capa_mask));
4492
4493         memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
4494         memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
4495                sizeof(ifmgd->vht_capa_mask));
4496
4497         if (req->ie && req->ie_len) {
4498                 memcpy(assoc_data->ie, req->ie, req->ie_len);
4499                 assoc_data->ie_len = req->ie_len;
4500         }
4501
4502         assoc_data->bss = req->bss;
4503
4504         if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
4505                 if (ifmgd->powersave)
4506                         sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
4507                 else
4508                         sdata->smps_mode = IEEE80211_SMPS_OFF;
4509         } else
4510                 sdata->smps_mode = ifmgd->req_smps;
4511
4512         assoc_data->capability = req->bss->capability;
4513         assoc_data->supp_rates = bss->supp_rates;
4514         assoc_data->supp_rates_len = bss->supp_rates_len;
4515
4516         rcu_read_lock();
4517         ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
4518         if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
4519                 assoc_data->ap_ht_param =
4520                         ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
4521         else
4522                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4523         vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
4524         if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
4525                 memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
4526                        sizeof(struct ieee80211_vht_cap));
4527         else
4528                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4529         rcu_read_unlock();
4530
4531         if (bss->wmm_used && bss->uapsd_supported &&
4532             (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
4533                 assoc_data->uapsd = true;
4534                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
4535         } else {
4536                 assoc_data->uapsd = false;
4537                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
4538         }
4539
4540         if (req->prev_bssid)
4541                 memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4542
4543         if (req->use_mfp) {
4544                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
4545                 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
4546         } else {
4547                 ifmgd->mfp = IEEE80211_MFP_DISABLED;
4548                 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
4549         }
4550
4551         if (req->flags & ASSOC_REQ_USE_RRM)
4552                 ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
4553         else
4554                 ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
4555
4556         if (req->crypto.control_port)
4557                 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
4558         else
4559                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
4560
4561         sdata->control_port_protocol = req->crypto.control_port_ethertype;
4562         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4563         sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
4564                                                         sdata->vif.type);
4565
4566         /* kick off associate process */
4567
4568         ifmgd->assoc_data = assoc_data;
4569         ifmgd->dtim_period = 0;
4570         ifmgd->have_beacon = false;
4571
4572         err = ieee80211_prep_connection(sdata, req->bss, true);
4573         if (err)
4574                 goto err_clear;
4575
4576         rcu_read_lock();
4577         beacon_ies = rcu_dereference(req->bss->beacon_ies);
4578
4579         if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC &&
4580             !beacon_ies) {
4581                 /*
4582                  * Wait up to one beacon interval ...
4583                  * should this be more if we miss one?
4584                  */
4585                 sdata_info(sdata, "waiting for beacon from %pM\n",
4586                            ifmgd->bssid);
4587                 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4588                 assoc_data->timeout_started = true;
4589                 assoc_data->need_beacon = true;
4590         } else if (beacon_ies) {
4591                 const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
4592                                                     beacon_ies->data,
4593                                                     beacon_ies->len);
4594                 u8 dtim_count = 0;
4595
4596                 if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
4597                         const struct ieee80211_tim_ie *tim;
4598                         tim = (void *)(tim_ie + 2);
4599                         ifmgd->dtim_period = tim->dtim_period;
4600                         dtim_count = tim->dtim_count;
4601                 }
4602                 ifmgd->have_beacon = true;
4603                 assoc_data->timeout = jiffies;
4604                 assoc_data->timeout_started = true;
4605
4606                 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
4607                         sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
4608                         sdata->vif.bss_conf.sync_device_ts =
4609                                 bss->device_ts_beacon;
4610                         sdata->vif.bss_conf.sync_dtim_count = dtim_count;
4611                 }
4612         } else {
4613                 assoc_data->timeout = jiffies;
4614                 assoc_data->timeout_started = true;
4615         }
4616         rcu_read_unlock();
4617
4618         run_again(sdata, assoc_data->timeout);
4619
4620         if (bss->corrupt_data) {
4621                 char *corrupt_type = "data";
4622                 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
4623                         if (bss->corrupt_data &
4624                                         IEEE80211_BSS_CORRUPT_PROBE_RESP)
4625                                 corrupt_type = "beacon and probe response";
4626                         else
4627                                 corrupt_type = "beacon";
4628                 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
4629                         corrupt_type = "probe response";
4630                 sdata_info(sdata, "associating with AP with corrupt %s\n",
4631                            corrupt_type);
4632         }
4633
4634         return 0;
4635  err_clear:
4636         memset(ifmgd->bssid, 0, ETH_ALEN);
4637         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4638         ifmgd->assoc_data = NULL;
4639  err_free:
4640         kfree(assoc_data);
4641         return err;
4642 }
4643
4644 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4645                          struct cfg80211_deauth_request *req)
4646 {
4647         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4648         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4649         bool tx = !req->local_state_change;
4650
4651         if (ifmgd->auth_data &&
4652             ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
4653                 sdata_info(sdata,
4654                            "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
4655                            req->bssid, req->reason_code,
4656                            ieee80211_get_reason_code_string(req->reason_code));
4657
4658                 drv_mgd_prepare_tx(sdata->local, sdata);
4659                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
4660                                                IEEE80211_STYPE_DEAUTH,
4661                                                req->reason_code, tx,
4662                                                frame_buf);
4663                 ieee80211_destroy_auth_data(sdata, false);
4664                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4665                                       IEEE80211_DEAUTH_FRAME_LEN);
4666
4667                 return 0;
4668         }
4669
4670         if (ifmgd->associated &&
4671             ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4672                 sdata_info(sdata,
4673                            "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
4674                            req->bssid, req->reason_code,
4675                            ieee80211_get_reason_code_string(req->reason_code));
4676
4677                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4678                                        req->reason_code, tx, frame_buf);
4679                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4680                                       IEEE80211_DEAUTH_FRAME_LEN);
4681                 return 0;
4682         }
4683
4684         return -ENOTCONN;
4685 }
4686
4687 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4688                            struct cfg80211_disassoc_request *req)
4689 {
4690         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4691         u8 bssid[ETH_ALEN];
4692         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4693
4694         /*
4695          * cfg80211 should catch this ... but it's racy since
4696          * we can receive a disassoc frame, process it, hand it
4697          * to cfg80211 while that's in a locked section already
4698          * trying to tell us that the user wants to disconnect.
4699          */
4700         if (ifmgd->associated != req->bss)
4701                 return -ENOLINK;
4702
4703         sdata_info(sdata,
4704                    "disassociating from %pM by local choice (Reason: %u=%s)\n",
4705                    req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
4706
4707         memcpy(bssid, req->bss->bssid, ETH_ALEN);
4708         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
4709                                req->reason_code, !req->local_state_change,
4710                                frame_buf);
4711
4712         cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4713                               IEEE80211_DEAUTH_FRAME_LEN);
4714
4715         return 0;
4716 }
4717
4718 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4719 {
4720         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4721
4722         /*
4723          * Make sure some work items will not run after this,
4724          * they will not do anything but might not have been
4725          * cancelled when disconnecting.
4726          */
4727         cancel_work_sync(&ifmgd->monitor_work);
4728         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
4729         cancel_work_sync(&ifmgd->request_smps_work);
4730         cancel_work_sync(&ifmgd->csa_connection_drop_work);
4731         cancel_work_sync(&ifmgd->chswitch_work);
4732         cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
4733
4734         sdata_lock(sdata);
4735         if (ifmgd->assoc_data) {
4736                 struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4737                 ieee80211_destroy_assoc_data(sdata, false);
4738                 cfg80211_assoc_timeout(sdata->dev, bss);
4739         }
4740         if (ifmgd->auth_data)
4741                 ieee80211_destroy_auth_data(sdata, false);
4742         del_timer_sync(&ifmgd->timer);
4743         sdata_unlock(sdata);
4744 }
4745
4746 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
4747                                enum nl80211_cqm_rssi_threshold_event rssi_event,
4748                                gfp_t gfp)
4749 {
4750         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4751
4752         trace_api_cqm_rssi_notify(sdata, rssi_event);
4753
4754         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
4755 }
4756 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);