1 /* 2 * BSS client mode implementation 3 * Copyright 2003-2008, Jouni Malinen <j@w1.fi> 4 * Copyright 2004, Instant802 Networks, Inc. 5 * Copyright 2005, Devicescape Software, Inc. 6 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 7 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation. 12 */ 13 14 #include <linux/delay.h> 15 #include <linux/if_ether.h> 16 #include <linux/skbuff.h> 17 #include <linux/if_arp.h> 18 #include <linux/etherdevice.h> 19 #include <linux/moduleparam.h> 20 #include <linux/rtnetlink.h> 21 #include <linux/pm_qos.h> 22 #include <linux/crc32.h> 23 #include <linux/slab.h> 24 #include <linux/export.h> 25 #include <net/mac80211.h> 26 #include <asm/unaligned.h> 27 28 #include "ieee80211_i.h" 29 #include "driver-ops.h" 30 #include "rate.h" 31 #include "led.h" 32 33 #define IEEE80211_AUTH_TIMEOUT (HZ / 5) 34 #define IEEE80211_AUTH_MAX_TRIES 3 35 #define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5) 36 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5) 37 #define IEEE80211_ASSOC_MAX_TRIES 3 38 39 static int max_nullfunc_tries = 2; 40 module_param(max_nullfunc_tries, int, 0644); 41 MODULE_PARM_DESC(max_nullfunc_tries, 42 "Maximum nullfunc tx tries before disconnecting (reason 4)."); 43 44 static int max_probe_tries = 5; 45 module_param(max_probe_tries, int, 0644); 46 MODULE_PARM_DESC(max_probe_tries, 47 "Maximum probe tries before disconnecting (reason 4)."); 48 49 /* 50 * Beacon loss timeout is calculated as N frames times the 51 * advertised beacon interval. This may need to be somewhat 52 * higher than what hardware might detect to account for 53 * delays in the host processing frames. But since we also 54 * probe on beacon miss before declaring the connection lost 55 * default to what we want. 56 */ 57 #define IEEE80211_BEACON_LOSS_COUNT 7 58 59 /* 60 * Time the connection can be idle before we probe 61 * it to see if we can still talk to the AP. 62 */ 63 #define IEEE80211_CONNECTION_IDLE_TIME (30 * HZ) 64 /* 65 * Time we wait for a probe response after sending 66 * a probe request because of beacon loss or for 67 * checking the connection still works. 68 */ 69 static int probe_wait_ms = 500; 70 module_param(probe_wait_ms, int, 0644); 71 MODULE_PARM_DESC(probe_wait_ms, 72 "Maximum time(ms) to wait for probe response" 73 " before disconnecting (reason 4)."); 74 75 /* 76 * Weight given to the latest Beacon frame when calculating average signal 77 * strength for Beacon frames received in the current BSS. This must be 78 * between 1 and 15. 79 */ 80 #define IEEE80211_SIGNAL_AVE_WEIGHT 3 81 82 /* 83 * How many Beacon frames need to have been used in average signal strength 84 * before starting to indicate signal change events. 85 */ 86 #define IEEE80211_SIGNAL_AVE_MIN_COUNT 4 87 88 #define TMR_RUNNING_TIMER 0 89 #define TMR_RUNNING_CHANSW 1 90 91 /* 92 * All cfg80211 functions have to be called outside a locked 93 * section so that they can acquire a lock themselves... This 94 * is much simpler than queuing up things in cfg80211, but we 95 * do need some indirection for that here. 96 */ 97 enum rx_mgmt_action { 98 /* no action required */ 99 RX_MGMT_NONE, 100 101 /* caller must call cfg80211_send_deauth() */ 102 RX_MGMT_CFG80211_DEAUTH, 103 104 /* caller must call cfg80211_send_disassoc() */ 105 RX_MGMT_CFG80211_DISASSOC, 106 107 /* caller must call cfg80211_send_rx_auth() */ 108 RX_MGMT_CFG80211_RX_AUTH, 109 110 /* caller must call cfg80211_send_rx_assoc() */ 111 RX_MGMT_CFG80211_RX_ASSOC, 112 113 /* caller must call cfg80211_send_assoc_timeout() */ 114 RX_MGMT_CFG80211_ASSOC_TIMEOUT, 115 }; 116 117 /* utils */ 118 static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd) 119 { 120 lockdep_assert_held(&ifmgd->mtx); 121 } 122 123 /* 124 * We can have multiple work items (and connection probing) 125 * scheduling this timer, but we need to take care to only 126 * reschedule it when it should fire _earlier_ than it was 127 * asked for before, or if it's not pending right now. This 128 * function ensures that. Note that it then is required to 129 * run this function for all timeouts after the first one 130 * has happened -- the work that runs from this timer will 131 * do that. 132 */ 133 static void run_again(struct ieee80211_if_managed *ifmgd, unsigned long timeout) 134 { 135 ASSERT_MGD_MTX(ifmgd); 136 137 if (!timer_pending(&ifmgd->timer) || 138 time_before(timeout, ifmgd->timer.expires)) 139 mod_timer(&ifmgd->timer, timeout); 140 } 141 142 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata) 143 { 144 if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER) 145 return; 146 147 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR) 148 return; 149 150 mod_timer(&sdata->u.mgd.bcn_mon_timer, 151 round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout)); 152 } 153 154 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata) 155 { 156 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 157 158 if (unlikely(!sdata->u.mgd.associated)) 159 return; 160 161 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR) 162 return; 163 164 mod_timer(&sdata->u.mgd.conn_mon_timer, 165 round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME)); 166 167 ifmgd->probe_send_count = 0; 168 } 169 170 static int ecw2cw(int ecw) 171 { 172 return (1 << ecw) - 1; 173 } 174 175 static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata, 176 struct ieee80211_ht_operation *ht_oper, 177 const u8 *bssid, bool reconfig) 178 { 179 struct ieee80211_local *local = sdata->local; 180 struct ieee80211_supported_band *sband; 181 struct ieee80211_chanctx_conf *chanctx_conf; 182 struct ieee80211_channel *chan; 183 struct sta_info *sta; 184 u32 changed = 0; 185 u16 ht_opmode; 186 bool disable_40 = false; 187 188 rcu_read_lock(); 189 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 190 if (WARN_ON(!chanctx_conf)) { 191 rcu_read_unlock(); 192 return 0; 193 } 194 chan = chanctx_conf->def.chan; 195 rcu_read_unlock(); 196 sband = local->hw.wiphy->bands[chan->band]; 197 198 switch (sdata->vif.bss_conf.chandef.width) { 199 case NL80211_CHAN_WIDTH_40: 200 if (sdata->vif.bss_conf.chandef.chan->center_freq > 201 sdata->vif.bss_conf.chandef.center_freq1 && 202 chan->flags & IEEE80211_CHAN_NO_HT40PLUS) 203 disable_40 = true; 204 if (sdata->vif.bss_conf.chandef.chan->center_freq < 205 sdata->vif.bss_conf.chandef.center_freq1 && 206 chan->flags & IEEE80211_CHAN_NO_HT40MINUS) 207 disable_40 = true; 208 break; 209 default: 210 break; 211 } 212 213 /* This can change during the lifetime of the BSS */ 214 if (!(ht_oper->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) 215 disable_40 = true; 216 217 mutex_lock(&local->sta_mtx); 218 sta = sta_info_get(sdata, bssid); 219 220 WARN_ON_ONCE(!sta); 221 222 if (sta && !sta->supports_40mhz) 223 disable_40 = true; 224 225 if (sta && (!reconfig || 226 (disable_40 != !(sta->sta.ht_cap.cap & 227 IEEE80211_HT_CAP_SUP_WIDTH_20_40)))) { 228 229 if (disable_40) 230 sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40; 231 else 232 sta->sta.ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40; 233 234 rate_control_rate_update(local, sband, sta, 235 IEEE80211_RC_BW_CHANGED); 236 } 237 mutex_unlock(&local->sta_mtx); 238 239 ht_opmode = le16_to_cpu(ht_oper->operation_mode); 240 241 /* if bss configuration changed store the new one */ 242 if (!reconfig || (sdata->vif.bss_conf.ht_operation_mode != ht_opmode)) { 243 changed |= BSS_CHANGED_HT; 244 sdata->vif.bss_conf.ht_operation_mode = ht_opmode; 245 } 246 247 return changed; 248 } 249 250 /* frame sending functions */ 251 252 static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len, 253 struct ieee80211_supported_band *sband, 254 u32 *rates) 255 { 256 int i, j, count; 257 *rates = 0; 258 count = 0; 259 for (i = 0; i < supp_rates_len; i++) { 260 int rate = (supp_rates[i] & 0x7F) * 5; 261 262 for (j = 0; j < sband->n_bitrates; j++) 263 if (sband->bitrates[j].bitrate == rate) { 264 *rates |= BIT(j); 265 count++; 266 break; 267 } 268 } 269 270 return count; 271 } 272 273 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata, 274 struct sk_buff *skb, u8 ap_ht_param, 275 struct ieee80211_supported_band *sband, 276 struct ieee80211_channel *channel, 277 enum ieee80211_smps_mode smps) 278 { 279 u8 *pos; 280 u32 flags = channel->flags; 281 u16 cap; 282 struct ieee80211_sta_ht_cap ht_cap; 283 284 BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap)); 285 286 memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap)); 287 ieee80211_apply_htcap_overrides(sdata, &ht_cap); 288 289 /* determine capability flags */ 290 cap = ht_cap.cap; 291 292 switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) { 293 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE: 294 if (flags & IEEE80211_CHAN_NO_HT40PLUS) { 295 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40; 296 cap &= ~IEEE80211_HT_CAP_SGI_40; 297 } 298 break; 299 case IEEE80211_HT_PARAM_CHA_SEC_BELOW: 300 if (flags & IEEE80211_CHAN_NO_HT40MINUS) { 301 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40; 302 cap &= ~IEEE80211_HT_CAP_SGI_40; 303 } 304 break; 305 } 306 307 /* 308 * If 40 MHz was disabled associate as though we weren't 309 * capable of 40 MHz -- some broken APs will never fall 310 * back to trying to transmit in 20 MHz. 311 */ 312 if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) { 313 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40; 314 cap &= ~IEEE80211_HT_CAP_SGI_40; 315 } 316 317 /* set SM PS mode properly */ 318 cap &= ~IEEE80211_HT_CAP_SM_PS; 319 switch (smps) { 320 case IEEE80211_SMPS_AUTOMATIC: 321 case IEEE80211_SMPS_NUM_MODES: 322 WARN_ON(1); 323 case IEEE80211_SMPS_OFF: 324 cap |= WLAN_HT_CAP_SM_PS_DISABLED << 325 IEEE80211_HT_CAP_SM_PS_SHIFT; 326 break; 327 case IEEE80211_SMPS_STATIC: 328 cap |= WLAN_HT_CAP_SM_PS_STATIC << 329 IEEE80211_HT_CAP_SM_PS_SHIFT; 330 break; 331 case IEEE80211_SMPS_DYNAMIC: 332 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC << 333 IEEE80211_HT_CAP_SM_PS_SHIFT; 334 break; 335 } 336 337 /* reserve and fill IE */ 338 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2); 339 ieee80211_ie_build_ht_cap(pos, &ht_cap, cap); 340 } 341 342 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata, 343 struct sk_buff *skb, 344 struct ieee80211_supported_band *sband) 345 { 346 u8 *pos; 347 u32 cap; 348 struct ieee80211_sta_vht_cap vht_cap; 349 350 BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap)); 351 352 memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap)); 353 354 /* determine capability flags */ 355 cap = vht_cap.cap; 356 357 if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) { 358 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ; 359 cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ; 360 } 361 362 if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) { 363 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160; 364 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ; 365 } 366 367 /* reserve and fill IE */ 368 pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2); 369 ieee80211_ie_build_vht_cap(pos, &vht_cap, cap); 370 } 371 372 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata) 373 { 374 struct ieee80211_local *local = sdata->local; 375 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 376 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data; 377 struct sk_buff *skb; 378 struct ieee80211_mgmt *mgmt; 379 u8 *pos, qos_info; 380 size_t offset = 0, noffset; 381 int i, count, rates_len, supp_rates_len; 382 u16 capab; 383 struct ieee80211_supported_band *sband; 384 struct ieee80211_chanctx_conf *chanctx_conf; 385 struct ieee80211_channel *chan; 386 u32 rates = 0; 387 388 lockdep_assert_held(&ifmgd->mtx); 389 390 rcu_read_lock(); 391 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 392 if (WARN_ON(!chanctx_conf)) { 393 rcu_read_unlock(); 394 return; 395 } 396 chan = chanctx_conf->def.chan; 397 rcu_read_unlock(); 398 sband = local->hw.wiphy->bands[chan->band]; 399 400 if (assoc_data->supp_rates_len) { 401 /* 402 * Get all rates supported by the device and the AP as 403 * some APs don't like getting a superset of their rates 404 * in the association request (e.g. D-Link DAP 1353 in 405 * b-only mode)... 406 */ 407 rates_len = ieee80211_compatible_rates(assoc_data->supp_rates, 408 assoc_data->supp_rates_len, 409 sband, &rates); 410 } else { 411 /* 412 * In case AP not provide any supported rates information 413 * before association, we send information element(s) with 414 * all rates that we support. 415 */ 416 rates = ~0; 417 rates_len = sband->n_bitrates; 418 } 419 420 skb = alloc_skb(local->hw.extra_tx_headroom + 421 sizeof(*mgmt) + /* bit too much but doesn't matter */ 422 2 + assoc_data->ssid_len + /* SSID */ 423 4 + rates_len + /* (extended) rates */ 424 4 + /* power capability */ 425 2 + 2 * sband->n_channels + /* supported channels */ 426 2 + sizeof(struct ieee80211_ht_cap) + /* HT */ 427 2 + sizeof(struct ieee80211_vht_cap) + /* VHT */ 428 assoc_data->ie_len + /* extra IEs */ 429 9, /* WMM */ 430 GFP_KERNEL); 431 if (!skb) 432 return; 433 434 skb_reserve(skb, local->hw.extra_tx_headroom); 435 436 capab = WLAN_CAPABILITY_ESS; 437 438 if (sband->band == IEEE80211_BAND_2GHZ) { 439 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE)) 440 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME; 441 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE)) 442 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE; 443 } 444 445 if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY) 446 capab |= WLAN_CAPABILITY_PRIVACY; 447 448 if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) && 449 (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT)) 450 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT; 451 452 mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24); 453 memset(mgmt, 0, 24); 454 memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN); 455 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN); 456 memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN); 457 458 if (!is_zero_ether_addr(assoc_data->prev_bssid)) { 459 skb_put(skb, 10); 460 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 461 IEEE80211_STYPE_REASSOC_REQ); 462 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab); 463 mgmt->u.reassoc_req.listen_interval = 464 cpu_to_le16(local->hw.conf.listen_interval); 465 memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid, 466 ETH_ALEN); 467 } else { 468 skb_put(skb, 4); 469 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 470 IEEE80211_STYPE_ASSOC_REQ); 471 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab); 472 mgmt->u.assoc_req.listen_interval = 473 cpu_to_le16(local->hw.conf.listen_interval); 474 } 475 476 /* SSID */ 477 pos = skb_put(skb, 2 + assoc_data->ssid_len); 478 *pos++ = WLAN_EID_SSID; 479 *pos++ = assoc_data->ssid_len; 480 memcpy(pos, assoc_data->ssid, assoc_data->ssid_len); 481 482 /* add all rates which were marked to be used above */ 483 supp_rates_len = rates_len; 484 if (supp_rates_len > 8) 485 supp_rates_len = 8; 486 487 pos = skb_put(skb, supp_rates_len + 2); 488 *pos++ = WLAN_EID_SUPP_RATES; 489 *pos++ = supp_rates_len; 490 491 count = 0; 492 for (i = 0; i < sband->n_bitrates; i++) { 493 if (BIT(i) & rates) { 494 int rate = sband->bitrates[i].bitrate; 495 *pos++ = (u8) (rate / 5); 496 if (++count == 8) 497 break; 498 } 499 } 500 501 if (rates_len > count) { 502 pos = skb_put(skb, rates_len - count + 2); 503 *pos++ = WLAN_EID_EXT_SUPP_RATES; 504 *pos++ = rates_len - count; 505 506 for (i++; i < sband->n_bitrates; i++) { 507 if (BIT(i) & rates) { 508 int rate = sband->bitrates[i].bitrate; 509 *pos++ = (u8) (rate / 5); 510 } 511 } 512 } 513 514 if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) { 515 /* 1. power capabilities */ 516 pos = skb_put(skb, 4); 517 *pos++ = WLAN_EID_PWR_CAPABILITY; 518 *pos++ = 2; 519 *pos++ = 0; /* min tx power */ 520 *pos++ = chan->max_power; /* max tx power */ 521 522 /* 2. supported channels */ 523 /* TODO: get this in reg domain format */ 524 pos = skb_put(skb, 2 * sband->n_channels + 2); 525 *pos++ = WLAN_EID_SUPPORTED_CHANNELS; 526 *pos++ = 2 * sband->n_channels; 527 for (i = 0; i < sband->n_channels; i++) { 528 *pos++ = ieee80211_frequency_to_channel( 529 sband->channels[i].center_freq); 530 *pos++ = 1; /* one channel in the subband*/ 531 } 532 } 533 534 /* if present, add any custom IEs that go before HT */ 535 if (assoc_data->ie_len && assoc_data->ie) { 536 static const u8 before_ht[] = { 537 WLAN_EID_SSID, 538 WLAN_EID_SUPP_RATES, 539 WLAN_EID_EXT_SUPP_RATES, 540 WLAN_EID_PWR_CAPABILITY, 541 WLAN_EID_SUPPORTED_CHANNELS, 542 WLAN_EID_RSN, 543 WLAN_EID_QOS_CAPA, 544 WLAN_EID_RRM_ENABLED_CAPABILITIES, 545 WLAN_EID_MOBILITY_DOMAIN, 546 WLAN_EID_SUPPORTED_REGULATORY_CLASSES, 547 }; 548 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len, 549 before_ht, ARRAY_SIZE(before_ht), 550 offset); 551 pos = skb_put(skb, noffset - offset); 552 memcpy(pos, assoc_data->ie + offset, noffset - offset); 553 offset = noffset; 554 } 555 556 if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) && 557 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))) 558 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT; 559 560 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) 561 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param, 562 sband, chan, sdata->smps_mode); 563 564 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) 565 ieee80211_add_vht_ie(sdata, skb, sband); 566 567 /* if present, add any custom non-vendor IEs that go after HT */ 568 if (assoc_data->ie_len && assoc_data->ie) { 569 noffset = ieee80211_ie_split_vendor(assoc_data->ie, 570 assoc_data->ie_len, 571 offset); 572 pos = skb_put(skb, noffset - offset); 573 memcpy(pos, assoc_data->ie + offset, noffset - offset); 574 offset = noffset; 575 } 576 577 if (assoc_data->wmm) { 578 if (assoc_data->uapsd) { 579 qos_info = ifmgd->uapsd_queues; 580 qos_info |= (ifmgd->uapsd_max_sp_len << 581 IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT); 582 } else { 583 qos_info = 0; 584 } 585 586 pos = skb_put(skb, 9); 587 *pos++ = WLAN_EID_VENDOR_SPECIFIC; 588 *pos++ = 7; /* len */ 589 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */ 590 *pos++ = 0x50; 591 *pos++ = 0xf2; 592 *pos++ = 2; /* WME */ 593 *pos++ = 0; /* WME info */ 594 *pos++ = 1; /* WME ver */ 595 *pos++ = qos_info; 596 } 597 598 /* add any remaining custom (i.e. vendor specific here) IEs */ 599 if (assoc_data->ie_len && assoc_data->ie) { 600 noffset = assoc_data->ie_len; 601 pos = skb_put(skb, noffset - offset); 602 memcpy(pos, assoc_data->ie + offset, noffset - offset); 603 } 604 605 drv_mgd_prepare_tx(local, sdata); 606 607 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; 608 ieee80211_tx_skb(sdata, skb); 609 } 610 611 void ieee80211_send_pspoll(struct ieee80211_local *local, 612 struct ieee80211_sub_if_data *sdata) 613 { 614 struct ieee80211_pspoll *pspoll; 615 struct sk_buff *skb; 616 617 skb = ieee80211_pspoll_get(&local->hw, &sdata->vif); 618 if (!skb) 619 return; 620 621 pspoll = (struct ieee80211_pspoll *) skb->data; 622 pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM); 623 624 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; 625 ieee80211_tx_skb(sdata, skb); 626 } 627 628 void ieee80211_send_nullfunc(struct ieee80211_local *local, 629 struct ieee80211_sub_if_data *sdata, 630 int powersave) 631 { 632 struct sk_buff *skb; 633 struct ieee80211_hdr_3addr *nullfunc; 634 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 635 636 skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif); 637 if (!skb) 638 return; 639 640 nullfunc = (struct ieee80211_hdr_3addr *) skb->data; 641 if (powersave) 642 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM); 643 644 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; 645 if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL | 646 IEEE80211_STA_CONNECTION_POLL)) 647 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE; 648 649 ieee80211_tx_skb(sdata, skb); 650 } 651 652 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local, 653 struct ieee80211_sub_if_data *sdata) 654 { 655 struct sk_buff *skb; 656 struct ieee80211_hdr *nullfunc; 657 __le16 fc; 658 659 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION)) 660 return; 661 662 skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30); 663 if (!skb) 664 return; 665 666 skb_reserve(skb, local->hw.extra_tx_headroom); 667 668 nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30); 669 memset(nullfunc, 0, 30); 670 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC | 671 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS); 672 nullfunc->frame_control = fc; 673 memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN); 674 memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN); 675 memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN); 676 memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN); 677 678 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; 679 ieee80211_tx_skb(sdata, skb); 680 } 681 682 /* spectrum management related things */ 683 static void ieee80211_chswitch_work(struct work_struct *work) 684 { 685 struct ieee80211_sub_if_data *sdata = 686 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work); 687 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 688 689 if (!ieee80211_sdata_running(sdata)) 690 return; 691 692 mutex_lock(&ifmgd->mtx); 693 if (!ifmgd->associated) 694 goto out; 695 696 sdata->local->_oper_channel = sdata->local->csa_channel; 697 if (!sdata->local->ops->channel_switch) { 698 /* call "hw_config" only if doing sw channel switch */ 699 ieee80211_hw_config(sdata->local, 700 IEEE80211_CONF_CHANGE_CHANNEL); 701 } else { 702 /* update the device channel directly */ 703 sdata->local->hw.conf.channel = sdata->local->_oper_channel; 704 } 705 706 /* XXX: shouldn't really modify cfg80211-owned data! */ 707 ifmgd->associated->channel = sdata->local->_oper_channel; 708 709 /* XXX: wait for a beacon first? */ 710 ieee80211_wake_queues_by_reason(&sdata->local->hw, 711 IEEE80211_QUEUE_STOP_REASON_CSA); 712 out: 713 ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED; 714 mutex_unlock(&ifmgd->mtx); 715 } 716 717 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success) 718 { 719 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 720 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 721 722 trace_api_chswitch_done(sdata, success); 723 if (!success) { 724 sdata_info(sdata, 725 "driver channel switch failed, disconnecting\n"); 726 ieee80211_queue_work(&sdata->local->hw, 727 &ifmgd->csa_connection_drop_work); 728 } else { 729 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work); 730 } 731 } 732 EXPORT_SYMBOL(ieee80211_chswitch_done); 733 734 static void ieee80211_chswitch_timer(unsigned long data) 735 { 736 struct ieee80211_sub_if_data *sdata = 737 (struct ieee80211_sub_if_data *) data; 738 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 739 740 if (sdata->local->quiescing) { 741 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running); 742 return; 743 } 744 745 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work); 746 } 747 748 void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata, 749 struct ieee80211_channel_sw_ie *sw_elem, 750 struct ieee80211_bss *bss, 751 u64 timestamp) 752 { 753 struct cfg80211_bss *cbss = 754 container_of((void *)bss, struct cfg80211_bss, priv); 755 struct ieee80211_channel *new_ch; 756 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 757 int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num, 758 cbss->channel->band); 759 struct ieee80211_chanctx *chanctx; 760 761 ASSERT_MGD_MTX(ifmgd); 762 763 if (!ifmgd->associated) 764 return; 765 766 if (sdata->local->scanning) 767 return; 768 769 /* Disregard subsequent beacons if we are already running a timer 770 processing a CSA */ 771 772 if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED) 773 return; 774 775 new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq); 776 if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED) { 777 sdata_info(sdata, 778 "AP %pM switches to unsupported channel (%d MHz), disconnecting\n", 779 ifmgd->associated->bssid, new_freq); 780 ieee80211_queue_work(&sdata->local->hw, 781 &ifmgd->csa_connection_drop_work); 782 return; 783 } 784 785 ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED; 786 787 if (sdata->local->use_chanctx) { 788 sdata_info(sdata, 789 "not handling channel switch with channel contexts\n"); 790 ieee80211_queue_work(&sdata->local->hw, 791 &ifmgd->csa_connection_drop_work); 792 return; 793 } 794 795 mutex_lock(&sdata->local->chanctx_mtx); 796 if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) { 797 mutex_unlock(&sdata->local->chanctx_mtx); 798 return; 799 } 800 chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf), 801 struct ieee80211_chanctx, conf); 802 if (chanctx->refcount > 1) { 803 sdata_info(sdata, 804 "channel switch with multiple interfaces on the same channel, disconnecting\n"); 805 ieee80211_queue_work(&sdata->local->hw, 806 &ifmgd->csa_connection_drop_work); 807 mutex_unlock(&sdata->local->chanctx_mtx); 808 return; 809 } 810 mutex_unlock(&sdata->local->chanctx_mtx); 811 812 sdata->local->csa_channel = new_ch; 813 814 if (sw_elem->mode) 815 ieee80211_stop_queues_by_reason(&sdata->local->hw, 816 IEEE80211_QUEUE_STOP_REASON_CSA); 817 818 if (sdata->local->ops->channel_switch) { 819 /* use driver's channel switch callback */ 820 struct ieee80211_channel_switch ch_switch = { 821 .timestamp = timestamp, 822 .block_tx = sw_elem->mode, 823 .channel = new_ch, 824 .count = sw_elem->count, 825 }; 826 827 drv_channel_switch(sdata->local, &ch_switch); 828 return; 829 } 830 831 /* channel switch handled in software */ 832 if (sw_elem->count <= 1) 833 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work); 834 else 835 mod_timer(&ifmgd->chswitch_timer, 836 TU_TO_EXP_TIME(sw_elem->count * 837 cbss->beacon_interval)); 838 } 839 840 static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata, 841 struct ieee80211_channel *channel, 842 const u8 *country_ie, u8 country_ie_len, 843 const u8 *pwr_constr_elem) 844 { 845 struct ieee80211_country_ie_triplet *triplet; 846 int chan = ieee80211_frequency_to_channel(channel->center_freq); 847 int i, chan_pwr, chan_increment, new_ap_level; 848 bool have_chan_pwr = false; 849 850 /* Invalid IE */ 851 if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN) 852 return 0; 853 854 triplet = (void *)(country_ie + 3); 855 country_ie_len -= 3; 856 857 switch (channel->band) { 858 default: 859 WARN_ON_ONCE(1); 860 /* fall through */ 861 case IEEE80211_BAND_2GHZ: 862 case IEEE80211_BAND_60GHZ: 863 chan_increment = 1; 864 break; 865 case IEEE80211_BAND_5GHZ: 866 chan_increment = 4; 867 break; 868 } 869 870 /* find channel */ 871 while (country_ie_len >= 3) { 872 u8 first_channel = triplet->chans.first_channel; 873 874 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID) 875 goto next; 876 877 for (i = 0; i < triplet->chans.num_channels; i++) { 878 if (first_channel + i * chan_increment == chan) { 879 have_chan_pwr = true; 880 chan_pwr = triplet->chans.max_power; 881 break; 882 } 883 } 884 if (have_chan_pwr) 885 break; 886 887 next: 888 triplet++; 889 country_ie_len -= 3; 890 } 891 892 if (!have_chan_pwr) 893 return 0; 894 895 new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem); 896 897 if (sdata->ap_power_level == new_ap_level) 898 return 0; 899 900 sdata_info(sdata, 901 "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n", 902 new_ap_level, chan_pwr, *pwr_constr_elem, 903 sdata->u.mgd.bssid); 904 sdata->ap_power_level = new_ap_level; 905 if (__ieee80211_recalc_txpower(sdata)) 906 return BSS_CHANGED_TXPOWER; 907 return 0; 908 } 909 910 void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif) 911 { 912 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 913 struct ieee80211_local *local = sdata->local; 914 struct ieee80211_conf *conf = &local->hw.conf; 915 916 WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION || 917 !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) || 918 (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)); 919 920 local->disable_dynamic_ps = false; 921 conf->dynamic_ps_timeout = local->dynamic_ps_user_timeout; 922 } 923 EXPORT_SYMBOL(ieee80211_enable_dyn_ps); 924 925 void ieee80211_disable_dyn_ps(struct ieee80211_vif *vif) 926 { 927 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 928 struct ieee80211_local *local = sdata->local; 929 struct ieee80211_conf *conf = &local->hw.conf; 930 931 WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION || 932 !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) || 933 (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)); 934 935 local->disable_dynamic_ps = true; 936 conf->dynamic_ps_timeout = 0; 937 del_timer_sync(&local->dynamic_ps_timer); 938 ieee80211_queue_work(&local->hw, 939 &local->dynamic_ps_enable_work); 940 } 941 EXPORT_SYMBOL(ieee80211_disable_dyn_ps); 942 943 /* powersave */ 944 static void ieee80211_enable_ps(struct ieee80211_local *local, 945 struct ieee80211_sub_if_data *sdata) 946 { 947 struct ieee80211_conf *conf = &local->hw.conf; 948 949 /* 950 * If we are scanning right now then the parameters will 951 * take effect when scan finishes. 952 */ 953 if (local->scanning) 954 return; 955 956 if (conf->dynamic_ps_timeout > 0 && 957 !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) { 958 mod_timer(&local->dynamic_ps_timer, jiffies + 959 msecs_to_jiffies(conf->dynamic_ps_timeout)); 960 } else { 961 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) 962 ieee80211_send_nullfunc(local, sdata, 1); 963 964 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) && 965 (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) 966 return; 967 968 conf->flags |= IEEE80211_CONF_PS; 969 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 970 } 971 } 972 973 static void ieee80211_change_ps(struct ieee80211_local *local) 974 { 975 struct ieee80211_conf *conf = &local->hw.conf; 976 977 if (local->ps_sdata) { 978 ieee80211_enable_ps(local, local->ps_sdata); 979 } else if (conf->flags & IEEE80211_CONF_PS) { 980 conf->flags &= ~IEEE80211_CONF_PS; 981 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 982 del_timer_sync(&local->dynamic_ps_timer); 983 cancel_work_sync(&local->dynamic_ps_enable_work); 984 } 985 } 986 987 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata) 988 { 989 struct ieee80211_if_managed *mgd = &sdata->u.mgd; 990 struct sta_info *sta = NULL; 991 bool authorized = false; 992 993 if (!mgd->powersave) 994 return false; 995 996 if (mgd->broken_ap) 997 return false; 998 999 if (!mgd->associated) 1000 return false; 1001 1002 if (mgd->flags & (IEEE80211_STA_BEACON_POLL | 1003 IEEE80211_STA_CONNECTION_POLL)) 1004 return false; 1005 1006 rcu_read_lock(); 1007 sta = sta_info_get(sdata, mgd->bssid); 1008 if (sta) 1009 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED); 1010 rcu_read_unlock(); 1011 1012 return authorized; 1013 } 1014 1015 /* need to hold RTNL or interface lock */ 1016 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency) 1017 { 1018 struct ieee80211_sub_if_data *sdata, *found = NULL; 1019 int count = 0; 1020 int timeout; 1021 1022 if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) { 1023 local->ps_sdata = NULL; 1024 return; 1025 } 1026 1027 list_for_each_entry(sdata, &local->interfaces, list) { 1028 if (!ieee80211_sdata_running(sdata)) 1029 continue; 1030 if (sdata->vif.type == NL80211_IFTYPE_AP) { 1031 /* If an AP vif is found, then disable PS 1032 * by setting the count to zero thereby setting 1033 * ps_sdata to NULL. 1034 */ 1035 count = 0; 1036 break; 1037 } 1038 if (sdata->vif.type != NL80211_IFTYPE_STATION) 1039 continue; 1040 found = sdata; 1041 count++; 1042 } 1043 1044 if (count == 1 && ieee80211_powersave_allowed(found)) { 1045 struct ieee80211_conf *conf = &local->hw.conf; 1046 s32 beaconint_us; 1047 1048 if (latency < 0) 1049 latency = pm_qos_request(PM_QOS_NETWORK_LATENCY); 1050 1051 beaconint_us = ieee80211_tu_to_usec( 1052 found->vif.bss_conf.beacon_int); 1053 1054 timeout = local->dynamic_ps_forced_timeout; 1055 if (timeout < 0) { 1056 /* 1057 * Go to full PSM if the user configures a very low 1058 * latency requirement. 1059 * The 2000 second value is there for compatibility 1060 * until the PM_QOS_NETWORK_LATENCY is configured 1061 * with real values. 1062 */ 1063 if (latency > (1900 * USEC_PER_MSEC) && 1064 latency != (2000 * USEC_PER_SEC)) 1065 timeout = 0; 1066 else 1067 timeout = 100; 1068 } 1069 local->dynamic_ps_user_timeout = timeout; 1070 if (!local->disable_dynamic_ps) 1071 conf->dynamic_ps_timeout = 1072 local->dynamic_ps_user_timeout; 1073 1074 if (beaconint_us > latency) { 1075 local->ps_sdata = NULL; 1076 } else { 1077 struct ieee80211_bss *bss; 1078 int maxslp = 1; 1079 u8 dtimper; 1080 1081 bss = (void *)found->u.mgd.associated->priv; 1082 dtimper = bss->dtim_period; 1083 1084 /* If the TIM IE is invalid, pretend the value is 1 */ 1085 if (!dtimper) 1086 dtimper = 1; 1087 else if (dtimper > 1) 1088 maxslp = min_t(int, dtimper, 1089 latency / beaconint_us); 1090 1091 local->hw.conf.max_sleep_period = maxslp; 1092 local->hw.conf.ps_dtim_period = dtimper; 1093 local->ps_sdata = found; 1094 } 1095 } else { 1096 local->ps_sdata = NULL; 1097 } 1098 1099 ieee80211_change_ps(local); 1100 } 1101 1102 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata) 1103 { 1104 bool ps_allowed = ieee80211_powersave_allowed(sdata); 1105 1106 if (sdata->vif.bss_conf.ps != ps_allowed) { 1107 sdata->vif.bss_conf.ps = ps_allowed; 1108 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS); 1109 } 1110 } 1111 1112 void ieee80211_dynamic_ps_disable_work(struct work_struct *work) 1113 { 1114 struct ieee80211_local *local = 1115 container_of(work, struct ieee80211_local, 1116 dynamic_ps_disable_work); 1117 1118 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 1119 local->hw.conf.flags &= ~IEEE80211_CONF_PS; 1120 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 1121 } 1122 1123 ieee80211_wake_queues_by_reason(&local->hw, 1124 IEEE80211_QUEUE_STOP_REASON_PS); 1125 } 1126 1127 void ieee80211_dynamic_ps_enable_work(struct work_struct *work) 1128 { 1129 struct ieee80211_local *local = 1130 container_of(work, struct ieee80211_local, 1131 dynamic_ps_enable_work); 1132 struct ieee80211_sub_if_data *sdata = local->ps_sdata; 1133 struct ieee80211_if_managed *ifmgd; 1134 unsigned long flags; 1135 int q; 1136 1137 /* can only happen when PS was just disabled anyway */ 1138 if (!sdata) 1139 return; 1140 1141 ifmgd = &sdata->u.mgd; 1142 1143 if (local->hw.conf.flags & IEEE80211_CONF_PS) 1144 return; 1145 1146 if (!local->disable_dynamic_ps && 1147 local->hw.conf.dynamic_ps_timeout > 0) { 1148 /* don't enter PS if TX frames are pending */ 1149 if (drv_tx_frames_pending(local)) { 1150 mod_timer(&local->dynamic_ps_timer, jiffies + 1151 msecs_to_jiffies( 1152 local->hw.conf.dynamic_ps_timeout)); 1153 return; 1154 } 1155 1156 /* 1157 * transmission can be stopped by others which leads to 1158 * dynamic_ps_timer expiry. Postpone the ps timer if it 1159 * is not the actual idle state. 1160 */ 1161 spin_lock_irqsave(&local->queue_stop_reason_lock, flags); 1162 for (q = 0; q < local->hw.queues; q++) { 1163 if (local->queue_stop_reasons[q]) { 1164 spin_unlock_irqrestore(&local->queue_stop_reason_lock, 1165 flags); 1166 mod_timer(&local->dynamic_ps_timer, jiffies + 1167 msecs_to_jiffies( 1168 local->hw.conf.dynamic_ps_timeout)); 1169 return; 1170 } 1171 } 1172 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); 1173 } 1174 1175 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) && 1176 !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) { 1177 netif_tx_stop_all_queues(sdata->dev); 1178 1179 if (drv_tx_frames_pending(local)) 1180 mod_timer(&local->dynamic_ps_timer, jiffies + 1181 msecs_to_jiffies( 1182 local->hw.conf.dynamic_ps_timeout)); 1183 else { 1184 ieee80211_send_nullfunc(local, sdata, 1); 1185 /* Flush to get the tx status of nullfunc frame */ 1186 drv_flush(local, false); 1187 } 1188 } 1189 1190 if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) && 1191 (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) || 1192 (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) { 1193 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED; 1194 local->hw.conf.flags |= IEEE80211_CONF_PS; 1195 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 1196 } 1197 1198 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) 1199 netif_tx_wake_all_queues(sdata->dev); 1200 } 1201 1202 void ieee80211_dynamic_ps_timer(unsigned long data) 1203 { 1204 struct ieee80211_local *local = (void *) data; 1205 1206 if (local->quiescing || local->suspended) 1207 return; 1208 1209 ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work); 1210 } 1211 1212 /* MLME */ 1213 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local, 1214 struct ieee80211_sub_if_data *sdata, 1215 u8 *wmm_param, size_t wmm_param_len) 1216 { 1217 struct ieee80211_tx_queue_params params; 1218 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1219 size_t left; 1220 int count; 1221 u8 *pos, uapsd_queues = 0; 1222 1223 if (!local->ops->conf_tx) 1224 return false; 1225 1226 if (local->hw.queues < IEEE80211_NUM_ACS) 1227 return false; 1228 1229 if (!wmm_param) 1230 return false; 1231 1232 if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1) 1233 return false; 1234 1235 if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) 1236 uapsd_queues = ifmgd->uapsd_queues; 1237 1238 count = wmm_param[6] & 0x0f; 1239 if (count == ifmgd->wmm_last_param_set) 1240 return false; 1241 ifmgd->wmm_last_param_set = count; 1242 1243 pos = wmm_param + 8; 1244 left = wmm_param_len - 8; 1245 1246 memset(¶ms, 0, sizeof(params)); 1247 1248 sdata->wmm_acm = 0; 1249 for (; left >= 4; left -= 4, pos += 4) { 1250 int aci = (pos[0] >> 5) & 0x03; 1251 int acm = (pos[0] >> 4) & 0x01; 1252 bool uapsd = false; 1253 int queue; 1254 1255 switch (aci) { 1256 case 1: /* AC_BK */ 1257 queue = 3; 1258 if (acm) 1259 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */ 1260 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) 1261 uapsd = true; 1262 break; 1263 case 2: /* AC_VI */ 1264 queue = 1; 1265 if (acm) 1266 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */ 1267 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) 1268 uapsd = true; 1269 break; 1270 case 3: /* AC_VO */ 1271 queue = 0; 1272 if (acm) 1273 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */ 1274 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) 1275 uapsd = true; 1276 break; 1277 case 0: /* AC_BE */ 1278 default: 1279 queue = 2; 1280 if (acm) 1281 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */ 1282 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) 1283 uapsd = true; 1284 break; 1285 } 1286 1287 params.aifs = pos[0] & 0x0f; 1288 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4); 1289 params.cw_min = ecw2cw(pos[1] & 0x0f); 1290 params.txop = get_unaligned_le16(pos + 2); 1291 params.uapsd = uapsd; 1292 1293 mlme_dbg(sdata, 1294 "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n", 1295 queue, aci, acm, 1296 params.aifs, params.cw_min, params.cw_max, 1297 params.txop, params.uapsd); 1298 sdata->tx_conf[queue] = params; 1299 if (drv_conf_tx(local, sdata, queue, ¶ms)) 1300 sdata_err(sdata, 1301 "failed to set TX queue parameters for queue %d\n", 1302 queue); 1303 } 1304 1305 /* enable WMM or activate new settings */ 1306 sdata->vif.bss_conf.qos = true; 1307 return true; 1308 } 1309 1310 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata) 1311 { 1312 lockdep_assert_held(&sdata->local->mtx); 1313 1314 sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL | 1315 IEEE80211_STA_BEACON_POLL); 1316 ieee80211_run_deferred_scan(sdata->local); 1317 } 1318 1319 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata) 1320 { 1321 mutex_lock(&sdata->local->mtx); 1322 __ieee80211_stop_poll(sdata); 1323 mutex_unlock(&sdata->local->mtx); 1324 } 1325 1326 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata, 1327 u16 capab, bool erp_valid, u8 erp) 1328 { 1329 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf; 1330 u32 changed = 0; 1331 bool use_protection; 1332 bool use_short_preamble; 1333 bool use_short_slot; 1334 1335 if (erp_valid) { 1336 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0; 1337 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0; 1338 } else { 1339 use_protection = false; 1340 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE); 1341 } 1342 1343 use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME); 1344 if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ) 1345 use_short_slot = true; 1346 1347 if (use_protection != bss_conf->use_cts_prot) { 1348 bss_conf->use_cts_prot = use_protection; 1349 changed |= BSS_CHANGED_ERP_CTS_PROT; 1350 } 1351 1352 if (use_short_preamble != bss_conf->use_short_preamble) { 1353 bss_conf->use_short_preamble = use_short_preamble; 1354 changed |= BSS_CHANGED_ERP_PREAMBLE; 1355 } 1356 1357 if (use_short_slot != bss_conf->use_short_slot) { 1358 bss_conf->use_short_slot = use_short_slot; 1359 changed |= BSS_CHANGED_ERP_SLOT; 1360 } 1361 1362 return changed; 1363 } 1364 1365 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata, 1366 struct cfg80211_bss *cbss, 1367 u32 bss_info_changed) 1368 { 1369 struct ieee80211_bss *bss = (void *)cbss->priv; 1370 struct ieee80211_local *local = sdata->local; 1371 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf; 1372 1373 bss_info_changed |= BSS_CHANGED_ASSOC; 1374 bss_info_changed |= ieee80211_handle_bss_capability(sdata, 1375 bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value); 1376 1377 sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec( 1378 IEEE80211_BEACON_LOSS_COUNT * bss_conf->beacon_int)); 1379 1380 sdata->u.mgd.associated = cbss; 1381 memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN); 1382 1383 sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE; 1384 1385 if (sdata->vif.p2p) { 1386 const struct cfg80211_bss_ies *ies; 1387 1388 rcu_read_lock(); 1389 ies = rcu_dereference(cbss->ies); 1390 if (ies) { 1391 u8 noa[2]; 1392 int ret; 1393 1394 ret = cfg80211_get_p2p_attr( 1395 ies->data, ies->len, 1396 IEEE80211_P2P_ATTR_ABSENCE_NOTICE, 1397 noa, sizeof(noa)); 1398 if (ret >= 2) { 1399 bss_conf->p2p_oppps = noa[1] & 0x80; 1400 bss_conf->p2p_ctwindow = noa[1] & 0x7f; 1401 bss_info_changed |= BSS_CHANGED_P2P_PS; 1402 sdata->u.mgd.p2p_noa_index = noa[0]; 1403 } 1404 } 1405 rcu_read_unlock(); 1406 } 1407 1408 /* just to be sure */ 1409 ieee80211_stop_poll(sdata); 1410 1411 ieee80211_led_assoc(local, 1); 1412 1413 if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) 1414 bss_conf->dtim_period = bss->dtim_period; 1415 else 1416 bss_conf->dtim_period = 0; 1417 1418 bss_conf->assoc = 1; 1419 1420 /* Tell the driver to monitor connection quality (if supported) */ 1421 if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI && 1422 bss_conf->cqm_rssi_thold) 1423 bss_info_changed |= BSS_CHANGED_CQM; 1424 1425 /* Enable ARP filtering */ 1426 if (bss_conf->arp_filter_enabled != sdata->arp_filter_state) { 1427 bss_conf->arp_filter_enabled = sdata->arp_filter_state; 1428 bss_info_changed |= BSS_CHANGED_ARP_FILTER; 1429 } 1430 1431 ieee80211_bss_info_change_notify(sdata, bss_info_changed); 1432 1433 mutex_lock(&local->iflist_mtx); 1434 ieee80211_recalc_ps(local, -1); 1435 mutex_unlock(&local->iflist_mtx); 1436 1437 ieee80211_recalc_smps(sdata); 1438 ieee80211_recalc_ps_vif(sdata); 1439 1440 netif_tx_start_all_queues(sdata->dev); 1441 netif_carrier_on(sdata->dev); 1442 } 1443 1444 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata, 1445 u16 stype, u16 reason, bool tx, 1446 u8 *frame_buf) 1447 { 1448 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1449 struct ieee80211_local *local = sdata->local; 1450 struct sta_info *sta; 1451 u32 changed = 0; 1452 1453 ASSERT_MGD_MTX(ifmgd); 1454 1455 if (WARN_ON_ONCE(tx && !frame_buf)) 1456 return; 1457 1458 if (WARN_ON(!ifmgd->associated)) 1459 return; 1460 1461 ieee80211_stop_poll(sdata); 1462 1463 ifmgd->associated = NULL; 1464 1465 /* 1466 * we need to commit the associated = NULL change because the 1467 * scan code uses that to determine whether this iface should 1468 * go to/wake up from powersave or not -- and could otherwise 1469 * wake the queues erroneously. 1470 */ 1471 smp_mb(); 1472 1473 /* 1474 * Thus, we can only afterwards stop the queues -- to account 1475 * for the case where another CPU is finishing a scan at this 1476 * time -- we don't want the scan code to enable queues. 1477 */ 1478 1479 netif_tx_stop_all_queues(sdata->dev); 1480 netif_carrier_off(sdata->dev); 1481 1482 mutex_lock(&local->sta_mtx); 1483 sta = sta_info_get(sdata, ifmgd->bssid); 1484 if (sta) { 1485 set_sta_flag(sta, WLAN_STA_BLOCK_BA); 1486 ieee80211_sta_tear_down_BA_sessions(sta, false); 1487 } 1488 mutex_unlock(&local->sta_mtx); 1489 1490 /* 1491 * if we want to get out of ps before disassoc (why?) we have 1492 * to do it before sending disassoc, as otherwise the null-packet 1493 * won't be valid. 1494 */ 1495 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 1496 local->hw.conf.flags &= ~IEEE80211_CONF_PS; 1497 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 1498 } 1499 local->ps_sdata = NULL; 1500 1501 /* disable per-vif ps */ 1502 ieee80211_recalc_ps_vif(sdata); 1503 1504 /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */ 1505 if (tx) 1506 drv_flush(local, false); 1507 1508 /* deauthenticate/disassociate now */ 1509 if (tx || frame_buf) 1510 ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype, 1511 reason, tx, frame_buf); 1512 1513 /* flush out frame */ 1514 if (tx) 1515 drv_flush(local, false); 1516 1517 /* clear bssid only after building the needed mgmt frames */ 1518 memset(ifmgd->bssid, 0, ETH_ALEN); 1519 1520 /* remove AP and TDLS peers */ 1521 sta_info_flush(local, sdata); 1522 1523 /* finally reset all BSS / config parameters */ 1524 changed |= ieee80211_reset_erp_info(sdata); 1525 1526 ieee80211_led_assoc(local, 0); 1527 changed |= BSS_CHANGED_ASSOC; 1528 sdata->vif.bss_conf.assoc = false; 1529 1530 sdata->vif.bss_conf.p2p_ctwindow = 0; 1531 sdata->vif.bss_conf.p2p_oppps = false; 1532 1533 /* on the next assoc, re-program HT parameters */ 1534 memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa)); 1535 memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask)); 1536 1537 sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL; 1538 1539 del_timer_sync(&local->dynamic_ps_timer); 1540 cancel_work_sync(&local->dynamic_ps_enable_work); 1541 1542 /* Disable ARP filtering */ 1543 if (sdata->vif.bss_conf.arp_filter_enabled) { 1544 sdata->vif.bss_conf.arp_filter_enabled = false; 1545 changed |= BSS_CHANGED_ARP_FILTER; 1546 } 1547 1548 sdata->vif.bss_conf.qos = false; 1549 changed |= BSS_CHANGED_QOS; 1550 1551 /* The BSSID (not really interesting) and HT changed */ 1552 changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT; 1553 ieee80211_bss_info_change_notify(sdata, changed); 1554 1555 /* disassociated - set to defaults now */ 1556 ieee80211_set_wmm_default(sdata, false); 1557 1558 del_timer_sync(&sdata->u.mgd.conn_mon_timer); 1559 del_timer_sync(&sdata->u.mgd.bcn_mon_timer); 1560 del_timer_sync(&sdata->u.mgd.timer); 1561 del_timer_sync(&sdata->u.mgd.chswitch_timer); 1562 1563 sdata->u.mgd.timers_running = 0; 1564 1565 ifmgd->flags = 0; 1566 ieee80211_vif_release_channel(sdata); 1567 } 1568 1569 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata, 1570 struct ieee80211_hdr *hdr) 1571 { 1572 /* 1573 * We can postpone the mgd.timer whenever receiving unicast frames 1574 * from AP because we know that the connection is working both ways 1575 * at that time. But multicast frames (and hence also beacons) must 1576 * be ignored here, because we need to trigger the timer during 1577 * data idle periods for sending the periodic probe request to the 1578 * AP we're connected to. 1579 */ 1580 if (is_multicast_ether_addr(hdr->addr1)) 1581 return; 1582 1583 ieee80211_sta_reset_conn_monitor(sdata); 1584 } 1585 1586 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata) 1587 { 1588 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1589 struct ieee80211_local *local = sdata->local; 1590 1591 mutex_lock(&local->mtx); 1592 if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL | 1593 IEEE80211_STA_CONNECTION_POLL))) { 1594 mutex_unlock(&local->mtx); 1595 return; 1596 } 1597 1598 __ieee80211_stop_poll(sdata); 1599 1600 mutex_lock(&local->iflist_mtx); 1601 ieee80211_recalc_ps(local, -1); 1602 mutex_unlock(&local->iflist_mtx); 1603 1604 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR) 1605 goto out; 1606 1607 /* 1608 * We've received a probe response, but are not sure whether 1609 * we have or will be receiving any beacons or data, so let's 1610 * schedule the timers again, just in case. 1611 */ 1612 ieee80211_sta_reset_beacon_monitor(sdata); 1613 1614 mod_timer(&ifmgd->conn_mon_timer, 1615 round_jiffies_up(jiffies + 1616 IEEE80211_CONNECTION_IDLE_TIME)); 1617 out: 1618 mutex_unlock(&local->mtx); 1619 } 1620 1621 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata, 1622 struct ieee80211_hdr *hdr, bool ack) 1623 { 1624 if (!ieee80211_is_data(hdr->frame_control)) 1625 return; 1626 1627 if (ack) 1628 ieee80211_sta_reset_conn_monitor(sdata); 1629 1630 if (ieee80211_is_nullfunc(hdr->frame_control) && 1631 sdata->u.mgd.probe_send_count > 0) { 1632 if (ack) 1633 sdata->u.mgd.probe_send_count = 0; 1634 else 1635 sdata->u.mgd.nullfunc_failed = true; 1636 ieee80211_queue_work(&sdata->local->hw, &sdata->work); 1637 } 1638 } 1639 1640 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata) 1641 { 1642 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1643 const u8 *ssid; 1644 u8 *dst = ifmgd->associated->bssid; 1645 u8 unicast_limit = max(1, max_probe_tries - 3); 1646 1647 /* 1648 * Try sending broadcast probe requests for the last three 1649 * probe requests after the first ones failed since some 1650 * buggy APs only support broadcast probe requests. 1651 */ 1652 if (ifmgd->probe_send_count >= unicast_limit) 1653 dst = NULL; 1654 1655 /* 1656 * When the hardware reports an accurate Tx ACK status, it's 1657 * better to send a nullfunc frame instead of a probe request, 1658 * as it will kick us off the AP quickly if we aren't associated 1659 * anymore. The timeout will be reset if the frame is ACKed by 1660 * the AP. 1661 */ 1662 ifmgd->probe_send_count++; 1663 1664 if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) { 1665 ifmgd->nullfunc_failed = false; 1666 ieee80211_send_nullfunc(sdata->local, sdata, 0); 1667 } else { 1668 int ssid_len; 1669 1670 rcu_read_lock(); 1671 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID); 1672 if (WARN_ON_ONCE(ssid == NULL)) 1673 ssid_len = 0; 1674 else 1675 ssid_len = ssid[1]; 1676 1677 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL, 1678 0, (u32) -1, true, false, 1679 ifmgd->associated->channel, false); 1680 rcu_read_unlock(); 1681 } 1682 1683 ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms); 1684 run_again(ifmgd, ifmgd->probe_timeout); 1685 if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) 1686 drv_flush(sdata->local, false); 1687 } 1688 1689 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata, 1690 bool beacon) 1691 { 1692 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1693 bool already = false; 1694 1695 if (!ieee80211_sdata_running(sdata)) 1696 return; 1697 1698 mutex_lock(&ifmgd->mtx); 1699 1700 if (!ifmgd->associated) 1701 goto out; 1702 1703 mutex_lock(&sdata->local->mtx); 1704 1705 if (sdata->local->tmp_channel || sdata->local->scanning) { 1706 mutex_unlock(&sdata->local->mtx); 1707 goto out; 1708 } 1709 1710 if (beacon) 1711 mlme_dbg_ratelimited(sdata, 1712 "detected beacon loss from AP - sending probe request\n"); 1713 1714 ieee80211_cqm_rssi_notify(&sdata->vif, 1715 NL80211_CQM_RSSI_BEACON_LOSS_EVENT, GFP_KERNEL); 1716 1717 /* 1718 * The driver/our work has already reported this event or the 1719 * connection monitoring has kicked in and we have already sent 1720 * a probe request. Or maybe the AP died and the driver keeps 1721 * reporting until we disassociate... 1722 * 1723 * In either case we have to ignore the current call to this 1724 * function (except for setting the correct probe reason bit) 1725 * because otherwise we would reset the timer every time and 1726 * never check whether we received a probe response! 1727 */ 1728 if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL | 1729 IEEE80211_STA_CONNECTION_POLL)) 1730 already = true; 1731 1732 if (beacon) 1733 ifmgd->flags |= IEEE80211_STA_BEACON_POLL; 1734 else 1735 ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL; 1736 1737 mutex_unlock(&sdata->local->mtx); 1738 1739 if (already) 1740 goto out; 1741 1742 mutex_lock(&sdata->local->iflist_mtx); 1743 ieee80211_recalc_ps(sdata->local, -1); 1744 mutex_unlock(&sdata->local->iflist_mtx); 1745 1746 ifmgd->probe_send_count = 0; 1747 ieee80211_mgd_probe_ap_send(sdata); 1748 out: 1749 mutex_unlock(&ifmgd->mtx); 1750 } 1751 1752 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw, 1753 struct ieee80211_vif *vif) 1754 { 1755 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 1756 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1757 struct cfg80211_bss *cbss; 1758 struct sk_buff *skb; 1759 const u8 *ssid; 1760 int ssid_len; 1761 1762 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION)) 1763 return NULL; 1764 1765 ASSERT_MGD_MTX(ifmgd); 1766 1767 if (ifmgd->associated) 1768 cbss = ifmgd->associated; 1769 else if (ifmgd->auth_data) 1770 cbss = ifmgd->auth_data->bss; 1771 else if (ifmgd->assoc_data) 1772 cbss = ifmgd->assoc_data->bss; 1773 else 1774 return NULL; 1775 1776 rcu_read_lock(); 1777 ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID); 1778 if (WARN_ON_ONCE(ssid == NULL)) 1779 ssid_len = 0; 1780 else 1781 ssid_len = ssid[1]; 1782 1783 skb = ieee80211_build_probe_req(sdata, cbss->bssid, 1784 (u32) -1, cbss->channel, 1785 ssid + 2, ssid_len, 1786 NULL, 0, true); 1787 rcu_read_unlock(); 1788 1789 return skb; 1790 } 1791 EXPORT_SYMBOL(ieee80211_ap_probereq_get); 1792 1793 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata, 1794 bool transmit_frame) 1795 { 1796 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1797 struct ieee80211_local *local = sdata->local; 1798 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 1799 1800 mutex_lock(&ifmgd->mtx); 1801 if (!ifmgd->associated) { 1802 mutex_unlock(&ifmgd->mtx); 1803 return; 1804 } 1805 1806 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, 1807 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, 1808 transmit_frame, frame_buf); 1809 ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED; 1810 mutex_unlock(&ifmgd->mtx); 1811 1812 /* 1813 * must be outside lock due to cfg80211, 1814 * but that's not a problem. 1815 */ 1816 cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN); 1817 1818 mutex_lock(&local->mtx); 1819 ieee80211_recalc_idle(local); 1820 mutex_unlock(&local->mtx); 1821 } 1822 1823 static void ieee80211_beacon_connection_loss_work(struct work_struct *work) 1824 { 1825 struct ieee80211_sub_if_data *sdata = 1826 container_of(work, struct ieee80211_sub_if_data, 1827 u.mgd.beacon_connection_loss_work); 1828 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1829 struct sta_info *sta; 1830 1831 if (ifmgd->associated) { 1832 rcu_read_lock(); 1833 sta = sta_info_get(sdata, ifmgd->bssid); 1834 if (sta) 1835 sta->beacon_loss_count++; 1836 rcu_read_unlock(); 1837 } 1838 1839 if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR) { 1840 sdata_info(sdata, "Connection to AP %pM lost\n", 1841 ifmgd->bssid); 1842 __ieee80211_disconnect(sdata, false); 1843 } else { 1844 ieee80211_mgd_probe_ap(sdata, true); 1845 } 1846 } 1847 1848 static void ieee80211_csa_connection_drop_work(struct work_struct *work) 1849 { 1850 struct ieee80211_sub_if_data *sdata = 1851 container_of(work, struct ieee80211_sub_if_data, 1852 u.mgd.csa_connection_drop_work); 1853 1854 ieee80211_wake_queues_by_reason(&sdata->local->hw, 1855 IEEE80211_QUEUE_STOP_REASON_CSA); 1856 __ieee80211_disconnect(sdata, true); 1857 } 1858 1859 void ieee80211_beacon_loss(struct ieee80211_vif *vif) 1860 { 1861 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 1862 struct ieee80211_hw *hw = &sdata->local->hw; 1863 1864 trace_api_beacon_loss(sdata); 1865 1866 WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR); 1867 ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work); 1868 } 1869 EXPORT_SYMBOL(ieee80211_beacon_loss); 1870 1871 void ieee80211_connection_loss(struct ieee80211_vif *vif) 1872 { 1873 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 1874 struct ieee80211_hw *hw = &sdata->local->hw; 1875 1876 trace_api_connection_loss(sdata); 1877 1878 WARN_ON(!(hw->flags & IEEE80211_HW_CONNECTION_MONITOR)); 1879 ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work); 1880 } 1881 EXPORT_SYMBOL(ieee80211_connection_loss); 1882 1883 1884 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata, 1885 bool assoc) 1886 { 1887 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data; 1888 1889 lockdep_assert_held(&sdata->u.mgd.mtx); 1890 1891 if (!assoc) { 1892 sta_info_destroy_addr(sdata, auth_data->bss->bssid); 1893 1894 memset(sdata->u.mgd.bssid, 0, ETH_ALEN); 1895 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID); 1896 sdata->u.mgd.flags = 0; 1897 ieee80211_vif_release_channel(sdata); 1898 } 1899 1900 cfg80211_put_bss(auth_data->bss); 1901 kfree(auth_data); 1902 sdata->u.mgd.auth_data = NULL; 1903 } 1904 1905 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata, 1906 struct ieee80211_mgmt *mgmt, size_t len) 1907 { 1908 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data; 1909 u8 *pos; 1910 struct ieee802_11_elems elems; 1911 1912 pos = mgmt->u.auth.variable; 1913 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems); 1914 if (!elems.challenge) 1915 return; 1916 auth_data->expected_transaction = 4; 1917 drv_mgd_prepare_tx(sdata->local, sdata); 1918 ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0, 1919 elems.challenge - 2, elems.challenge_len + 2, 1920 auth_data->bss->bssid, auth_data->bss->bssid, 1921 auth_data->key, auth_data->key_len, 1922 auth_data->key_idx); 1923 } 1924 1925 static enum rx_mgmt_action __must_check 1926 ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, 1927 struct ieee80211_mgmt *mgmt, size_t len) 1928 { 1929 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1930 u8 bssid[ETH_ALEN]; 1931 u16 auth_alg, auth_transaction, status_code; 1932 struct sta_info *sta; 1933 1934 lockdep_assert_held(&ifmgd->mtx); 1935 1936 if (len < 24 + 6) 1937 return RX_MGMT_NONE; 1938 1939 if (!ifmgd->auth_data || ifmgd->auth_data->done) 1940 return RX_MGMT_NONE; 1941 1942 memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN); 1943 1944 if (!ether_addr_equal(bssid, mgmt->bssid)) 1945 return RX_MGMT_NONE; 1946 1947 auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg); 1948 auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction); 1949 status_code = le16_to_cpu(mgmt->u.auth.status_code); 1950 1951 if (auth_alg != ifmgd->auth_data->algorithm || 1952 auth_transaction != ifmgd->auth_data->expected_transaction) { 1953 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n", 1954 mgmt->sa, auth_alg, ifmgd->auth_data->algorithm, 1955 auth_transaction, 1956 ifmgd->auth_data->expected_transaction); 1957 return RX_MGMT_NONE; 1958 } 1959 1960 if (status_code != WLAN_STATUS_SUCCESS) { 1961 sdata_info(sdata, "%pM denied authentication (status %d)\n", 1962 mgmt->sa, status_code); 1963 ieee80211_destroy_auth_data(sdata, false); 1964 return RX_MGMT_CFG80211_RX_AUTH; 1965 } 1966 1967 switch (ifmgd->auth_data->algorithm) { 1968 case WLAN_AUTH_OPEN: 1969 case WLAN_AUTH_LEAP: 1970 case WLAN_AUTH_FT: 1971 case WLAN_AUTH_SAE: 1972 break; 1973 case WLAN_AUTH_SHARED_KEY: 1974 if (ifmgd->auth_data->expected_transaction != 4) { 1975 ieee80211_auth_challenge(sdata, mgmt, len); 1976 /* need another frame */ 1977 return RX_MGMT_NONE; 1978 } 1979 break; 1980 default: 1981 WARN_ONCE(1, "invalid auth alg %d", 1982 ifmgd->auth_data->algorithm); 1983 return RX_MGMT_NONE; 1984 } 1985 1986 sdata_info(sdata, "authenticated\n"); 1987 ifmgd->auth_data->done = true; 1988 ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC; 1989 run_again(ifmgd, ifmgd->auth_data->timeout); 1990 1991 if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE && 1992 ifmgd->auth_data->expected_transaction != 2) { 1993 /* 1994 * Report auth frame to user space for processing since another 1995 * round of Authentication frames is still needed. 1996 */ 1997 return RX_MGMT_CFG80211_RX_AUTH; 1998 } 1999 2000 /* move station state to auth */ 2001 mutex_lock(&sdata->local->sta_mtx); 2002 sta = sta_info_get(sdata, bssid); 2003 if (!sta) { 2004 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid); 2005 goto out_err; 2006 } 2007 if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) { 2008 sdata_info(sdata, "failed moving %pM to auth\n", bssid); 2009 goto out_err; 2010 } 2011 mutex_unlock(&sdata->local->sta_mtx); 2012 2013 return RX_MGMT_CFG80211_RX_AUTH; 2014 out_err: 2015 mutex_unlock(&sdata->local->sta_mtx); 2016 /* ignore frame -- wait for timeout */ 2017 return RX_MGMT_NONE; 2018 } 2019 2020 2021 static enum rx_mgmt_action __must_check 2022 ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, 2023 struct ieee80211_mgmt *mgmt, size_t len) 2024 { 2025 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2026 const u8 *bssid = NULL; 2027 u16 reason_code; 2028 2029 lockdep_assert_held(&ifmgd->mtx); 2030 2031 if (len < 24 + 2) 2032 return RX_MGMT_NONE; 2033 2034 if (!ifmgd->associated || 2035 !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) 2036 return RX_MGMT_NONE; 2037 2038 bssid = ifmgd->associated->bssid; 2039 2040 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); 2041 2042 sdata_info(sdata, "deauthenticated from %pM (Reason: %u)\n", 2043 bssid, reason_code); 2044 2045 ieee80211_set_disassoc(sdata, 0, 0, false, NULL); 2046 2047 mutex_lock(&sdata->local->mtx); 2048 ieee80211_recalc_idle(sdata->local); 2049 mutex_unlock(&sdata->local->mtx); 2050 2051 return RX_MGMT_CFG80211_DEAUTH; 2052 } 2053 2054 2055 static enum rx_mgmt_action __must_check 2056 ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata, 2057 struct ieee80211_mgmt *mgmt, size_t len) 2058 { 2059 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2060 u16 reason_code; 2061 2062 lockdep_assert_held(&ifmgd->mtx); 2063 2064 if (len < 24 + 2) 2065 return RX_MGMT_NONE; 2066 2067 if (!ifmgd->associated || 2068 !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) 2069 return RX_MGMT_NONE; 2070 2071 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code); 2072 2073 sdata_info(sdata, "disassociated from %pM (Reason: %u)\n", 2074 mgmt->sa, reason_code); 2075 2076 ieee80211_set_disassoc(sdata, 0, 0, false, NULL); 2077 2078 mutex_lock(&sdata->local->mtx); 2079 ieee80211_recalc_idle(sdata->local); 2080 mutex_unlock(&sdata->local->mtx); 2081 2082 return RX_MGMT_CFG80211_DISASSOC; 2083 } 2084 2085 static void ieee80211_get_rates(struct ieee80211_supported_band *sband, 2086 u8 *supp_rates, unsigned int supp_rates_len, 2087 u32 *rates, u32 *basic_rates, 2088 bool *have_higher_than_11mbit, 2089 int *min_rate, int *min_rate_index) 2090 { 2091 int i, j; 2092 2093 for (i = 0; i < supp_rates_len; i++) { 2094 int rate = (supp_rates[i] & 0x7f) * 5; 2095 bool is_basic = !!(supp_rates[i] & 0x80); 2096 2097 if (rate > 110) 2098 *have_higher_than_11mbit = true; 2099 2100 /* 2101 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009 2102 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it. 2103 * 2104 * Note: Even through the membership selector and the basic 2105 * rate flag share the same bit, they are not exactly 2106 * the same. 2107 */ 2108 if (!!(supp_rates[i] & 0x80) && 2109 (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 2110 continue; 2111 2112 for (j = 0; j < sband->n_bitrates; j++) { 2113 if (sband->bitrates[j].bitrate == rate) { 2114 *rates |= BIT(j); 2115 if (is_basic) 2116 *basic_rates |= BIT(j); 2117 if (rate < *min_rate) { 2118 *min_rate = rate; 2119 *min_rate_index = j; 2120 } 2121 break; 2122 } 2123 } 2124 } 2125 } 2126 2127 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata, 2128 bool assoc) 2129 { 2130 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data; 2131 2132 lockdep_assert_held(&sdata->u.mgd.mtx); 2133 2134 if (!assoc) { 2135 sta_info_destroy_addr(sdata, assoc_data->bss->bssid); 2136 2137 memset(sdata->u.mgd.bssid, 0, ETH_ALEN); 2138 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID); 2139 sdata->u.mgd.flags = 0; 2140 ieee80211_vif_release_channel(sdata); 2141 } 2142 2143 kfree(assoc_data); 2144 sdata->u.mgd.assoc_data = NULL; 2145 } 2146 2147 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata, 2148 struct cfg80211_bss *cbss, 2149 struct ieee80211_mgmt *mgmt, size_t len) 2150 { 2151 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2152 struct ieee80211_local *local = sdata->local; 2153 struct ieee80211_supported_band *sband; 2154 struct sta_info *sta; 2155 u8 *pos; 2156 u16 capab_info, aid; 2157 struct ieee802_11_elems elems; 2158 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf; 2159 u32 changed = 0; 2160 int err; 2161 2162 /* AssocResp and ReassocResp have identical structure */ 2163 2164 aid = le16_to_cpu(mgmt->u.assoc_resp.aid); 2165 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info); 2166 2167 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14))) 2168 sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n", 2169 aid); 2170 aid &= ~(BIT(15) | BIT(14)); 2171 2172 ifmgd->broken_ap = false; 2173 2174 if (aid == 0 || aid > IEEE80211_MAX_AID) { 2175 sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n", 2176 aid); 2177 aid = 0; 2178 ifmgd->broken_ap = true; 2179 } 2180 2181 pos = mgmt->u.assoc_resp.variable; 2182 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems); 2183 2184 if (!elems.supp_rates) { 2185 sdata_info(sdata, "no SuppRates element in AssocResp\n"); 2186 return false; 2187 } 2188 2189 ifmgd->aid = aid; 2190 2191 mutex_lock(&sdata->local->sta_mtx); 2192 /* 2193 * station info was already allocated and inserted before 2194 * the association and should be available to us 2195 */ 2196 sta = sta_info_get(sdata, cbss->bssid); 2197 if (WARN_ON(!sta)) { 2198 mutex_unlock(&sdata->local->sta_mtx); 2199 return false; 2200 } 2201 2202 sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)]; 2203 2204 if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) 2205 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband, 2206 elems.ht_cap_elem, &sta->sta.ht_cap); 2207 2208 sta->supports_40mhz = 2209 sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40; 2210 2211 if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) 2212 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband, 2213 elems.vht_cap_elem, 2214 &sta->sta.vht_cap); 2215 2216 rate_control_rate_init(sta); 2217 2218 if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) 2219 set_sta_flag(sta, WLAN_STA_MFP); 2220 2221 if (elems.wmm_param) 2222 set_sta_flag(sta, WLAN_STA_WME); 2223 2224 err = sta_info_move_state(sta, IEEE80211_STA_AUTH); 2225 if (!err) 2226 err = sta_info_move_state(sta, IEEE80211_STA_ASSOC); 2227 if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT)) 2228 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED); 2229 if (err) { 2230 sdata_info(sdata, 2231 "failed to move station %pM to desired state\n", 2232 sta->sta.addr); 2233 WARN_ON(__sta_info_destroy(sta)); 2234 mutex_unlock(&sdata->local->sta_mtx); 2235 return false; 2236 } 2237 2238 mutex_unlock(&sdata->local->sta_mtx); 2239 2240 /* 2241 * Always handle WMM once after association regardless 2242 * of the first value the AP uses. Setting -1 here has 2243 * that effect because the AP values is an unsigned 2244 * 4-bit value. 2245 */ 2246 ifmgd->wmm_last_param_set = -1; 2247 2248 if (elems.wmm_param) 2249 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param, 2250 elems.wmm_param_len); 2251 else 2252 ieee80211_set_wmm_default(sdata, false); 2253 changed |= BSS_CHANGED_QOS; 2254 2255 if (elems.ht_operation && elems.wmm_param && 2256 !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) 2257 changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation, 2258 cbss->bssid, false); 2259 2260 /* set AID and assoc capability, 2261 * ieee80211_set_associated() will tell the driver */ 2262 bss_conf->aid = aid; 2263 bss_conf->assoc_capability = capab_info; 2264 ieee80211_set_associated(sdata, cbss, changed); 2265 2266 /* 2267 * If we're using 4-addr mode, let the AP know that we're 2268 * doing so, so that it can create the STA VLAN on its side 2269 */ 2270 if (ifmgd->use_4addr) 2271 ieee80211_send_4addr_nullfunc(local, sdata); 2272 2273 /* 2274 * Start timer to probe the connection to the AP now. 2275 * Also start the timer that will detect beacon loss. 2276 */ 2277 ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt); 2278 ieee80211_sta_reset_beacon_monitor(sdata); 2279 2280 return true; 2281 } 2282 2283 static enum rx_mgmt_action __must_check 2284 ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, 2285 struct ieee80211_mgmt *mgmt, size_t len, 2286 struct cfg80211_bss **bss) 2287 { 2288 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2289 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data; 2290 u16 capab_info, status_code, aid; 2291 struct ieee802_11_elems elems; 2292 u8 *pos; 2293 bool reassoc; 2294 2295 lockdep_assert_held(&ifmgd->mtx); 2296 2297 if (!assoc_data) 2298 return RX_MGMT_NONE; 2299 if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid)) 2300 return RX_MGMT_NONE; 2301 2302 /* 2303 * AssocResp and ReassocResp have identical structure, so process both 2304 * of them in this function. 2305 */ 2306 2307 if (len < 24 + 6) 2308 return RX_MGMT_NONE; 2309 2310 reassoc = ieee80211_is_reassoc_req(mgmt->frame_control); 2311 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info); 2312 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code); 2313 aid = le16_to_cpu(mgmt->u.assoc_resp.aid); 2314 2315 sdata_info(sdata, 2316 "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n", 2317 reassoc ? "Rea" : "A", mgmt->sa, 2318 capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14)))); 2319 2320 pos = mgmt->u.assoc_resp.variable; 2321 ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems); 2322 2323 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY && 2324 elems.timeout_int && elems.timeout_int_len == 5 && 2325 elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) { 2326 u32 tu, ms; 2327 tu = get_unaligned_le32(elems.timeout_int + 1); 2328 ms = tu * 1024 / 1000; 2329 sdata_info(sdata, 2330 "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n", 2331 mgmt->sa, tu, ms); 2332 assoc_data->timeout = jiffies + msecs_to_jiffies(ms); 2333 if (ms > IEEE80211_ASSOC_TIMEOUT) 2334 run_again(ifmgd, assoc_data->timeout); 2335 return RX_MGMT_NONE; 2336 } 2337 2338 *bss = assoc_data->bss; 2339 2340 if (status_code != WLAN_STATUS_SUCCESS) { 2341 sdata_info(sdata, "%pM denied association (code=%d)\n", 2342 mgmt->sa, status_code); 2343 ieee80211_destroy_assoc_data(sdata, false); 2344 } else { 2345 if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) { 2346 /* oops -- internal error -- send timeout for now */ 2347 ieee80211_destroy_assoc_data(sdata, false); 2348 cfg80211_put_bss(*bss); 2349 return RX_MGMT_CFG80211_ASSOC_TIMEOUT; 2350 } 2351 sdata_info(sdata, "associated\n"); 2352 2353 /* 2354 * destroy assoc_data afterwards, as otherwise an idle 2355 * recalc after assoc_data is NULL but before associated 2356 * is set can cause the interface to go idle 2357 */ 2358 ieee80211_destroy_assoc_data(sdata, true); 2359 } 2360 2361 return RX_MGMT_CFG80211_RX_ASSOC; 2362 } 2363 2364 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata, 2365 struct ieee80211_mgmt *mgmt, size_t len, 2366 struct ieee80211_rx_status *rx_status, 2367 struct ieee802_11_elems *elems, 2368 bool beacon) 2369 { 2370 struct ieee80211_local *local = sdata->local; 2371 int freq; 2372 struct ieee80211_bss *bss; 2373 struct ieee80211_channel *channel; 2374 bool need_ps = false; 2375 2376 if (sdata->u.mgd.associated && 2377 ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) { 2378 bss = (void *)sdata->u.mgd.associated->priv; 2379 /* not previously set so we may need to recalc */ 2380 need_ps = !bss->dtim_period; 2381 } 2382 2383 if (elems->ds_params && elems->ds_params_len == 1) 2384 freq = ieee80211_channel_to_frequency(elems->ds_params[0], 2385 rx_status->band); 2386 else 2387 freq = rx_status->freq; 2388 2389 channel = ieee80211_get_channel(local->hw.wiphy, freq); 2390 2391 if (!channel || channel->flags & IEEE80211_CHAN_DISABLED) 2392 return; 2393 2394 bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems, 2395 channel, beacon); 2396 if (bss) 2397 ieee80211_rx_bss_put(local, bss); 2398 2399 if (!sdata->u.mgd.associated) 2400 return; 2401 2402 if (need_ps) { 2403 mutex_lock(&local->iflist_mtx); 2404 ieee80211_recalc_ps(local, -1); 2405 mutex_unlock(&local->iflist_mtx); 2406 } 2407 2408 if (elems->ch_switch_ie && 2409 memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid, ETH_ALEN) == 0) 2410 ieee80211_sta_process_chanswitch(sdata, elems->ch_switch_ie, 2411 bss, rx_status->mactime); 2412 } 2413 2414 2415 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata, 2416 struct sk_buff *skb) 2417 { 2418 struct ieee80211_mgmt *mgmt = (void *)skb->data; 2419 struct ieee80211_if_managed *ifmgd; 2420 struct ieee80211_rx_status *rx_status = (void *) skb->cb; 2421 size_t baselen, len = skb->len; 2422 struct ieee802_11_elems elems; 2423 2424 ifmgd = &sdata->u.mgd; 2425 2426 ASSERT_MGD_MTX(ifmgd); 2427 2428 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) 2429 return; /* ignore ProbeResp to foreign address */ 2430 2431 baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt; 2432 if (baselen > len) 2433 return; 2434 2435 ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen, 2436 &elems); 2437 2438 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false); 2439 2440 if (ifmgd->associated && 2441 ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) 2442 ieee80211_reset_ap_probe(sdata); 2443 2444 if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies && 2445 ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) { 2446 /* got probe response, continue with auth */ 2447 sdata_info(sdata, "direct probe responded\n"); 2448 ifmgd->auth_data->tries = 0; 2449 ifmgd->auth_data->timeout = jiffies; 2450 run_again(ifmgd, ifmgd->auth_data->timeout); 2451 } 2452 } 2453 2454 /* 2455 * This is the canonical list of information elements we care about, 2456 * the filter code also gives us all changes to the Microsoft OUI 2457 * (00:50:F2) vendor IE which is used for WMM which we need to track. 2458 * 2459 * We implement beacon filtering in software since that means we can 2460 * avoid processing the frame here and in cfg80211, and userspace 2461 * will not be able to tell whether the hardware supports it or not. 2462 * 2463 * XXX: This list needs to be dynamic -- userspace needs to be able to 2464 * add items it requires. It also needs to be able to tell us to 2465 * look out for other vendor IEs. 2466 */ 2467 static const u64 care_about_ies = 2468 (1ULL << WLAN_EID_COUNTRY) | 2469 (1ULL << WLAN_EID_ERP_INFO) | 2470 (1ULL << WLAN_EID_CHANNEL_SWITCH) | 2471 (1ULL << WLAN_EID_PWR_CONSTRAINT) | 2472 (1ULL << WLAN_EID_HT_CAPABILITY) | 2473 (1ULL << WLAN_EID_HT_OPERATION); 2474 2475 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, 2476 struct ieee80211_mgmt *mgmt, 2477 size_t len, 2478 struct ieee80211_rx_status *rx_status) 2479 { 2480 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2481 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf; 2482 size_t baselen; 2483 struct ieee802_11_elems elems; 2484 struct ieee80211_local *local = sdata->local; 2485 struct ieee80211_chanctx_conf *chanctx_conf; 2486 struct ieee80211_channel *chan; 2487 u32 changed = 0; 2488 bool erp_valid; 2489 u8 erp_value = 0; 2490 u32 ncrc; 2491 u8 *bssid; 2492 2493 lockdep_assert_held(&ifmgd->mtx); 2494 2495 /* Process beacon from the current BSS */ 2496 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt; 2497 if (baselen > len) 2498 return; 2499 2500 rcu_read_lock(); 2501 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 2502 if (!chanctx_conf) { 2503 rcu_read_unlock(); 2504 return; 2505 } 2506 2507 if (rx_status->freq != chanctx_conf->def.chan->center_freq) { 2508 rcu_read_unlock(); 2509 return; 2510 } 2511 chan = chanctx_conf->def.chan; 2512 rcu_read_unlock(); 2513 2514 if (ifmgd->assoc_data && !ifmgd->assoc_data->have_beacon && 2515 ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) { 2516 ieee802_11_parse_elems(mgmt->u.beacon.variable, 2517 len - baselen, &elems); 2518 2519 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, 2520 false); 2521 ifmgd->assoc_data->have_beacon = true; 2522 ifmgd->assoc_data->sent_assoc = false; 2523 /* continue assoc process */ 2524 ifmgd->assoc_data->timeout = jiffies; 2525 run_again(ifmgd, ifmgd->assoc_data->timeout); 2526 return; 2527 } 2528 2529 if (!ifmgd->associated || 2530 !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) 2531 return; 2532 bssid = ifmgd->associated->bssid; 2533 2534 /* Track average RSSI from the Beacon frames of the current AP */ 2535 ifmgd->last_beacon_signal = rx_status->signal; 2536 if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) { 2537 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE; 2538 ifmgd->ave_beacon_signal = rx_status->signal * 16; 2539 ifmgd->last_cqm_event_signal = 0; 2540 ifmgd->count_beacon_signal = 1; 2541 ifmgd->last_ave_beacon_signal = 0; 2542 } else { 2543 ifmgd->ave_beacon_signal = 2544 (IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 + 2545 (16 - IEEE80211_SIGNAL_AVE_WEIGHT) * 2546 ifmgd->ave_beacon_signal) / 16; 2547 ifmgd->count_beacon_signal++; 2548 } 2549 2550 if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold && 2551 ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) { 2552 int sig = ifmgd->ave_beacon_signal; 2553 int last_sig = ifmgd->last_ave_beacon_signal; 2554 2555 /* 2556 * if signal crosses either of the boundaries, invoke callback 2557 * with appropriate parameters 2558 */ 2559 if (sig > ifmgd->rssi_max_thold && 2560 (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) { 2561 ifmgd->last_ave_beacon_signal = sig; 2562 drv_rssi_callback(local, RSSI_EVENT_HIGH); 2563 } else if (sig < ifmgd->rssi_min_thold && 2564 (last_sig >= ifmgd->rssi_max_thold || 2565 last_sig == 0)) { 2566 ifmgd->last_ave_beacon_signal = sig; 2567 drv_rssi_callback(local, RSSI_EVENT_LOW); 2568 } 2569 } 2570 2571 if (bss_conf->cqm_rssi_thold && 2572 ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT && 2573 !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) { 2574 int sig = ifmgd->ave_beacon_signal / 16; 2575 int last_event = ifmgd->last_cqm_event_signal; 2576 int thold = bss_conf->cqm_rssi_thold; 2577 int hyst = bss_conf->cqm_rssi_hyst; 2578 if (sig < thold && 2579 (last_event == 0 || sig < last_event - hyst)) { 2580 ifmgd->last_cqm_event_signal = sig; 2581 ieee80211_cqm_rssi_notify( 2582 &sdata->vif, 2583 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW, 2584 GFP_KERNEL); 2585 } else if (sig > thold && 2586 (last_event == 0 || sig > last_event + hyst)) { 2587 ifmgd->last_cqm_event_signal = sig; 2588 ieee80211_cqm_rssi_notify( 2589 &sdata->vif, 2590 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH, 2591 GFP_KERNEL); 2592 } 2593 } 2594 2595 if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) { 2596 mlme_dbg_ratelimited(sdata, 2597 "cancelling probereq poll due to a received beacon\n"); 2598 mutex_lock(&local->mtx); 2599 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL; 2600 ieee80211_run_deferred_scan(local); 2601 mutex_unlock(&local->mtx); 2602 2603 mutex_lock(&local->iflist_mtx); 2604 ieee80211_recalc_ps(local, -1); 2605 mutex_unlock(&local->iflist_mtx); 2606 } 2607 2608 /* 2609 * Push the beacon loss detection into the future since 2610 * we are processing a beacon from the AP just now. 2611 */ 2612 ieee80211_sta_reset_beacon_monitor(sdata); 2613 2614 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4); 2615 ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable, 2616 len - baselen, &elems, 2617 care_about_ies, ncrc); 2618 2619 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) { 2620 bool directed_tim = ieee80211_check_tim(elems.tim, 2621 elems.tim_len, 2622 ifmgd->aid); 2623 if (directed_tim) { 2624 if (local->hw.conf.dynamic_ps_timeout > 0) { 2625 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 2626 local->hw.conf.flags &= ~IEEE80211_CONF_PS; 2627 ieee80211_hw_config(local, 2628 IEEE80211_CONF_CHANGE_PS); 2629 } 2630 ieee80211_send_nullfunc(local, sdata, 0); 2631 } else if (!local->pspolling && sdata->u.mgd.powersave) { 2632 local->pspolling = true; 2633 2634 /* 2635 * Here is assumed that the driver will be 2636 * able to send ps-poll frame and receive a 2637 * response even though power save mode is 2638 * enabled, but some drivers might require 2639 * to disable power save here. This needs 2640 * to be investigated. 2641 */ 2642 ieee80211_send_pspoll(local, sdata); 2643 } 2644 } 2645 } 2646 2647 if (sdata->vif.p2p) { 2648 u8 noa[2]; 2649 int ret; 2650 2651 ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable, 2652 len - baselen, 2653 IEEE80211_P2P_ATTR_ABSENCE_NOTICE, 2654 noa, sizeof(noa)); 2655 if (ret >= 2 && sdata->u.mgd.p2p_noa_index != noa[0]) { 2656 bss_conf->p2p_oppps = noa[1] & 0x80; 2657 bss_conf->p2p_ctwindow = noa[1] & 0x7f; 2658 changed |= BSS_CHANGED_P2P_PS; 2659 sdata->u.mgd.p2p_noa_index = noa[0]; 2660 /* 2661 * make sure we update all information, the CRC 2662 * mechanism doesn't look at P2P attributes. 2663 */ 2664 ifmgd->beacon_crc_valid = false; 2665 } 2666 } 2667 2668 if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid) 2669 return; 2670 ifmgd->beacon_crc = ncrc; 2671 ifmgd->beacon_crc_valid = true; 2672 2673 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, 2674 true); 2675 2676 if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param, 2677 elems.wmm_param_len)) 2678 changed |= BSS_CHANGED_QOS; 2679 2680 if (elems.erp_info && elems.erp_info_len >= 1) { 2681 erp_valid = true; 2682 erp_value = elems.erp_info[0]; 2683 } else { 2684 erp_valid = false; 2685 } 2686 changed |= ieee80211_handle_bss_capability(sdata, 2687 le16_to_cpu(mgmt->u.beacon.capab_info), 2688 erp_valid, erp_value); 2689 2690 2691 if (elems.ht_cap_elem && elems.ht_operation && elems.wmm_param && 2692 !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) 2693 changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation, 2694 bssid, true); 2695 2696 if (elems.country_elem && elems.pwr_constr_elem && 2697 mgmt->u.probe_resp.capab_info & 2698 cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT)) 2699 changed |= ieee80211_handle_pwr_constr(sdata, chan, 2700 elems.country_elem, 2701 elems.country_elem_len, 2702 elems.pwr_constr_elem); 2703 2704 ieee80211_bss_info_change_notify(sdata, changed); 2705 } 2706 2707 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, 2708 struct sk_buff *skb) 2709 { 2710 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2711 struct ieee80211_rx_status *rx_status; 2712 struct ieee80211_mgmt *mgmt; 2713 struct cfg80211_bss *bss = NULL; 2714 enum rx_mgmt_action rma = RX_MGMT_NONE; 2715 u16 fc; 2716 2717 rx_status = (struct ieee80211_rx_status *) skb->cb; 2718 mgmt = (struct ieee80211_mgmt *) skb->data; 2719 fc = le16_to_cpu(mgmt->frame_control); 2720 2721 mutex_lock(&ifmgd->mtx); 2722 2723 switch (fc & IEEE80211_FCTL_STYPE) { 2724 case IEEE80211_STYPE_BEACON: 2725 ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status); 2726 break; 2727 case IEEE80211_STYPE_PROBE_RESP: 2728 ieee80211_rx_mgmt_probe_resp(sdata, skb); 2729 break; 2730 case IEEE80211_STYPE_AUTH: 2731 rma = ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len); 2732 break; 2733 case IEEE80211_STYPE_DEAUTH: 2734 rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len); 2735 break; 2736 case IEEE80211_STYPE_DISASSOC: 2737 rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len); 2738 break; 2739 case IEEE80211_STYPE_ASSOC_RESP: 2740 case IEEE80211_STYPE_REASSOC_RESP: 2741 rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss); 2742 break; 2743 case IEEE80211_STYPE_ACTION: 2744 switch (mgmt->u.action.category) { 2745 case WLAN_CATEGORY_SPECTRUM_MGMT: 2746 ieee80211_sta_process_chanswitch(sdata, 2747 &mgmt->u.action.u.chan_switch.sw_elem, 2748 (void *)ifmgd->associated->priv, 2749 rx_status->mactime); 2750 break; 2751 } 2752 } 2753 mutex_unlock(&ifmgd->mtx); 2754 2755 switch (rma) { 2756 case RX_MGMT_NONE: 2757 /* no action */ 2758 break; 2759 case RX_MGMT_CFG80211_DEAUTH: 2760 cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len); 2761 break; 2762 case RX_MGMT_CFG80211_DISASSOC: 2763 cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len); 2764 break; 2765 case RX_MGMT_CFG80211_RX_AUTH: 2766 cfg80211_send_rx_auth(sdata->dev, (u8 *)mgmt, skb->len); 2767 break; 2768 case RX_MGMT_CFG80211_RX_ASSOC: 2769 cfg80211_send_rx_assoc(sdata->dev, bss, (u8 *)mgmt, skb->len); 2770 break; 2771 case RX_MGMT_CFG80211_ASSOC_TIMEOUT: 2772 cfg80211_send_assoc_timeout(sdata->dev, mgmt->bssid); 2773 break; 2774 default: 2775 WARN(1, "unexpected: %d", rma); 2776 } 2777 } 2778 2779 static void ieee80211_sta_timer(unsigned long data) 2780 { 2781 struct ieee80211_sub_if_data *sdata = 2782 (struct ieee80211_sub_if_data *) data; 2783 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2784 struct ieee80211_local *local = sdata->local; 2785 2786 if (local->quiescing) { 2787 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running); 2788 return; 2789 } 2790 2791 ieee80211_queue_work(&local->hw, &sdata->work); 2792 } 2793 2794 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata, 2795 u8 *bssid, u8 reason) 2796 { 2797 struct ieee80211_local *local = sdata->local; 2798 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2799 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 2800 2801 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason, 2802 false, frame_buf); 2803 mutex_unlock(&ifmgd->mtx); 2804 2805 /* 2806 * must be outside lock due to cfg80211, 2807 * but that's not a problem. 2808 */ 2809 cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN); 2810 2811 mutex_lock(&local->mtx); 2812 ieee80211_recalc_idle(local); 2813 mutex_unlock(&local->mtx); 2814 2815 mutex_lock(&ifmgd->mtx); 2816 } 2817 2818 static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata) 2819 { 2820 struct ieee80211_local *local = sdata->local; 2821 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2822 struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data; 2823 2824 lockdep_assert_held(&ifmgd->mtx); 2825 2826 if (WARN_ON_ONCE(!auth_data)) 2827 return -EINVAL; 2828 2829 auth_data->tries++; 2830 2831 if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) { 2832 sdata_info(sdata, "authentication with %pM timed out\n", 2833 auth_data->bss->bssid); 2834 2835 /* 2836 * Most likely AP is not in the range so remove the 2837 * bss struct for that AP. 2838 */ 2839 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss); 2840 2841 return -ETIMEDOUT; 2842 } 2843 2844 drv_mgd_prepare_tx(local, sdata); 2845 2846 if (auth_data->bss->proberesp_ies) { 2847 u16 trans = 1; 2848 u16 status = 0; 2849 2850 sdata_info(sdata, "send auth to %pM (try %d/%d)\n", 2851 auth_data->bss->bssid, auth_data->tries, 2852 IEEE80211_AUTH_MAX_TRIES); 2853 2854 auth_data->expected_transaction = 2; 2855 2856 if (auth_data->algorithm == WLAN_AUTH_SAE) { 2857 trans = auth_data->sae_trans; 2858 status = auth_data->sae_status; 2859 auth_data->expected_transaction = trans; 2860 } 2861 2862 ieee80211_send_auth(sdata, trans, auth_data->algorithm, status, 2863 auth_data->data, auth_data->data_len, 2864 auth_data->bss->bssid, 2865 auth_data->bss->bssid, NULL, 0, 0); 2866 } else { 2867 const u8 *ssidie; 2868 2869 sdata_info(sdata, "direct probe to %pM (try %d/%i)\n", 2870 auth_data->bss->bssid, auth_data->tries, 2871 IEEE80211_AUTH_MAX_TRIES); 2872 2873 rcu_read_lock(); 2874 ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID); 2875 if (!ssidie) { 2876 rcu_read_unlock(); 2877 return -EINVAL; 2878 } 2879 /* 2880 * Direct probe is sent to broadcast address as some APs 2881 * will not answer to direct packet in unassociated state. 2882 */ 2883 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1], 2884 NULL, 0, (u32) -1, true, false, 2885 auth_data->bss->channel, false); 2886 rcu_read_unlock(); 2887 } 2888 2889 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT; 2890 run_again(ifmgd, auth_data->timeout); 2891 2892 return 0; 2893 } 2894 2895 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata) 2896 { 2897 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data; 2898 struct ieee80211_local *local = sdata->local; 2899 2900 lockdep_assert_held(&sdata->u.mgd.mtx); 2901 2902 assoc_data->tries++; 2903 if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) { 2904 sdata_info(sdata, "association with %pM timed out\n", 2905 assoc_data->bss->bssid); 2906 2907 /* 2908 * Most likely AP is not in the range so remove the 2909 * bss struct for that AP. 2910 */ 2911 cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss); 2912 2913 return -ETIMEDOUT; 2914 } 2915 2916 sdata_info(sdata, "associate with %pM (try %d/%d)\n", 2917 assoc_data->bss->bssid, assoc_data->tries, 2918 IEEE80211_ASSOC_MAX_TRIES); 2919 ieee80211_send_assoc(sdata); 2920 2921 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT; 2922 run_again(&sdata->u.mgd, assoc_data->timeout); 2923 2924 return 0; 2925 } 2926 2927 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata) 2928 { 2929 struct ieee80211_local *local = sdata->local; 2930 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2931 2932 mutex_lock(&ifmgd->mtx); 2933 2934 if (ifmgd->auth_data && 2935 time_after(jiffies, ifmgd->auth_data->timeout)) { 2936 if (ifmgd->auth_data->done) { 2937 /* 2938 * ok ... we waited for assoc but userspace didn't, 2939 * so let's just kill the auth data 2940 */ 2941 ieee80211_destroy_auth_data(sdata, false); 2942 } else if (ieee80211_probe_auth(sdata)) { 2943 u8 bssid[ETH_ALEN]; 2944 2945 memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN); 2946 2947 ieee80211_destroy_auth_data(sdata, false); 2948 2949 mutex_unlock(&ifmgd->mtx); 2950 cfg80211_send_auth_timeout(sdata->dev, bssid); 2951 mutex_lock(&ifmgd->mtx); 2952 } 2953 } else if (ifmgd->auth_data) 2954 run_again(ifmgd, ifmgd->auth_data->timeout); 2955 2956 if (ifmgd->assoc_data && 2957 time_after(jiffies, ifmgd->assoc_data->timeout)) { 2958 if (!ifmgd->assoc_data->have_beacon || 2959 ieee80211_do_assoc(sdata)) { 2960 u8 bssid[ETH_ALEN]; 2961 2962 memcpy(bssid, ifmgd->assoc_data->bss->bssid, ETH_ALEN); 2963 2964 ieee80211_destroy_assoc_data(sdata, false); 2965 2966 mutex_unlock(&ifmgd->mtx); 2967 cfg80211_send_assoc_timeout(sdata->dev, bssid); 2968 mutex_lock(&ifmgd->mtx); 2969 } 2970 } else if (ifmgd->assoc_data) 2971 run_again(ifmgd, ifmgd->assoc_data->timeout); 2972 2973 if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL | 2974 IEEE80211_STA_CONNECTION_POLL) && 2975 ifmgd->associated) { 2976 u8 bssid[ETH_ALEN]; 2977 int max_tries; 2978 2979 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN); 2980 2981 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) 2982 max_tries = max_nullfunc_tries; 2983 else 2984 max_tries = max_probe_tries; 2985 2986 /* ACK received for nullfunc probing frame */ 2987 if (!ifmgd->probe_send_count) 2988 ieee80211_reset_ap_probe(sdata); 2989 else if (ifmgd->nullfunc_failed) { 2990 if (ifmgd->probe_send_count < max_tries) { 2991 mlme_dbg(sdata, 2992 "No ack for nullfunc frame to AP %pM, try %d/%i\n", 2993 bssid, ifmgd->probe_send_count, 2994 max_tries); 2995 ieee80211_mgd_probe_ap_send(sdata); 2996 } else { 2997 mlme_dbg(sdata, 2998 "No ack for nullfunc frame to AP %pM, disconnecting.\n", 2999 bssid); 3000 ieee80211_sta_connection_lost(sdata, bssid, 3001 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY); 3002 } 3003 } else if (time_is_after_jiffies(ifmgd->probe_timeout)) 3004 run_again(ifmgd, ifmgd->probe_timeout); 3005 else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) { 3006 mlme_dbg(sdata, 3007 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n", 3008 bssid, probe_wait_ms); 3009 ieee80211_sta_connection_lost(sdata, bssid, 3010 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY); 3011 } else if (ifmgd->probe_send_count < max_tries) { 3012 mlme_dbg(sdata, 3013 "No probe response from AP %pM after %dms, try %d/%i\n", 3014 bssid, probe_wait_ms, 3015 ifmgd->probe_send_count, max_tries); 3016 ieee80211_mgd_probe_ap_send(sdata); 3017 } else { 3018 /* 3019 * We actually lost the connection ... or did we? 3020 * Let's make sure! 3021 */ 3022 wiphy_debug(local->hw.wiphy, 3023 "%s: No probe response from AP %pM" 3024 " after %dms, disconnecting.\n", 3025 sdata->name, 3026 bssid, probe_wait_ms); 3027 3028 ieee80211_sta_connection_lost(sdata, bssid, 3029 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY); 3030 } 3031 } 3032 3033 mutex_unlock(&ifmgd->mtx); 3034 3035 mutex_lock(&local->mtx); 3036 ieee80211_recalc_idle(local); 3037 mutex_unlock(&local->mtx); 3038 } 3039 3040 static void ieee80211_sta_bcn_mon_timer(unsigned long data) 3041 { 3042 struct ieee80211_sub_if_data *sdata = 3043 (struct ieee80211_sub_if_data *) data; 3044 struct ieee80211_local *local = sdata->local; 3045 3046 if (local->quiescing) 3047 return; 3048 3049 ieee80211_queue_work(&sdata->local->hw, 3050 &sdata->u.mgd.beacon_connection_loss_work); 3051 } 3052 3053 static void ieee80211_sta_conn_mon_timer(unsigned long data) 3054 { 3055 struct ieee80211_sub_if_data *sdata = 3056 (struct ieee80211_sub_if_data *) data; 3057 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3058 struct ieee80211_local *local = sdata->local; 3059 3060 if (local->quiescing) 3061 return; 3062 3063 ieee80211_queue_work(&local->hw, &ifmgd->monitor_work); 3064 } 3065 3066 static void ieee80211_sta_monitor_work(struct work_struct *work) 3067 { 3068 struct ieee80211_sub_if_data *sdata = 3069 container_of(work, struct ieee80211_sub_if_data, 3070 u.mgd.monitor_work); 3071 3072 ieee80211_mgd_probe_ap(sdata, false); 3073 } 3074 3075 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata) 3076 { 3077 u32 flags; 3078 3079 if (sdata->vif.type == NL80211_IFTYPE_STATION) { 3080 __ieee80211_stop_poll(sdata); 3081 3082 /* let's probe the connection once */ 3083 flags = sdata->local->hw.flags; 3084 if (!(flags & IEEE80211_HW_CONNECTION_MONITOR)) 3085 ieee80211_queue_work(&sdata->local->hw, 3086 &sdata->u.mgd.monitor_work); 3087 /* and do all the other regular work too */ 3088 ieee80211_queue_work(&sdata->local->hw, &sdata->work); 3089 } 3090 } 3091 3092 #ifdef CONFIG_PM 3093 void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata) 3094 { 3095 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3096 3097 /* 3098 * we need to use atomic bitops for the running bits 3099 * only because both timers might fire at the same 3100 * time -- the code here is properly synchronised. 3101 */ 3102 3103 cancel_work_sync(&ifmgd->request_smps_work); 3104 3105 cancel_work_sync(&ifmgd->monitor_work); 3106 cancel_work_sync(&ifmgd->beacon_connection_loss_work); 3107 cancel_work_sync(&ifmgd->csa_connection_drop_work); 3108 if (del_timer_sync(&ifmgd->timer)) 3109 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running); 3110 3111 cancel_work_sync(&ifmgd->chswitch_work); 3112 if (del_timer_sync(&ifmgd->chswitch_timer)) 3113 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running); 3114 3115 /* these will just be re-established on connection */ 3116 del_timer_sync(&ifmgd->conn_mon_timer); 3117 del_timer_sync(&ifmgd->bcn_mon_timer); 3118 } 3119 3120 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata) 3121 { 3122 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3123 3124 if (!ifmgd->associated) 3125 return; 3126 3127 if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) { 3128 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME; 3129 mutex_lock(&ifmgd->mtx); 3130 if (ifmgd->associated) { 3131 mlme_dbg(sdata, 3132 "driver requested disconnect after resume\n"); 3133 ieee80211_sta_connection_lost(sdata, 3134 ifmgd->associated->bssid, 3135 WLAN_REASON_UNSPECIFIED); 3136 mutex_unlock(&ifmgd->mtx); 3137 return; 3138 } 3139 mutex_unlock(&ifmgd->mtx); 3140 } 3141 3142 if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running)) 3143 add_timer(&ifmgd->timer); 3144 if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running)) 3145 add_timer(&ifmgd->chswitch_timer); 3146 ieee80211_sta_reset_beacon_monitor(sdata); 3147 3148 mutex_lock(&sdata->local->mtx); 3149 ieee80211_restart_sta_timer(sdata); 3150 mutex_unlock(&sdata->local->mtx); 3151 } 3152 #endif 3153 3154 /* interface setup */ 3155 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata) 3156 { 3157 struct ieee80211_if_managed *ifmgd; 3158 3159 ifmgd = &sdata->u.mgd; 3160 INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work); 3161 INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work); 3162 INIT_WORK(&ifmgd->beacon_connection_loss_work, 3163 ieee80211_beacon_connection_loss_work); 3164 INIT_WORK(&ifmgd->csa_connection_drop_work, 3165 ieee80211_csa_connection_drop_work); 3166 INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_work); 3167 setup_timer(&ifmgd->timer, ieee80211_sta_timer, 3168 (unsigned long) sdata); 3169 setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 3170 (unsigned long) sdata); 3171 setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 3172 (unsigned long) sdata); 3173 setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer, 3174 (unsigned long) sdata); 3175 3176 ifmgd->flags = 0; 3177 ifmgd->powersave = sdata->wdev.ps; 3178 ifmgd->uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES; 3179 ifmgd->uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN; 3180 3181 mutex_init(&ifmgd->mtx); 3182 3183 if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS) 3184 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC; 3185 else 3186 ifmgd->req_smps = IEEE80211_SMPS_OFF; 3187 } 3188 3189 /* scan finished notification */ 3190 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local) 3191 { 3192 struct ieee80211_sub_if_data *sdata; 3193 3194 /* Restart STA timers */ 3195 rcu_read_lock(); 3196 list_for_each_entry_rcu(sdata, &local->interfaces, list) 3197 ieee80211_restart_sta_timer(sdata); 3198 rcu_read_unlock(); 3199 } 3200 3201 int ieee80211_max_network_latency(struct notifier_block *nb, 3202 unsigned long data, void *dummy) 3203 { 3204 s32 latency_usec = (s32) data; 3205 struct ieee80211_local *local = 3206 container_of(nb, struct ieee80211_local, 3207 network_latency_notifier); 3208 3209 mutex_lock(&local->iflist_mtx); 3210 ieee80211_recalc_ps(local, latency_usec); 3211 mutex_unlock(&local->iflist_mtx); 3212 3213 return 0; 3214 } 3215 3216 static u32 chandef_downgrade(struct cfg80211_chan_def *c) 3217 { 3218 u32 ret; 3219 int tmp; 3220 3221 switch (c->width) { 3222 case NL80211_CHAN_WIDTH_20: 3223 c->width = NL80211_CHAN_WIDTH_20_NOHT; 3224 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT; 3225 break; 3226 case NL80211_CHAN_WIDTH_40: 3227 c->width = NL80211_CHAN_WIDTH_20; 3228 c->center_freq1 = c->chan->center_freq; 3229 ret = IEEE80211_STA_DISABLE_40MHZ | 3230 IEEE80211_STA_DISABLE_VHT; 3231 break; 3232 case NL80211_CHAN_WIDTH_80: 3233 tmp = (30 + c->chan->center_freq - c->center_freq1)/20; 3234 /* n_P40 */ 3235 tmp /= 2; 3236 /* freq_P40 */ 3237 c->center_freq1 = c->center_freq1 - 20 + 40 * tmp; 3238 c->width = NL80211_CHAN_WIDTH_40; 3239 ret = IEEE80211_STA_DISABLE_VHT; 3240 break; 3241 case NL80211_CHAN_WIDTH_80P80: 3242 c->center_freq2 = 0; 3243 c->width = NL80211_CHAN_WIDTH_80; 3244 ret = IEEE80211_STA_DISABLE_80P80MHZ | 3245 IEEE80211_STA_DISABLE_160MHZ; 3246 break; 3247 case NL80211_CHAN_WIDTH_160: 3248 /* n_P20 */ 3249 tmp = (70 + c->chan->center_freq - c->center_freq1)/20; 3250 /* n_P80 */ 3251 tmp /= 4; 3252 c->center_freq1 = c->center_freq1 - 40 + 80 * tmp; 3253 c->width = NL80211_CHAN_WIDTH_80; 3254 ret = IEEE80211_STA_DISABLE_80P80MHZ | 3255 IEEE80211_STA_DISABLE_160MHZ; 3256 break; 3257 default: 3258 case NL80211_CHAN_WIDTH_20_NOHT: 3259 WARN_ON_ONCE(1); 3260 c->width = NL80211_CHAN_WIDTH_20_NOHT; 3261 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT; 3262 break; 3263 } 3264 3265 WARN_ON_ONCE(!cfg80211_chandef_valid(c)); 3266 3267 return ret; 3268 } 3269 3270 static u32 3271 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata, 3272 struct ieee80211_supported_band *sband, 3273 struct ieee80211_channel *channel, 3274 const struct ieee80211_ht_operation *ht_oper, 3275 const struct ieee80211_vht_operation *vht_oper, 3276 struct cfg80211_chan_def *chandef) 3277 { 3278 struct cfg80211_chan_def vht_chandef; 3279 u32 ht_cfreq, ret; 3280 3281 chandef->chan = channel; 3282 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 3283 chandef->center_freq1 = channel->center_freq; 3284 chandef->center_freq2 = 0; 3285 3286 if (!ht_oper || !sband->ht_cap.ht_supported) { 3287 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT; 3288 goto out; 3289 } 3290 3291 chandef->width = NL80211_CHAN_WIDTH_20; 3292 3293 ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan, 3294 channel->band); 3295 /* check that channel matches the right operating channel */ 3296 if (channel->center_freq != ht_cfreq) { 3297 /* 3298 * It's possible that some APs are confused here; 3299 * Netgear WNDR3700 sometimes reports 4 higher than 3300 * the actual channel in association responses, but 3301 * since we look at probe response/beacon data here 3302 * it should be OK. 3303 */ 3304 sdata_info(sdata, 3305 "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n", 3306 channel->center_freq, ht_cfreq, 3307 ht_oper->primary_chan, channel->band); 3308 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT; 3309 goto out; 3310 } 3311 3312 /* check 40 MHz support, if we have it */ 3313 if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) { 3314 switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) { 3315 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE: 3316 chandef->width = NL80211_CHAN_WIDTH_40; 3317 chandef->center_freq1 += 10; 3318 break; 3319 case IEEE80211_HT_PARAM_CHA_SEC_BELOW: 3320 chandef->width = NL80211_CHAN_WIDTH_40; 3321 chandef->center_freq1 -= 10; 3322 break; 3323 } 3324 } else { 3325 /* 40 MHz (and 80 MHz) must be supported for VHT */ 3326 ret = IEEE80211_STA_DISABLE_VHT; 3327 goto out; 3328 } 3329 3330 if (!vht_oper || !sband->vht_cap.vht_supported) { 3331 ret = IEEE80211_STA_DISABLE_VHT; 3332 goto out; 3333 } 3334 3335 vht_chandef.chan = channel; 3336 vht_chandef.center_freq1 = 3337 ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx, 3338 channel->band); 3339 vht_chandef.center_freq2 = 0; 3340 3341 if (vht_oper->center_freq_seg2_idx) 3342 vht_chandef.center_freq2 = 3343 ieee80211_channel_to_frequency( 3344 vht_oper->center_freq_seg2_idx, 3345 channel->band); 3346 3347 switch (vht_oper->chan_width) { 3348 case IEEE80211_VHT_CHANWIDTH_USE_HT: 3349 vht_chandef.width = chandef->width; 3350 break; 3351 case IEEE80211_VHT_CHANWIDTH_80MHZ: 3352 vht_chandef.width = NL80211_CHAN_WIDTH_80; 3353 break; 3354 case IEEE80211_VHT_CHANWIDTH_160MHZ: 3355 vht_chandef.width = NL80211_CHAN_WIDTH_160; 3356 break; 3357 case IEEE80211_VHT_CHANWIDTH_80P80MHZ: 3358 vht_chandef.width = NL80211_CHAN_WIDTH_80P80; 3359 break; 3360 default: 3361 sdata_info(sdata, 3362 "AP VHT operation IE has invalid channel width (%d), disable VHT\n", 3363 vht_oper->chan_width); 3364 ret = IEEE80211_STA_DISABLE_VHT; 3365 goto out; 3366 } 3367 3368 if (!cfg80211_chandef_valid(&vht_chandef)) { 3369 sdata_info(sdata, 3370 "AP VHT information is invalid, disable VHT\n"); 3371 ret = IEEE80211_STA_DISABLE_VHT; 3372 goto out; 3373 } 3374 3375 if (cfg80211_chandef_identical(chandef, &vht_chandef)) { 3376 ret = 0; 3377 goto out; 3378 } 3379 3380 if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) { 3381 sdata_info(sdata, 3382 "AP VHT information doesn't match HT, disable VHT\n"); 3383 ret = IEEE80211_STA_DISABLE_VHT; 3384 goto out; 3385 } 3386 3387 *chandef = vht_chandef; 3388 3389 ret = 0; 3390 3391 while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef, 3392 IEEE80211_CHAN_DISABLED)) { 3393 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) { 3394 ret = IEEE80211_STA_DISABLE_HT | 3395 IEEE80211_STA_DISABLE_VHT; 3396 goto out; 3397 } 3398 3399 ret = chandef_downgrade(chandef); 3400 } 3401 3402 if (chandef->width != vht_chandef.width) 3403 sdata_info(sdata, 3404 "local regulatory prevented using AP HT/VHT configuration, downgraded\n"); 3405 3406 out: 3407 WARN_ON_ONCE(!cfg80211_chandef_valid(chandef)); 3408 return ret; 3409 } 3410 3411 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata, 3412 struct cfg80211_bss *cbss) 3413 { 3414 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3415 const u8 *ht_cap_ie, *vht_cap_ie; 3416 const struct ieee80211_ht_cap *ht_cap; 3417 const struct ieee80211_vht_cap *vht_cap; 3418 u8 chains = 1; 3419 3420 if (ifmgd->flags & IEEE80211_STA_DISABLE_HT) 3421 return chains; 3422 3423 ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY); 3424 if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) { 3425 ht_cap = (void *)(ht_cap_ie + 2); 3426 chains = ieee80211_mcs_to_chains(&ht_cap->mcs); 3427 /* 3428 * TODO: use "Tx Maximum Number Spatial Streams Supported" and 3429 * "Tx Unequal Modulation Supported" fields. 3430 */ 3431 } 3432 3433 if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT) 3434 return chains; 3435 3436 vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY); 3437 if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) { 3438 u8 nss; 3439 u16 tx_mcs_map; 3440 3441 vht_cap = (void *)(vht_cap_ie + 2); 3442 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map); 3443 for (nss = 8; nss > 0; nss--) { 3444 if (((tx_mcs_map >> (2 * (nss - 1))) & 3) != 3445 IEEE80211_VHT_MCS_NOT_SUPPORTED) 3446 break; 3447 } 3448 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */ 3449 chains = max(chains, nss); 3450 } 3451 3452 return chains; 3453 } 3454 3455 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata, 3456 struct cfg80211_bss *cbss) 3457 { 3458 struct ieee80211_local *local = sdata->local; 3459 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3460 const struct ieee80211_ht_operation *ht_oper = NULL; 3461 const struct ieee80211_vht_operation *vht_oper = NULL; 3462 struct ieee80211_supported_band *sband; 3463 struct cfg80211_chan_def chandef; 3464 int ret; 3465 3466 sband = local->hw.wiphy->bands[cbss->channel->band]; 3467 3468 ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ | 3469 IEEE80211_STA_DISABLE_80P80MHZ | 3470 IEEE80211_STA_DISABLE_160MHZ); 3471 3472 rcu_read_lock(); 3473 3474 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) && 3475 sband->ht_cap.ht_supported) { 3476 const u8 *ht_oper_ie; 3477 3478 ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION); 3479 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper)) 3480 ht_oper = (void *)(ht_oper_ie + 2); 3481 } 3482 3483 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) && 3484 sband->vht_cap.vht_supported) { 3485 const u8 *vht_oper_ie; 3486 3487 vht_oper_ie = ieee80211_bss_get_ie(cbss, 3488 WLAN_EID_VHT_OPERATION); 3489 if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper)) 3490 vht_oper = (void *)(vht_oper_ie + 2); 3491 if (vht_oper && !ht_oper) { 3492 vht_oper = NULL; 3493 sdata_info(sdata, 3494 "AP advertised VHT without HT, disabling both\n"); 3495 sdata->flags |= IEEE80211_STA_DISABLE_HT; 3496 sdata->flags |= IEEE80211_STA_DISABLE_VHT; 3497 } 3498 } 3499 3500 ifmgd->flags |= ieee80211_determine_chantype(sdata, sband, 3501 cbss->channel, 3502 ht_oper, vht_oper, 3503 &chandef); 3504 3505 sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss), 3506 local->rx_chains); 3507 3508 rcu_read_unlock(); 3509 3510 /* will change later if needed */ 3511 sdata->smps_mode = IEEE80211_SMPS_OFF; 3512 3513 /* 3514 * If this fails (possibly due to channel context sharing 3515 * on incompatible channels, e.g. 80+80 and 160 sharing the 3516 * same control channel) try to use a smaller bandwidth. 3517 */ 3518 ret = ieee80211_vif_use_channel(sdata, &chandef, 3519 IEEE80211_CHANCTX_SHARED); 3520 while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) 3521 ifmgd->flags |= chandef_downgrade(&chandef); 3522 return ret; 3523 } 3524 3525 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, 3526 struct cfg80211_bss *cbss, bool assoc) 3527 { 3528 struct ieee80211_local *local = sdata->local; 3529 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3530 struct ieee80211_bss *bss = (void *)cbss->priv; 3531 struct sta_info *new_sta = NULL; 3532 bool have_sta = false; 3533 int err; 3534 3535 if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) 3536 return -EINVAL; 3537 3538 if (assoc) { 3539 rcu_read_lock(); 3540 have_sta = sta_info_get(sdata, cbss->bssid); 3541 rcu_read_unlock(); 3542 } 3543 3544 if (!have_sta) { 3545 new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL); 3546 if (!new_sta) 3547 return -ENOMEM; 3548 } 3549 3550 mutex_lock(&local->mtx); 3551 ieee80211_recalc_idle(sdata->local); 3552 mutex_unlock(&local->mtx); 3553 3554 if (new_sta) { 3555 u32 rates = 0, basic_rates = 0; 3556 bool have_higher_than_11mbit; 3557 int min_rate = INT_MAX, min_rate_index = -1; 3558 struct ieee80211_supported_band *sband; 3559 3560 sband = local->hw.wiphy->bands[cbss->channel->band]; 3561 3562 err = ieee80211_prep_channel(sdata, cbss); 3563 if (err) { 3564 sta_info_free(local, new_sta); 3565 return err; 3566 } 3567 3568 ieee80211_get_rates(sband, bss->supp_rates, 3569 bss->supp_rates_len, 3570 &rates, &basic_rates, 3571 &have_higher_than_11mbit, 3572 &min_rate, &min_rate_index); 3573 3574 /* 3575 * This used to be a workaround for basic rates missing 3576 * in the association response frame. Now that we no 3577 * longer use the basic rates from there, it probably 3578 * doesn't happen any more, but keep the workaround so 3579 * in case some *other* APs are buggy in different ways 3580 * we can connect -- with a warning. 3581 */ 3582 if (!basic_rates && min_rate_index >= 0) { 3583 sdata_info(sdata, 3584 "No basic rates, using min rate instead\n"); 3585 basic_rates = BIT(min_rate_index); 3586 } 3587 3588 new_sta->sta.supp_rates[cbss->channel->band] = rates; 3589 sdata->vif.bss_conf.basic_rates = basic_rates; 3590 3591 /* cf. IEEE 802.11 9.2.12 */ 3592 if (cbss->channel->band == IEEE80211_BAND_2GHZ && 3593 have_higher_than_11mbit) 3594 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE; 3595 else 3596 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE; 3597 3598 memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN); 3599 3600 /* set timing information */ 3601 sdata->vif.bss_conf.beacon_int = cbss->beacon_interval; 3602 sdata->vif.bss_conf.sync_tsf = cbss->tsf; 3603 sdata->vif.bss_conf.sync_device_ts = bss->device_ts; 3604 3605 /* tell driver about BSSID, basic rates and timing */ 3606 ieee80211_bss_info_change_notify(sdata, 3607 BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES | 3608 BSS_CHANGED_BEACON_INT); 3609 3610 if (assoc) 3611 sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH); 3612 3613 err = sta_info_insert(new_sta); 3614 new_sta = NULL; 3615 if (err) { 3616 sdata_info(sdata, 3617 "failed to insert STA entry for the AP (error %d)\n", 3618 err); 3619 return err; 3620 } 3621 } else 3622 WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid)); 3623 3624 return 0; 3625 } 3626 3627 /* config hooks */ 3628 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata, 3629 struct cfg80211_auth_request *req) 3630 { 3631 struct ieee80211_local *local = sdata->local; 3632 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3633 struct ieee80211_mgd_auth_data *auth_data; 3634 u16 auth_alg; 3635 int err; 3636 3637 /* prepare auth data structure */ 3638 3639 switch (req->auth_type) { 3640 case NL80211_AUTHTYPE_OPEN_SYSTEM: 3641 auth_alg = WLAN_AUTH_OPEN; 3642 break; 3643 case NL80211_AUTHTYPE_SHARED_KEY: 3644 if (IS_ERR(local->wep_tx_tfm)) 3645 return -EOPNOTSUPP; 3646 auth_alg = WLAN_AUTH_SHARED_KEY; 3647 break; 3648 case NL80211_AUTHTYPE_FT: 3649 auth_alg = WLAN_AUTH_FT; 3650 break; 3651 case NL80211_AUTHTYPE_NETWORK_EAP: 3652 auth_alg = WLAN_AUTH_LEAP; 3653 break; 3654 case NL80211_AUTHTYPE_SAE: 3655 auth_alg = WLAN_AUTH_SAE; 3656 break; 3657 default: 3658 return -EOPNOTSUPP; 3659 } 3660 3661 auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len + 3662 req->ie_len, GFP_KERNEL); 3663 if (!auth_data) 3664 return -ENOMEM; 3665 3666 auth_data->bss = req->bss; 3667 3668 if (req->sae_data_len >= 4) { 3669 __le16 *pos = (__le16 *) req->sae_data; 3670 auth_data->sae_trans = le16_to_cpu(pos[0]); 3671 auth_data->sae_status = le16_to_cpu(pos[1]); 3672 memcpy(auth_data->data, req->sae_data + 4, 3673 req->sae_data_len - 4); 3674 auth_data->data_len += req->sae_data_len - 4; 3675 } 3676 3677 if (req->ie && req->ie_len) { 3678 memcpy(&auth_data->data[auth_data->data_len], 3679 req->ie, req->ie_len); 3680 auth_data->data_len += req->ie_len; 3681 } 3682 3683 if (req->key && req->key_len) { 3684 auth_data->key_len = req->key_len; 3685 auth_data->key_idx = req->key_idx; 3686 memcpy(auth_data->key, req->key, req->key_len); 3687 } 3688 3689 auth_data->algorithm = auth_alg; 3690 3691 /* try to authenticate/probe */ 3692 3693 mutex_lock(&ifmgd->mtx); 3694 3695 if ((ifmgd->auth_data && !ifmgd->auth_data->done) || 3696 ifmgd->assoc_data) { 3697 err = -EBUSY; 3698 goto err_free; 3699 } 3700 3701 if (ifmgd->auth_data) 3702 ieee80211_destroy_auth_data(sdata, false); 3703 3704 /* prep auth_data so we don't go into idle on disassoc */ 3705 ifmgd->auth_data = auth_data; 3706 3707 if (ifmgd->associated) 3708 ieee80211_set_disassoc(sdata, 0, 0, false, NULL); 3709 3710 sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid); 3711 3712 err = ieee80211_prep_connection(sdata, req->bss, false); 3713 if (err) 3714 goto err_clear; 3715 3716 err = ieee80211_probe_auth(sdata); 3717 if (err) { 3718 sta_info_destroy_addr(sdata, req->bss->bssid); 3719 goto err_clear; 3720 } 3721 3722 /* hold our own reference */ 3723 cfg80211_ref_bss(auth_data->bss); 3724 err = 0; 3725 goto out_unlock; 3726 3727 err_clear: 3728 memset(ifmgd->bssid, 0, ETH_ALEN); 3729 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID); 3730 ifmgd->auth_data = NULL; 3731 err_free: 3732 kfree(auth_data); 3733 out_unlock: 3734 mutex_unlock(&ifmgd->mtx); 3735 3736 return err; 3737 } 3738 3739 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata, 3740 struct cfg80211_assoc_request *req) 3741 { 3742 struct ieee80211_local *local = sdata->local; 3743 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3744 struct ieee80211_bss *bss = (void *)req->bss->priv; 3745 struct ieee80211_mgd_assoc_data *assoc_data; 3746 struct ieee80211_supported_band *sband; 3747 const u8 *ssidie, *ht_ie; 3748 int i, err; 3749 3750 assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL); 3751 if (!assoc_data) 3752 return -ENOMEM; 3753 3754 rcu_read_lock(); 3755 ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID); 3756 if (!ssidie) { 3757 rcu_read_unlock(); 3758 kfree(assoc_data); 3759 return -EINVAL; 3760 } 3761 memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]); 3762 assoc_data->ssid_len = ssidie[1]; 3763 rcu_read_unlock(); 3764 3765 mutex_lock(&ifmgd->mtx); 3766 3767 if (ifmgd->associated) 3768 ieee80211_set_disassoc(sdata, 0, 0, false, NULL); 3769 3770 if (ifmgd->auth_data && !ifmgd->auth_data->done) { 3771 err = -EBUSY; 3772 goto err_free; 3773 } 3774 3775 if (ifmgd->assoc_data) { 3776 err = -EBUSY; 3777 goto err_free; 3778 } 3779 3780 if (ifmgd->auth_data) { 3781 bool match; 3782 3783 /* keep sta info, bssid if matching */ 3784 match = ether_addr_equal(ifmgd->bssid, req->bss->bssid); 3785 ieee80211_destroy_auth_data(sdata, match); 3786 } 3787 3788 /* prepare assoc data */ 3789 3790 ifmgd->beacon_crc_valid = false; 3791 3792 /* 3793 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode. 3794 * We still associate in non-HT mode (11a/b/g) if any one of these 3795 * ciphers is configured as pairwise. 3796 * We can set this to true for non-11n hardware, that'll be checked 3797 * separately along with the peer capabilities. 3798 */ 3799 for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) { 3800 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 || 3801 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP || 3802 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) { 3803 ifmgd->flags |= IEEE80211_STA_DISABLE_HT; 3804 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT; 3805 netdev_info(sdata->dev, 3806 "disabling HT/VHT due to WEP/TKIP use\n"); 3807 } 3808 } 3809 3810 if (req->flags & ASSOC_REQ_DISABLE_HT) { 3811 ifmgd->flags |= IEEE80211_STA_DISABLE_HT; 3812 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT; 3813 } 3814 3815 /* Also disable HT if we don't support it or the AP doesn't use WMM */ 3816 sband = local->hw.wiphy->bands[req->bss->channel->band]; 3817 if (!sband->ht_cap.ht_supported || 3818 local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) { 3819 ifmgd->flags |= IEEE80211_STA_DISABLE_HT; 3820 if (!bss->wmm_used) 3821 netdev_info(sdata->dev, 3822 "disabling HT as WMM/QoS is not supported by the AP\n"); 3823 } 3824 3825 /* disable VHT if we don't support it or the AP doesn't use WMM */ 3826 if (!sband->vht_cap.vht_supported || 3827 local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) { 3828 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT; 3829 if (!bss->wmm_used) 3830 netdev_info(sdata->dev, 3831 "disabling VHT as WMM/QoS is not supported by the AP\n"); 3832 } 3833 3834 memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa)); 3835 memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask, 3836 sizeof(ifmgd->ht_capa_mask)); 3837 3838 if (req->ie && req->ie_len) { 3839 memcpy(assoc_data->ie, req->ie, req->ie_len); 3840 assoc_data->ie_len = req->ie_len; 3841 } 3842 3843 assoc_data->bss = req->bss; 3844 3845 if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) { 3846 if (ifmgd->powersave) 3847 sdata->smps_mode = IEEE80211_SMPS_DYNAMIC; 3848 else 3849 sdata->smps_mode = IEEE80211_SMPS_OFF; 3850 } else 3851 sdata->smps_mode = ifmgd->req_smps; 3852 3853 assoc_data->capability = req->bss->capability; 3854 assoc_data->wmm = bss->wmm_used && 3855 (local->hw.queues >= IEEE80211_NUM_ACS); 3856 assoc_data->supp_rates = bss->supp_rates; 3857 assoc_data->supp_rates_len = bss->supp_rates_len; 3858 3859 rcu_read_lock(); 3860 ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION); 3861 if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation)) 3862 assoc_data->ap_ht_param = 3863 ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param; 3864 else 3865 ifmgd->flags |= IEEE80211_STA_DISABLE_HT; 3866 rcu_read_unlock(); 3867 3868 if (bss->wmm_used && bss->uapsd_supported && 3869 (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) { 3870 assoc_data->uapsd = true; 3871 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED; 3872 } else { 3873 assoc_data->uapsd = false; 3874 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED; 3875 } 3876 3877 if (req->prev_bssid) 3878 memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN); 3879 3880 if (req->use_mfp) { 3881 ifmgd->mfp = IEEE80211_MFP_REQUIRED; 3882 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED; 3883 } else { 3884 ifmgd->mfp = IEEE80211_MFP_DISABLED; 3885 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED; 3886 } 3887 3888 if (req->crypto.control_port) 3889 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT; 3890 else 3891 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT; 3892 3893 sdata->control_port_protocol = req->crypto.control_port_ethertype; 3894 sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt; 3895 3896 /* kick off associate process */ 3897 3898 ifmgd->assoc_data = assoc_data; 3899 3900 err = ieee80211_prep_connection(sdata, req->bss, true); 3901 if (err) 3902 goto err_clear; 3903 3904 if (!bss->dtim_period && 3905 sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) { 3906 /* 3907 * Wait up to one beacon interval ... 3908 * should this be more if we miss one? 3909 */ 3910 sdata_info(sdata, "waiting for beacon from %pM\n", 3911 ifmgd->bssid); 3912 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval); 3913 } else { 3914 assoc_data->have_beacon = true; 3915 assoc_data->sent_assoc = false; 3916 assoc_data->timeout = jiffies; 3917 } 3918 run_again(ifmgd, assoc_data->timeout); 3919 3920 if (bss->corrupt_data) { 3921 char *corrupt_type = "data"; 3922 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) { 3923 if (bss->corrupt_data & 3924 IEEE80211_BSS_CORRUPT_PROBE_RESP) 3925 corrupt_type = "beacon and probe response"; 3926 else 3927 corrupt_type = "beacon"; 3928 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) 3929 corrupt_type = "probe response"; 3930 sdata_info(sdata, "associating with AP with corrupt %s\n", 3931 corrupt_type); 3932 } 3933 3934 err = 0; 3935 goto out; 3936 err_clear: 3937 memset(ifmgd->bssid, 0, ETH_ALEN); 3938 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID); 3939 ifmgd->assoc_data = NULL; 3940 err_free: 3941 kfree(assoc_data); 3942 out: 3943 mutex_unlock(&ifmgd->mtx); 3944 3945 return err; 3946 } 3947 3948 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, 3949 struct cfg80211_deauth_request *req) 3950 { 3951 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3952 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 3953 bool tx = !req->local_state_change; 3954 bool sent_frame = false; 3955 3956 mutex_lock(&ifmgd->mtx); 3957 3958 sdata_info(sdata, 3959 "deauthenticating from %pM by local choice (reason=%d)\n", 3960 req->bssid, req->reason_code); 3961 3962 if (ifmgd->auth_data) { 3963 drv_mgd_prepare_tx(sdata->local, sdata); 3964 ieee80211_send_deauth_disassoc(sdata, req->bssid, 3965 IEEE80211_STYPE_DEAUTH, 3966 req->reason_code, tx, 3967 frame_buf); 3968 ieee80211_destroy_auth_data(sdata, false); 3969 mutex_unlock(&ifmgd->mtx); 3970 3971 sent_frame = tx; 3972 goto out; 3973 } 3974 3975 if (ifmgd->associated && 3976 ether_addr_equal(ifmgd->associated->bssid, req->bssid)) { 3977 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, 3978 req->reason_code, tx, frame_buf); 3979 sent_frame = tx; 3980 } 3981 mutex_unlock(&ifmgd->mtx); 3982 3983 out: 3984 mutex_lock(&sdata->local->mtx); 3985 ieee80211_recalc_idle(sdata->local); 3986 mutex_unlock(&sdata->local->mtx); 3987 3988 if (sent_frame) 3989 __cfg80211_send_deauth(sdata->dev, frame_buf, 3990 IEEE80211_DEAUTH_FRAME_LEN); 3991 3992 return 0; 3993 } 3994 3995 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata, 3996 struct cfg80211_disassoc_request *req) 3997 { 3998 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3999 u8 bssid[ETH_ALEN]; 4000 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 4001 4002 mutex_lock(&ifmgd->mtx); 4003 4004 /* 4005 * cfg80211 should catch this ... but it's racy since 4006 * we can receive a disassoc frame, process it, hand it 4007 * to cfg80211 while that's in a locked section already 4008 * trying to tell us that the user wants to disconnect. 4009 */ 4010 if (ifmgd->associated != req->bss) { 4011 mutex_unlock(&ifmgd->mtx); 4012 return -ENOLINK; 4013 } 4014 4015 sdata_info(sdata, 4016 "disassociating from %pM by local choice (reason=%d)\n", 4017 req->bss->bssid, req->reason_code); 4018 4019 memcpy(bssid, req->bss->bssid, ETH_ALEN); 4020 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC, 4021 req->reason_code, !req->local_state_change, 4022 frame_buf); 4023 mutex_unlock(&ifmgd->mtx); 4024 4025 __cfg80211_send_disassoc(sdata->dev, frame_buf, 4026 IEEE80211_DEAUTH_FRAME_LEN); 4027 4028 mutex_lock(&sdata->local->mtx); 4029 ieee80211_recalc_idle(sdata->local); 4030 mutex_unlock(&sdata->local->mtx); 4031 4032 return 0; 4033 } 4034 4035 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata) 4036 { 4037 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 4038 4039 mutex_lock(&ifmgd->mtx); 4040 if (ifmgd->assoc_data) 4041 ieee80211_destroy_assoc_data(sdata, false); 4042 if (ifmgd->auth_data) 4043 ieee80211_destroy_auth_data(sdata, false); 4044 del_timer_sync(&ifmgd->timer); 4045 mutex_unlock(&ifmgd->mtx); 4046 } 4047 4048 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif, 4049 enum nl80211_cqm_rssi_threshold_event rssi_event, 4050 gfp_t gfp) 4051 { 4052 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 4053 4054 trace_api_cqm_rssi_notify(sdata, rssi_event); 4055 4056 cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp); 4057 } 4058 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify); 4059