1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * BSS client mode implementation 4 * Copyright 2003-2008, Jouni Malinen <j@w1.fi> 5 * Copyright 2004, Instant802 Networks, Inc. 6 * Copyright 2005, Devicescape Software, Inc. 7 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 9 * Copyright 2013-2014 Intel Mobile Communications GmbH 10 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH 11 * Copyright (C) 2018 - 2024 Intel Corporation 12 */ 13 14#include <linux/delay.h> 15#include <linux/fips.h> 16#include <linux/if_ether.h> 17#include <linux/skbuff.h> 18#include <linux/if_arp.h> 19#include <linux/etherdevice.h> 20#include <linux/moduleparam.h> 21#include <linux/rtnetlink.h> 22#include <linux/crc32.h> 23#include <linux/slab.h> 24#include <linux/export.h> 25#include <net/mac80211.h> 26#include <asm/unaligned.h> 27 28#include "ieee80211_i.h" 29#include "driver-ops.h" 30#include "rate.h" 31#include "led.h" 32#include "fils_aead.h" 33 34#define IEEE80211_AUTH_TIMEOUT (HZ / 5) 35#define IEEE80211_AUTH_TIMEOUT_LONG (HZ / 2) 36#define IEEE80211_AUTH_TIMEOUT_SHORT (HZ / 10) 37#define IEEE80211_AUTH_TIMEOUT_SAE (HZ * 2) 38#define IEEE80211_AUTH_MAX_TRIES 3 39#define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5) 40#define IEEE80211_AUTH_WAIT_SAE_RETRY (HZ * 2) 41#define IEEE80211_ASSOC_TIMEOUT (HZ / 5) 42#define IEEE80211_ASSOC_TIMEOUT_LONG (HZ / 2) 43#define IEEE80211_ASSOC_TIMEOUT_SHORT (HZ / 10) 44#define IEEE80211_ASSOC_MAX_TRIES 3 45 46#define IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS msecs_to_jiffies(100) 47#define IEEE80211_ADV_TTLM_ST_UNDERFLOW 0xff00 48 49#define IEEE80211_NEG_TTLM_REQ_TIMEOUT (HZ / 5) 50 51static int max_nullfunc_tries = 2; 52module_param(max_nullfunc_tries, int, 0644); 53MODULE_PARM_DESC(max_nullfunc_tries, 54 "Maximum nullfunc tx tries before disconnecting (reason 4)."); 55 56static int max_probe_tries = 5; 57module_param(max_probe_tries, int, 0644); 58MODULE_PARM_DESC(max_probe_tries, 59 "Maximum probe tries before disconnecting (reason 4)."); 60 61/* 62 * Beacon loss timeout is calculated as N frames times the 63 * advertised beacon interval. This may need to be somewhat 64 * higher than what hardware might detect to account for 65 * delays in the host processing frames. But since we also 66 * probe on beacon miss before declaring the connection lost 67 * default to what we want. 68 */ 69static int beacon_loss_count = 7; 70module_param(beacon_loss_count, int, 0644); 71MODULE_PARM_DESC(beacon_loss_count, 72 "Number of beacon intervals before we decide beacon was lost."); 73 74/* 75 * Time the connection can be idle before we probe 76 * it to see if we can still talk to the AP. 77 */ 78#define IEEE80211_CONNECTION_IDLE_TIME (30 * HZ) 79/* 80 * Time we wait for a probe response after sending 81 * a probe request because of beacon loss or for 82 * checking the connection still works. 83 */ 84static int probe_wait_ms = 500; 85module_param(probe_wait_ms, int, 0644); 86MODULE_PARM_DESC(probe_wait_ms, 87 "Maximum time(ms) to wait for probe response" 88 " before disconnecting (reason 4)."); 89 90/* 91 * How many Beacon frames need to have been used in average signal strength 92 * before starting to indicate signal change events. 93 */ 94#define IEEE80211_SIGNAL_AVE_MIN_COUNT 4 95 96/* 97 * We can have multiple work items (and connection probing) 98 * scheduling this timer, but we need to take care to only 99 * reschedule it when it should fire _earlier_ than it was 100 * asked for before, or if it's not pending right now. This 101 * function ensures that. Note that it then is required to 102 * run this function for all timeouts after the first one 103 * has happened -- the work that runs from this timer will 104 * do that. 105 */ 106static void run_again(struct ieee80211_sub_if_data *sdata, 107 unsigned long timeout) 108{ 109 lockdep_assert_wiphy(sdata->local->hw.wiphy); 110 111 if (!timer_pending(&sdata->u.mgd.timer) || 112 time_before(timeout, sdata->u.mgd.timer.expires)) 113 mod_timer(&sdata->u.mgd.timer, timeout); 114} 115 116void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata) 117{ 118 if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER) 119 return; 120 121 if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR)) 122 return; 123 124 mod_timer(&sdata->u.mgd.bcn_mon_timer, 125 round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout)); 126} 127 128void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata) 129{ 130 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 131 132 if (unlikely(!ifmgd->associated)) 133 return; 134 135 if (ifmgd->probe_send_count) 136 ifmgd->probe_send_count = 0; 137 138 if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR)) 139 return; 140 141 mod_timer(&ifmgd->conn_mon_timer, 142 round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME)); 143} 144 145static int ecw2cw(int ecw) 146{ 147 return (1 << ecw) - 1; 148} 149 150static enum ieee80211_conn_mode 151ieee80211_determine_ap_chan(struct ieee80211_sub_if_data *sdata, 152 struct ieee80211_channel *channel, 153 u32 vht_cap_info, 154 const struct ieee802_11_elems *elems, 155 bool ignore_ht_channel_mismatch, 156 const struct ieee80211_conn_settings *conn, 157 struct cfg80211_chan_def *chandef) 158{ 159 const struct ieee80211_ht_operation *ht_oper = elems->ht_operation; 160 const struct ieee80211_vht_operation *vht_oper = elems->vht_operation; 161 const struct ieee80211_he_operation *he_oper = elems->he_operation; 162 const struct ieee80211_eht_operation *eht_oper = elems->eht_operation; 163 struct ieee80211_supported_band *sband = 164 sdata->local->hw.wiphy->bands[channel->band]; 165 struct cfg80211_chan_def vht_chandef; 166 bool no_vht = false; 167 u32 ht_cfreq; 168 169 *chandef = (struct cfg80211_chan_def) { 170 .chan = channel, 171 .width = NL80211_CHAN_WIDTH_20_NOHT, 172 .center_freq1 = channel->center_freq, 173 .freq1_offset = channel->freq_offset, 174 }; 175 176 /* get special S1G case out of the way */ 177 if (sband->band == NL80211_BAND_S1GHZ) { 178 if (!ieee80211_chandef_s1g_oper(elems->s1g_oper, chandef)) { 179 sdata_info(sdata, 180 "Missing S1G Operation Element? Trying operating == primary\n"); 181 chandef->width = ieee80211_s1g_channel_width(channel); 182 } 183 184 return IEEE80211_CONN_MODE_S1G; 185 } 186 187 /* get special 6 GHz case out of the way */ 188 if (sband->band == NL80211_BAND_6GHZ) { 189 enum ieee80211_conn_mode mode = IEEE80211_CONN_MODE_EHT; 190 191 /* this is an error */ 192 if (conn->mode < IEEE80211_CONN_MODE_HE) 193 return IEEE80211_CONN_MODE_LEGACY; 194 195 if (!elems->he_6ghz_capa || !elems->he_cap) { 196 sdata_info(sdata, 197 "HE 6 GHz AP is missing HE/HE 6 GHz band capability\n"); 198 return IEEE80211_CONN_MODE_LEGACY; 199 } 200 201 if (!eht_oper || !elems->eht_cap) { 202 eht_oper = NULL; 203 mode = IEEE80211_CONN_MODE_HE; 204 } 205 206 if (!ieee80211_chandef_he_6ghz_oper(sdata->local, he_oper, 207 eht_oper, chandef)) { 208 sdata_info(sdata, "bad HE/EHT 6 GHz operation\n"); 209 return IEEE80211_CONN_MODE_LEGACY; 210 } 211 212 return mode; 213 } 214 215 /* now we have the progression HT, VHT, ... */ 216 if (conn->mode < IEEE80211_CONN_MODE_HT) 217 return IEEE80211_CONN_MODE_LEGACY; 218 219 if (!ht_oper || !elems->ht_cap_elem) 220 return IEEE80211_CONN_MODE_LEGACY; 221 222 chandef->width = NL80211_CHAN_WIDTH_20; 223 224 ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan, 225 channel->band); 226 /* check that channel matches the right operating channel */ 227 if (!ignore_ht_channel_mismatch && channel->center_freq != ht_cfreq) { 228 /* 229 * It's possible that some APs are confused here; 230 * Netgear WNDR3700 sometimes reports 4 higher than 231 * the actual channel in association responses, but 232 * since we look at probe response/beacon data here 233 * it should be OK. 234 */ 235 sdata_info(sdata, 236 "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n", 237 channel->center_freq, ht_cfreq, 238 ht_oper->primary_chan, channel->band); 239 return IEEE80211_CONN_MODE_LEGACY; 240 } 241 242 ieee80211_chandef_ht_oper(ht_oper, chandef); 243 244 if (conn->mode < IEEE80211_CONN_MODE_VHT) 245 return IEEE80211_CONN_MODE_HT; 246 247 vht_chandef = *chandef; 248 249 /* 250 * having he_cap/he_oper parsed out implies we're at 251 * least operating as HE STA 252 */ 253 if (elems->he_cap && he_oper && 254 he_oper->he_oper_params & cpu_to_le32(IEEE80211_HE_OPERATION_VHT_OPER_INFO)) { 255 struct ieee80211_vht_operation he_oper_vht_cap; 256 257 /* 258 * Set only first 3 bytes (other 2 aren't used in 259 * ieee80211_chandef_vht_oper() anyway) 260 */ 261 memcpy(&he_oper_vht_cap, he_oper->optional, 3); 262 he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0); 263 264 if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info, 265 &he_oper_vht_cap, ht_oper, 266 &vht_chandef)) { 267 sdata_info(sdata, 268 "HE AP VHT information is invalid, disabling HE\n"); 269 /* this will cause us to re-parse as VHT STA */ 270 return IEEE80211_CONN_MODE_VHT; 271 } 272 } else if (!vht_oper || !elems->vht_cap_elem) { 273 if (sband->band == NL80211_BAND_5GHZ) { 274 sdata_info(sdata, 275 "VHT information is missing, disabling VHT\n"); 276 return IEEE80211_CONN_MODE_HT; 277 } 278 no_vht = true; 279 } else if (sband->band == NL80211_BAND_2GHZ) { 280 no_vht = true; 281 } else if (!ieee80211_chandef_vht_oper(&sdata->local->hw, 282 vht_cap_info, 283 vht_oper, ht_oper, 284 &vht_chandef)) { 285 sdata_info(sdata, 286 "AP VHT information is invalid, disabling VHT\n"); 287 return IEEE80211_CONN_MODE_HT; 288 } 289 290 if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) { 291 sdata_info(sdata, 292 "AP VHT information doesn't match HT, disabling VHT\n"); 293 return IEEE80211_CONN_MODE_HT; 294 } 295 296 *chandef = vht_chandef; 297 298 /* stick to current max mode if we or the AP don't have HE */ 299 if (conn->mode < IEEE80211_CONN_MODE_HE || 300 !elems->he_operation || !elems->he_cap) { 301 if (no_vht) 302 return IEEE80211_CONN_MODE_HT; 303 return IEEE80211_CONN_MODE_VHT; 304 } 305 306 /* stick to HE if we or the AP don't have EHT */ 307 if (conn->mode < IEEE80211_CONN_MODE_EHT || 308 !eht_oper || !elems->eht_cap) 309 return IEEE80211_CONN_MODE_HE; 310 311 /* 312 * handle the case that the EHT operation indicates that it holds EHT 313 * operation information (in case that the channel width differs from 314 * the channel width reported in HT/VHT/HE). 315 */ 316 if (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) { 317 struct cfg80211_chan_def eht_chandef = *chandef; 318 319 ieee80211_chandef_eht_oper((const void *)eht_oper->optional, 320 &eht_chandef); 321 322 eht_chandef.punctured = 323 ieee80211_eht_oper_dis_subchan_bitmap(eht_oper); 324 325 if (!cfg80211_chandef_valid(&eht_chandef)) { 326 sdata_info(sdata, 327 "AP EHT information is invalid, disabling EHT\n"); 328 return IEEE80211_CONN_MODE_HE; 329 } 330 331 if (!cfg80211_chandef_compatible(chandef, &eht_chandef)) { 332 sdata_info(sdata, 333 "AP EHT information doesn't match HT/VHT/HE, disabling EHT\n"); 334 return IEEE80211_CONN_MODE_HE; 335 } 336 337 *chandef = eht_chandef; 338 } 339 340 return IEEE80211_CONN_MODE_EHT; 341} 342 343static bool 344ieee80211_verify_peer_he_mcs_support(struct ieee80211_sub_if_data *sdata, 345 const struct ieee80211_he_cap_elem *he_cap, 346 const struct ieee80211_he_operation *he_op) 347{ 348 struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp; 349 u16 mcs_80_map_tx, mcs_80_map_rx; 350 u16 ap_min_req_set; 351 int nss; 352 353 if (!he_cap) 354 return false; 355 356 /* mcs_nss is right after he_cap info */ 357 he_mcs_nss_supp = (void *)(he_cap + 1); 358 359 mcs_80_map_tx = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80); 360 mcs_80_map_rx = le16_to_cpu(he_mcs_nss_supp->rx_mcs_80); 361 362 /* P802.11-REVme/D0.3 363 * 27.1.1 Introduction to the HE PHY 364 * ... 365 * An HE STA shall support the following features: 366 * ... 367 * Single spatial stream HE-MCSs 0 to 7 (transmit and receive) in all 368 * supported channel widths for HE SU PPDUs 369 */ 370 if ((mcs_80_map_tx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED || 371 (mcs_80_map_rx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED) { 372 sdata_info(sdata, 373 "Missing mandatory rates for 1 Nss, rx 0x%x, tx 0x%x, disable HE\n", 374 mcs_80_map_tx, mcs_80_map_rx); 375 return false; 376 } 377 378 if (!he_op) 379 return true; 380 381 ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set); 382 383 /* 384 * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all 385 * zeroes, which is nonsense, and completely inconsistent with itself 386 * (it doesn't have 8 streams). Accept the settings in this case anyway. 387 */ 388 if (!ap_min_req_set) 389 return true; 390 391 /* make sure the AP is consistent with itself 392 * 393 * P802.11-REVme/D0.3 394 * 26.17.1 Basic HE BSS operation 395 * 396 * A STA that is operating in an HE BSS shall be able to receive and 397 * transmit at each of the <HE-MCS, NSS> tuple values indicated by the 398 * Basic HE-MCS And NSS Set field of the HE Operation parameter of the 399 * MLME-START.request primitive and shall be able to receive at each of 400 * the <HE-MCS, NSS> tuple values indicated by the Supported HE-MCS and 401 * NSS Set field in the HE Capabilities parameter of the MLMESTART.request 402 * primitive 403 */ 404 for (nss = 8; nss > 0; nss--) { 405 u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3; 406 u8 ap_rx_val; 407 u8 ap_tx_val; 408 409 if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED) 410 continue; 411 412 ap_rx_val = (mcs_80_map_rx >> (2 * (nss - 1))) & 3; 413 ap_tx_val = (mcs_80_map_tx >> (2 * (nss - 1))) & 3; 414 415 if (ap_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED || 416 ap_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED || 417 ap_rx_val < ap_op_val || ap_tx_val < ap_op_val) { 418 sdata_info(sdata, 419 "Invalid rates for %d Nss, rx %d, tx %d oper %d, disable HE\n", 420 nss, ap_rx_val, ap_rx_val, ap_op_val); 421 return false; 422 } 423 } 424 425 return true; 426} 427 428static bool 429ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata, 430 struct ieee80211_supported_band *sband, 431 const struct ieee80211_he_operation *he_op) 432{ 433 const struct ieee80211_sta_he_cap *sta_he_cap = 434 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif); 435 u16 ap_min_req_set; 436 int i; 437 438 if (!sta_he_cap || !he_op) 439 return false; 440 441 ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set); 442 443 /* 444 * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all 445 * zeroes, which is nonsense, and completely inconsistent with itself 446 * (it doesn't have 8 streams). Accept the settings in this case anyway. 447 */ 448 if (!ap_min_req_set) 449 return true; 450 451 /* Need to go over for 80MHz, 160MHz and for 80+80 */ 452 for (i = 0; i < 3; i++) { 453 const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp = 454 &sta_he_cap->he_mcs_nss_supp; 455 u16 sta_mcs_map_rx = 456 le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]); 457 u16 sta_mcs_map_tx = 458 le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]); 459 u8 nss; 460 bool verified = true; 461 462 /* 463 * For each band there is a maximum of 8 spatial streams 464 * possible. Each of the sta_mcs_map_* is a 16-bit struct built 465 * of 2 bits per NSS (1-8), with the values defined in enum 466 * ieee80211_he_mcs_support. Need to make sure STA TX and RX 467 * capabilities aren't less than the AP's minimum requirements 468 * for this HE BSS per SS. 469 * It is enough to find one such band that meets the reqs. 470 */ 471 for (nss = 8; nss > 0; nss--) { 472 u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3; 473 u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3; 474 u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3; 475 476 if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED) 477 continue; 478 479 /* 480 * Make sure the HE AP doesn't require MCSs that aren't 481 * supported by the client as required by spec 482 * 483 * P802.11-REVme/D0.3 484 * 26.17.1 Basic HE BSS operation 485 * 486 * An HE STA shall not attempt to join * (MLME-JOIN.request primitive) 487 * a BSS, unless it supports (i.e., is able to both transmit and 488 * receive using) all of the <HE-MCS, NSS> tuples in the basic 489 * HE-MCS and NSS set. 490 */ 491 if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED || 492 sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED || 493 (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) { 494 verified = false; 495 break; 496 } 497 } 498 499 if (verified) 500 return true; 501 } 502 503 /* If here, STA doesn't meet AP's HE min requirements */ 504 return false; 505} 506 507static u8 508ieee80211_get_eht_cap_mcs_nss(const struct ieee80211_sta_he_cap *sta_he_cap, 509 const struct ieee80211_sta_eht_cap *sta_eht_cap, 510 unsigned int idx, int bw) 511{ 512 u8 he_phy_cap0 = sta_he_cap->he_cap_elem.phy_cap_info[0]; 513 u8 eht_phy_cap0 = sta_eht_cap->eht_cap_elem.phy_cap_info[0]; 514 515 /* handle us being a 20 MHz-only EHT STA - with four values 516 * for MCS 0-7, 8-9, 10-11, 12-13. 517 */ 518 if (!(he_phy_cap0 & IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK_ALL)) 519 return sta_eht_cap->eht_mcs_nss_supp.only_20mhz.rx_tx_max_nss[idx]; 520 521 /* the others have MCS 0-9 together, rather than separately from 0-7 */ 522 if (idx > 0) 523 idx--; 524 525 switch (bw) { 526 case 0: 527 return sta_eht_cap->eht_mcs_nss_supp.bw._80.rx_tx_max_nss[idx]; 528 case 1: 529 if (!(he_phy_cap0 & 530 (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G | 531 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G))) 532 return 0xff; /* pass check */ 533 return sta_eht_cap->eht_mcs_nss_supp.bw._160.rx_tx_max_nss[idx]; 534 case 2: 535 if (!(eht_phy_cap0 & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ)) 536 return 0xff; /* pass check */ 537 return sta_eht_cap->eht_mcs_nss_supp.bw._320.rx_tx_max_nss[idx]; 538 } 539 540 WARN_ON(1); 541 return 0; 542} 543 544static bool 545ieee80211_verify_sta_eht_mcs_support(struct ieee80211_sub_if_data *sdata, 546 struct ieee80211_supported_band *sband, 547 const struct ieee80211_eht_operation *eht_op) 548{ 549 const struct ieee80211_sta_he_cap *sta_he_cap = 550 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif); 551 const struct ieee80211_sta_eht_cap *sta_eht_cap = 552 ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif); 553 const struct ieee80211_eht_mcs_nss_supp_20mhz_only *req; 554 unsigned int i; 555 556 if (!sta_he_cap || !sta_eht_cap || !eht_op) 557 return false; 558 559 req = &eht_op->basic_mcs_nss; 560 561 for (i = 0; i < ARRAY_SIZE(req->rx_tx_max_nss); i++) { 562 u8 req_rx_nss, req_tx_nss; 563 unsigned int bw; 564 565 req_rx_nss = u8_get_bits(req->rx_tx_max_nss[i], 566 IEEE80211_EHT_MCS_NSS_RX); 567 req_tx_nss = u8_get_bits(req->rx_tx_max_nss[i], 568 IEEE80211_EHT_MCS_NSS_TX); 569 570 for (bw = 0; bw < 3; bw++) { 571 u8 have, have_rx_nss, have_tx_nss; 572 573 have = ieee80211_get_eht_cap_mcs_nss(sta_he_cap, 574 sta_eht_cap, 575 i, bw); 576 have_rx_nss = u8_get_bits(have, 577 IEEE80211_EHT_MCS_NSS_RX); 578 have_tx_nss = u8_get_bits(have, 579 IEEE80211_EHT_MCS_NSS_TX); 580 581 if (req_rx_nss > have_rx_nss || 582 req_tx_nss > have_tx_nss) 583 return false; 584 } 585 } 586 587 return true; 588} 589 590static bool ieee80211_chandef_usable(struct ieee80211_sub_if_data *sdata, 591 const struct cfg80211_chan_def *chandef, 592 u32 prohibited_flags) 593{ 594 if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, 595 chandef, prohibited_flags)) 596 return false; 597 598 if (chandef->punctured && 599 ieee80211_hw_check(&sdata->local->hw, DISALLOW_PUNCTURING)) 600 return false; 601 602 return true; 603} 604 605static struct ieee802_11_elems * 606ieee80211_determine_chan_mode(struct ieee80211_sub_if_data *sdata, 607 struct ieee80211_conn_settings *conn, 608 struct cfg80211_bss *cbss, int link_id, 609 struct ieee80211_chan_req *chanreq) 610{ 611 const struct cfg80211_bss_ies *ies = rcu_dereference(cbss->ies); 612 struct ieee80211_bss *bss = (void *)cbss->priv; 613 struct ieee80211_channel *channel = cbss->channel; 614 struct ieee80211_elems_parse_params parse_params = { 615 .link_id = -1, 616 .from_ap = true, 617 .start = ies->data, 618 .len = ies->len, 619 }; 620 struct ieee802_11_elems *elems; 621 struct ieee80211_supported_band *sband; 622 struct cfg80211_chan_def ap_chandef; 623 enum ieee80211_conn_mode ap_mode; 624 int ret; 625 626again: 627 parse_params.mode = conn->mode; 628 elems = ieee802_11_parse_elems_full(&parse_params); 629 if (!elems) 630 return ERR_PTR(-ENOMEM); 631 632 ap_mode = ieee80211_determine_ap_chan(sdata, channel, bss->vht_cap_info, 633 elems, false, conn, &ap_chandef); 634 635 /* this should be impossible since parsing depends on our mode */ 636 if (WARN_ON(ap_mode > conn->mode)) { 637 ret = -EINVAL; 638 goto free; 639 } 640 641 if (conn->mode != ap_mode) { 642 conn->mode = ap_mode; 643 kfree(elems); 644 goto again; 645 } 646 647 mlme_link_id_dbg(sdata, link_id, "determined AP %pM to be %s\n", 648 cbss->bssid, ieee80211_conn_mode_str(ap_mode)); 649 650 sband = sdata->local->hw.wiphy->bands[channel->band]; 651 652 switch (channel->band) { 653 case NL80211_BAND_S1GHZ: 654 if (WARN_ON(ap_mode != IEEE80211_CONN_MODE_S1G)) { 655 ret = -EINVAL; 656 goto free; 657 } 658 return elems; 659 case NL80211_BAND_6GHZ: 660 if (ap_mode < IEEE80211_CONN_MODE_HE) { 661 sdata_info(sdata, 662 "Rejecting non-HE 6/7 GHz connection"); 663 ret = -EINVAL; 664 goto free; 665 } 666 break; 667 default: 668 if (WARN_ON(ap_mode == IEEE80211_CONN_MODE_S1G)) { 669 ret = -EINVAL; 670 goto free; 671 } 672 } 673 674 switch (ap_mode) { 675 case IEEE80211_CONN_MODE_S1G: 676 WARN_ON(1); 677 ret = -EINVAL; 678 goto free; 679 case IEEE80211_CONN_MODE_LEGACY: 680 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20; 681 break; 682 case IEEE80211_CONN_MODE_HT: 683 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit, 684 conn->bw_limit, 685 IEEE80211_CONN_BW_LIMIT_40); 686 break; 687 case IEEE80211_CONN_MODE_VHT: 688 case IEEE80211_CONN_MODE_HE: 689 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit, 690 conn->bw_limit, 691 IEEE80211_CONN_BW_LIMIT_160); 692 break; 693 case IEEE80211_CONN_MODE_EHT: 694 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit, 695 conn->bw_limit, 696 IEEE80211_CONN_BW_LIMIT_320); 697 break; 698 } 699 700 chanreq->oper = ap_chandef; 701 702 /* wider-bandwidth OFDMA is only done in EHT */ 703 if (conn->mode >= IEEE80211_CONN_MODE_EHT && 704 !(sdata->vif.driver_flags & IEEE80211_VIF_IGNORE_OFDMA_WIDER_BW)) 705 chanreq->ap = ap_chandef; 706 else 707 chanreq->ap.chan = NULL; 708 709 while (!ieee80211_chandef_usable(sdata, &chanreq->oper, 710 IEEE80211_CHAN_DISABLED)) { 711 if (WARN_ON(chanreq->oper.width == NL80211_CHAN_WIDTH_20_NOHT)) { 712 ret = -EINVAL; 713 goto free; 714 } 715 716 ieee80211_chanreq_downgrade(chanreq, conn); 717 } 718 719 if (conn->mode >= IEEE80211_CONN_MODE_HE && 720 !cfg80211_chandef_usable(sdata->wdev.wiphy, &chanreq->oper, 721 IEEE80211_CHAN_NO_HE)) { 722 conn->mode = IEEE80211_CONN_MODE_VHT; 723 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit, 724 conn->bw_limit, 725 IEEE80211_CONN_BW_LIMIT_160); 726 } 727 728 if (conn->mode >= IEEE80211_CONN_MODE_EHT && 729 !cfg80211_chandef_usable(sdata->wdev.wiphy, &chanreq->oper, 730 IEEE80211_CHAN_NO_EHT)) { 731 conn->mode = IEEE80211_CONN_MODE_HE; 732 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit, 733 conn->bw_limit, 734 IEEE80211_CONN_BW_LIMIT_160); 735 } 736 737 if (chanreq->oper.width != ap_chandef.width || ap_mode != conn->mode) 738 sdata_info(sdata, 739 "regulatory prevented using AP config, downgraded\n"); 740 741 if (conn->mode >= IEEE80211_CONN_MODE_HE && 742 (!ieee80211_verify_peer_he_mcs_support(sdata, (void *)elems->he_cap, 743 elems->he_operation) || 744 !ieee80211_verify_sta_he_mcs_support(sdata, sband, 745 elems->he_operation))) { 746 conn->mode = IEEE80211_CONN_MODE_VHT; 747 sdata_info(sdata, "required MCSes not supported, disabling HE\n"); 748 } 749 750 if (conn->mode >= IEEE80211_CONN_MODE_EHT && 751 !ieee80211_verify_sta_eht_mcs_support(sdata, sband, 752 elems->eht_operation)) { 753 conn->mode = IEEE80211_CONN_MODE_HE; 754 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit, 755 conn->bw_limit, 756 IEEE80211_CONN_BW_LIMIT_160); 757 sdata_info(sdata, "required MCSes not supported, disabling EHT\n"); 758 } 759 760 /* the mode can only decrease, so this must terminate */ 761 if (ap_mode != conn->mode) { 762 kfree(elems); 763 goto again; 764 } 765 766 mlme_link_id_dbg(sdata, link_id, 767 "connecting with %s mode, max bandwidth %d MHz\n", 768 ieee80211_conn_mode_str(conn->mode), 769 20 * (1 << conn->bw_limit)); 770 771 if (WARN_ON_ONCE(!cfg80211_chandef_valid(&chanreq->oper))) { 772 ret = -EINVAL; 773 goto free; 774 } 775 776 return elems; 777free: 778 kfree(elems); 779 return ERR_PTR(ret); 780} 781 782static int ieee80211_config_bw(struct ieee80211_link_data *link, 783 struct ieee802_11_elems *elems, 784 bool update, u64 *changed) 785{ 786 struct ieee80211_channel *channel = link->conf->chanreq.oper.chan; 787 struct ieee80211_sub_if_data *sdata = link->sdata; 788 struct ieee80211_chan_req chanreq = {}; 789 enum ieee80211_conn_mode ap_mode; 790 u32 vht_cap_info = 0; 791 u16 ht_opmode; 792 int ret; 793 794 /* don't track any bandwidth changes in legacy/S1G modes */ 795 if (link->u.mgd.conn.mode == IEEE80211_CONN_MODE_LEGACY || 796 link->u.mgd.conn.mode == IEEE80211_CONN_MODE_S1G) 797 return 0; 798 799 if (elems->vht_cap_elem) 800 vht_cap_info = le32_to_cpu(elems->vht_cap_elem->vht_cap_info); 801 802 ap_mode = ieee80211_determine_ap_chan(sdata, channel, vht_cap_info, 803 elems, true, &link->u.mgd.conn, 804 &chanreq.ap); 805 806 if (ap_mode != link->u.mgd.conn.mode) { 807 link_info(link, 808 "AP appears to change mode (expected %s, found %s), disconnect\n", 809 ieee80211_conn_mode_str(link->u.mgd.conn.mode), 810 ieee80211_conn_mode_str(ap_mode)); 811 return -EINVAL; 812 } 813 814 chanreq.oper = chanreq.ap; 815 if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_EHT || 816 sdata->vif.driver_flags & IEEE80211_VIF_IGNORE_OFDMA_WIDER_BW) 817 chanreq.ap.chan = NULL; 818 819 /* 820 * if HT operation mode changed store the new one - 821 * this may be applicable even if channel is identical 822 */ 823 if (elems->ht_operation) { 824 ht_opmode = le16_to_cpu(elems->ht_operation->operation_mode); 825 if (link->conf->ht_operation_mode != ht_opmode) { 826 *changed |= BSS_CHANGED_HT; 827 link->conf->ht_operation_mode = ht_opmode; 828 } 829 } 830 831 /* 832 * Downgrade the new channel if we associated with restricted 833 * bandwidth capabilities. For example, if we associated as a 834 * 20 MHz STA to a 40 MHz AP (due to regulatory, capabilities 835 * or config reasons) then switching to a 40 MHz channel now 836 * won't do us any good -- we couldn't use it with the AP. 837 */ 838 while (link->u.mgd.conn.bw_limit < 839 ieee80211_min_bw_limit_from_chandef(&chanreq.oper)) 840 ieee80211_chandef_downgrade(&chanreq.oper, NULL); 841 842 if (ieee80211_chanreq_identical(&chanreq, &link->conf->chanreq)) 843 return 0; 844 845 link_info(link, 846 "AP %pM changed bandwidth, new used config is %d.%03d MHz, width %d (%d.%03d/%d MHz)\n", 847 link->u.mgd.bssid, chanreq.oper.chan->center_freq, 848 chanreq.oper.chan->freq_offset, chanreq.oper.width, 849 chanreq.oper.center_freq1, chanreq.oper.freq1_offset, 850 chanreq.oper.center_freq2); 851 852 if (!cfg80211_chandef_valid(&chanreq.oper)) { 853 sdata_info(sdata, 854 "AP %pM changed caps/bw in a way we can't support - disconnect\n", 855 link->u.mgd.bssid); 856 return -EINVAL; 857 } 858 859 if (!update) { 860 link->conf->chanreq = chanreq; 861 return 0; 862 } 863 864 /* 865 * We're tracking the current AP here, so don't do any further checks 866 * here. This keeps us from playing ping-pong with regulatory, without 867 * it the following can happen (for example): 868 * - connect to an AP with 80 MHz, world regdom allows 80 MHz 869 * - AP advertises regdom US 870 * - CRDA loads regdom US with 80 MHz prohibited (old database) 871 * - we detect an unsupported channel and disconnect 872 * - disconnect causes CRDA to reload world regdomain and the game 873 * starts anew. 874 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881) 875 * 876 * It seems possible that there are still scenarios with CSA or real 877 * bandwidth changes where a this could happen, but those cases are 878 * less common and wouldn't completely prevent using the AP. 879 */ 880 881 ret = ieee80211_link_change_chanreq(link, &chanreq, changed); 882 if (ret) { 883 sdata_info(sdata, 884 "AP %pM changed bandwidth to incompatible one - disconnect\n", 885 link->u.mgd.bssid); 886 return ret; 887 } 888 889 cfg80211_schedule_channels_check(&sdata->wdev); 890 return 0; 891} 892 893/* frame sending functions */ 894 895static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata, 896 struct sk_buff *skb, u8 ap_ht_param, 897 struct ieee80211_supported_band *sband, 898 struct ieee80211_channel *channel, 899 enum ieee80211_smps_mode smps, 900 const struct ieee80211_conn_settings *conn) 901{ 902 u8 *pos; 903 u32 flags = channel->flags; 904 u16 cap; 905 struct ieee80211_sta_ht_cap ht_cap; 906 907 BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap)); 908 909 memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap)); 910 ieee80211_apply_htcap_overrides(sdata, &ht_cap); 911 912 /* determine capability flags */ 913 cap = ht_cap.cap; 914 915 switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) { 916 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE: 917 if (flags & IEEE80211_CHAN_NO_HT40PLUS) { 918 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40; 919 cap &= ~IEEE80211_HT_CAP_SGI_40; 920 } 921 break; 922 case IEEE80211_HT_PARAM_CHA_SEC_BELOW: 923 if (flags & IEEE80211_CHAN_NO_HT40MINUS) { 924 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40; 925 cap &= ~IEEE80211_HT_CAP_SGI_40; 926 } 927 break; 928 } 929 930 /* 931 * If 40 MHz was disabled associate as though we weren't 932 * capable of 40 MHz -- some broken APs will never fall 933 * back to trying to transmit in 20 MHz. 934 */ 935 if (conn->bw_limit <= IEEE80211_CONN_BW_LIMIT_20) { 936 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40; 937 cap &= ~IEEE80211_HT_CAP_SGI_40; 938 } 939 940 /* set SM PS mode properly */ 941 cap &= ~IEEE80211_HT_CAP_SM_PS; 942 switch (smps) { 943 case IEEE80211_SMPS_AUTOMATIC: 944 case IEEE80211_SMPS_NUM_MODES: 945 WARN_ON(1); 946 fallthrough; 947 case IEEE80211_SMPS_OFF: 948 cap |= WLAN_HT_CAP_SM_PS_DISABLED << 949 IEEE80211_HT_CAP_SM_PS_SHIFT; 950 break; 951 case IEEE80211_SMPS_STATIC: 952 cap |= WLAN_HT_CAP_SM_PS_STATIC << 953 IEEE80211_HT_CAP_SM_PS_SHIFT; 954 break; 955 case IEEE80211_SMPS_DYNAMIC: 956 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC << 957 IEEE80211_HT_CAP_SM_PS_SHIFT; 958 break; 959 } 960 961 /* reserve and fill IE */ 962 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2); 963 ieee80211_ie_build_ht_cap(pos, &ht_cap, cap); 964} 965 966/* This function determines vht capability flags for the association 967 * and builds the IE. 968 * Note - the function returns true to own the MU-MIMO capability 969 */ 970static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata, 971 struct sk_buff *skb, 972 struct ieee80211_supported_band *sband, 973 struct ieee80211_vht_cap *ap_vht_cap, 974 const struct ieee80211_conn_settings *conn) 975{ 976 struct ieee80211_local *local = sdata->local; 977 u8 *pos; 978 u32 cap; 979 struct ieee80211_sta_vht_cap vht_cap; 980 u32 mask, ap_bf_sts, our_bf_sts; 981 bool mu_mimo_owner = false; 982 983 BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap)); 984 985 memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap)); 986 ieee80211_apply_vhtcap_overrides(sdata, &vht_cap); 987 988 /* determine capability flags */ 989 cap = vht_cap.cap; 990 991 if (conn->bw_limit <= IEEE80211_CONN_BW_LIMIT_80) { 992 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160; 993 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK; 994 } 995 996 /* 997 * Some APs apparently get confused if our capabilities are better 998 * than theirs, so restrict what we advertise in the assoc request. 999 */ 1000 if (!(ap_vht_cap->vht_cap_info & 1001 cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE))) 1002 cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE | 1003 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE); 1004 else if (!(ap_vht_cap->vht_cap_info & 1005 cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE))) 1006 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE; 1007 1008 /* 1009 * If some other vif is using the MU-MIMO capability we cannot associate 1010 * using MU-MIMO - this will lead to contradictions in the group-id 1011 * mechanism. 1012 * Ownership is defined since association request, in order to avoid 1013 * simultaneous associations with MU-MIMO. 1014 */ 1015 if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) { 1016 bool disable_mu_mimo = false; 1017 struct ieee80211_sub_if_data *other; 1018 1019 list_for_each_entry_rcu(other, &local->interfaces, list) { 1020 if (other->vif.bss_conf.mu_mimo_owner) { 1021 disable_mu_mimo = true; 1022 break; 1023 } 1024 } 1025 if (disable_mu_mimo) 1026 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE; 1027 else 1028 mu_mimo_owner = true; 1029 } 1030 1031 mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK; 1032 1033 ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask; 1034 our_bf_sts = cap & mask; 1035 1036 if (ap_bf_sts < our_bf_sts) { 1037 cap &= ~mask; 1038 cap |= ap_bf_sts; 1039 } 1040 1041 /* reserve and fill IE */ 1042 pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2); 1043 ieee80211_ie_build_vht_cap(pos, &vht_cap, cap); 1044 1045 return mu_mimo_owner; 1046} 1047 1048static void ieee80211_assoc_add_rates(struct sk_buff *skb, 1049 enum nl80211_chan_width width, 1050 struct ieee80211_supported_band *sband, 1051 struct ieee80211_mgd_assoc_data *assoc_data) 1052{ 1053 u32 rates; 1054 1055 if (assoc_data->supp_rates_len) { 1056 /* 1057 * Get all rates supported by the device and the AP as 1058 * some APs don't like getting a superset of their rates 1059 * in the association request (e.g. D-Link DAP 1353 in 1060 * b-only mode)... 1061 */ 1062 ieee80211_parse_bitrates(width, sband, 1063 assoc_data->supp_rates, 1064 assoc_data->supp_rates_len, 1065 &rates); 1066 } else { 1067 /* 1068 * In case AP not provide any supported rates information 1069 * before association, we send information element(s) with 1070 * all rates that we support. 1071 */ 1072 rates = ~0; 1073 } 1074 1075 ieee80211_put_srates_elem(skb, sband, 0, 0, ~rates, 1076 WLAN_EID_SUPP_RATES); 1077 ieee80211_put_srates_elem(skb, sband, 0, 0, ~rates, 1078 WLAN_EID_EXT_SUPP_RATES); 1079} 1080 1081static size_t ieee80211_add_before_ht_elems(struct sk_buff *skb, 1082 const u8 *elems, 1083 size_t elems_len, 1084 size_t offset) 1085{ 1086 size_t noffset; 1087 1088 static const u8 before_ht[] = { 1089 WLAN_EID_SSID, 1090 WLAN_EID_SUPP_RATES, 1091 WLAN_EID_EXT_SUPP_RATES, 1092 WLAN_EID_PWR_CAPABILITY, 1093 WLAN_EID_SUPPORTED_CHANNELS, 1094 WLAN_EID_RSN, 1095 WLAN_EID_QOS_CAPA, 1096 WLAN_EID_RRM_ENABLED_CAPABILITIES, 1097 WLAN_EID_MOBILITY_DOMAIN, 1098 WLAN_EID_FAST_BSS_TRANSITION, /* reassoc only */ 1099 WLAN_EID_RIC_DATA, /* reassoc only */ 1100 WLAN_EID_SUPPORTED_REGULATORY_CLASSES, 1101 }; 1102 static const u8 after_ric[] = { 1103 WLAN_EID_SUPPORTED_REGULATORY_CLASSES, 1104 WLAN_EID_HT_CAPABILITY, 1105 WLAN_EID_BSS_COEX_2040, 1106 /* luckily this is almost always there */ 1107 WLAN_EID_EXT_CAPABILITY, 1108 WLAN_EID_QOS_TRAFFIC_CAPA, 1109 WLAN_EID_TIM_BCAST_REQ, 1110 WLAN_EID_INTERWORKING, 1111 /* 60 GHz (Multi-band, DMG, MMS) can't happen */ 1112 WLAN_EID_VHT_CAPABILITY, 1113 WLAN_EID_OPMODE_NOTIF, 1114 }; 1115 1116 if (!elems_len) 1117 return offset; 1118 1119 noffset = ieee80211_ie_split_ric(elems, elems_len, 1120 before_ht, 1121 ARRAY_SIZE(before_ht), 1122 after_ric, 1123 ARRAY_SIZE(after_ric), 1124 offset); 1125 skb_put_data(skb, elems + offset, noffset - offset); 1126 1127 return noffset; 1128} 1129 1130static size_t ieee80211_add_before_vht_elems(struct sk_buff *skb, 1131 const u8 *elems, 1132 size_t elems_len, 1133 size_t offset) 1134{ 1135 static const u8 before_vht[] = { 1136 /* 1137 * no need to list the ones split off before HT 1138 * or generated here 1139 */ 1140 WLAN_EID_BSS_COEX_2040, 1141 WLAN_EID_EXT_CAPABILITY, 1142 WLAN_EID_QOS_TRAFFIC_CAPA, 1143 WLAN_EID_TIM_BCAST_REQ, 1144 WLAN_EID_INTERWORKING, 1145 /* 60 GHz (Multi-band, DMG, MMS) can't happen */ 1146 }; 1147 size_t noffset; 1148 1149 if (!elems_len) 1150 return offset; 1151 1152 /* RIC already taken care of in ieee80211_add_before_ht_elems() */ 1153 noffset = ieee80211_ie_split(elems, elems_len, 1154 before_vht, ARRAY_SIZE(before_vht), 1155 offset); 1156 skb_put_data(skb, elems + offset, noffset - offset); 1157 1158 return noffset; 1159} 1160 1161static size_t ieee80211_add_before_he_elems(struct sk_buff *skb, 1162 const u8 *elems, 1163 size_t elems_len, 1164 size_t offset) 1165{ 1166 static const u8 before_he[] = { 1167 /* 1168 * no need to list the ones split off before VHT 1169 * or generated here 1170 */ 1171 WLAN_EID_OPMODE_NOTIF, 1172 WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE, 1173 /* 11ai elements */ 1174 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION, 1175 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY, 1176 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM, 1177 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER, 1178 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN, 1179 /* TODO: add 11ah/11aj/11ak elements */ 1180 }; 1181 size_t noffset; 1182 1183 if (!elems_len) 1184 return offset; 1185 1186 /* RIC already taken care of in ieee80211_add_before_ht_elems() */ 1187 noffset = ieee80211_ie_split(elems, elems_len, 1188 before_he, ARRAY_SIZE(before_he), 1189 offset); 1190 skb_put_data(skb, elems + offset, noffset - offset); 1191 1192 return noffset; 1193} 1194 1195#define PRESENT_ELEMS_MAX 8 1196#define PRESENT_ELEM_EXT_OFFS 0x100 1197 1198static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata, 1199 struct sk_buff *skb, u16 capab, 1200 const struct element *ext_capa, 1201 const u16 *present_elems); 1202 1203static size_t ieee80211_assoc_link_elems(struct ieee80211_sub_if_data *sdata, 1204 struct sk_buff *skb, u16 *capab, 1205 const struct element *ext_capa, 1206 const u8 *extra_elems, 1207 size_t extra_elems_len, 1208 unsigned int link_id, 1209 struct ieee80211_link_data *link, 1210 u16 *present_elems) 1211{ 1212 enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif); 1213 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1214 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data; 1215 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss; 1216 struct ieee80211_channel *chan = cbss->channel; 1217 const struct ieee80211_sband_iftype_data *iftd; 1218 struct ieee80211_local *local = sdata->local; 1219 struct ieee80211_supported_band *sband; 1220 enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20; 1221 struct ieee80211_chanctx_conf *chanctx_conf; 1222 enum ieee80211_smps_mode smps_mode; 1223 u16 orig_capab = *capab; 1224 size_t offset = 0; 1225 int present_elems_len = 0; 1226 u8 *pos; 1227 int i; 1228 1229#define ADD_PRESENT_ELEM(id) do { \ 1230 /* need a last for termination - we use 0 == SSID */ \ 1231 if (!WARN_ON(present_elems_len >= PRESENT_ELEMS_MAX - 1)) \ 1232 present_elems[present_elems_len++] = (id); \ 1233} while (0) 1234#define ADD_PRESENT_EXT_ELEM(id) ADD_PRESENT_ELEM(PRESENT_ELEM_EXT_OFFS | (id)) 1235 1236 if (link) 1237 smps_mode = link->smps_mode; 1238 else if (sdata->u.mgd.powersave) 1239 smps_mode = IEEE80211_SMPS_DYNAMIC; 1240 else 1241 smps_mode = IEEE80211_SMPS_OFF; 1242 1243 if (link) { 1244 /* 1245 * 5/10 MHz scenarios are only viable without MLO, in which 1246 * case this pointer should be used ... All of this is a bit 1247 * unclear though, not sure this even works at all. 1248 */ 1249 rcu_read_lock(); 1250 chanctx_conf = rcu_dereference(link->conf->chanctx_conf); 1251 if (chanctx_conf) 1252 width = chanctx_conf->def.width; 1253 rcu_read_unlock(); 1254 } 1255 1256 sband = local->hw.wiphy->bands[chan->band]; 1257 iftd = ieee80211_get_sband_iftype_data(sband, iftype); 1258 1259 if (sband->band == NL80211_BAND_2GHZ) { 1260 *capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME; 1261 *capab |= WLAN_CAPABILITY_SHORT_PREAMBLE; 1262 } 1263 1264 if ((cbss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) && 1265 ieee80211_hw_check(&local->hw, SPECTRUM_MGMT)) 1266 *capab |= WLAN_CAPABILITY_SPECTRUM_MGMT; 1267 1268 if (sband->band != NL80211_BAND_S1GHZ) 1269 ieee80211_assoc_add_rates(skb, width, sband, assoc_data); 1270 1271 if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT || 1272 *capab & WLAN_CAPABILITY_RADIO_MEASURE) { 1273 struct cfg80211_chan_def chandef = { 1274 .width = width, 1275 .chan = chan, 1276 }; 1277 1278 pos = skb_put(skb, 4); 1279 *pos++ = WLAN_EID_PWR_CAPABILITY; 1280 *pos++ = 2; 1281 *pos++ = 0; /* min tx power */ 1282 /* max tx power */ 1283 *pos++ = ieee80211_chandef_max_power(&chandef); 1284 ADD_PRESENT_ELEM(WLAN_EID_PWR_CAPABILITY); 1285 } 1286 1287 /* 1288 * Per spec, we shouldn't include the list of channels if we advertise 1289 * support for extended channel switching, but we've always done that; 1290 * (for now?) apply this restriction only on the (new) 6 GHz band. 1291 */ 1292 if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT && 1293 (sband->band != NL80211_BAND_6GHZ || 1294 !ext_capa || ext_capa->datalen < 1 || 1295 !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) { 1296 /* TODO: get this in reg domain format */ 1297 pos = skb_put(skb, 2 * sband->n_channels + 2); 1298 *pos++ = WLAN_EID_SUPPORTED_CHANNELS; 1299 *pos++ = 2 * sband->n_channels; 1300 for (i = 0; i < sband->n_channels; i++) { 1301 int cf = sband->channels[i].center_freq; 1302 1303 *pos++ = ieee80211_frequency_to_channel(cf); 1304 *pos++ = 1; /* one channel in the subband*/ 1305 } 1306 ADD_PRESENT_ELEM(WLAN_EID_SUPPORTED_CHANNELS); 1307 } 1308 1309 /* if present, add any custom IEs that go before HT */ 1310 offset = ieee80211_add_before_ht_elems(skb, extra_elems, 1311 extra_elems_len, 1312 offset); 1313 1314 if (sband->band != NL80211_BAND_6GHZ && 1315 assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_HT) { 1316 ieee80211_add_ht_ie(sdata, skb, 1317 assoc_data->link[link_id].ap_ht_param, 1318 sband, chan, smps_mode, 1319 &assoc_data->link[link_id].conn); 1320 ADD_PRESENT_ELEM(WLAN_EID_HT_CAPABILITY); 1321 } 1322 1323 /* if present, add any custom IEs that go before VHT */ 1324 offset = ieee80211_add_before_vht_elems(skb, extra_elems, 1325 extra_elems_len, 1326 offset); 1327 1328 if (sband->band != NL80211_BAND_6GHZ && 1329 assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_VHT && 1330 sband->vht_cap.vht_supported) { 1331 bool mu_mimo_owner = 1332 ieee80211_add_vht_ie(sdata, skb, sband, 1333 &assoc_data->link[link_id].ap_vht_cap, 1334 &assoc_data->link[link_id].conn); 1335 1336 if (link) 1337 link->conf->mu_mimo_owner = mu_mimo_owner; 1338 ADD_PRESENT_ELEM(WLAN_EID_VHT_CAPABILITY); 1339 } 1340 1341 /* if present, add any custom IEs that go before HE */ 1342 offset = ieee80211_add_before_he_elems(skb, extra_elems, 1343 extra_elems_len, 1344 offset); 1345 1346 if (assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_HE) { 1347 ieee80211_put_he_cap(skb, sdata, sband, 1348 &assoc_data->link[link_id].conn); 1349 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY); 1350 ieee80211_put_he_6ghz_cap(skb, sdata, smps_mode); 1351 } 1352 1353 /* 1354 * careful - need to know about all the present elems before 1355 * calling ieee80211_assoc_add_ml_elem(), so add this one if 1356 * we're going to put it after the ML element 1357 */ 1358 if (assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_EHT) 1359 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_EHT_CAPABILITY); 1360 1361 if (link_id == assoc_data->assoc_link_id) 1362 ieee80211_assoc_add_ml_elem(sdata, skb, orig_capab, ext_capa, 1363 present_elems); 1364 1365 /* crash if somebody gets it wrong */ 1366 present_elems = NULL; 1367 1368 if (assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_EHT) 1369 ieee80211_put_eht_cap(skb, sdata, sband, 1370 &assoc_data->link[link_id].conn); 1371 1372 if (sband->band == NL80211_BAND_S1GHZ) { 1373 ieee80211_add_aid_request_ie(sdata, skb); 1374 ieee80211_add_s1g_capab_ie(sdata, &sband->s1g_cap, skb); 1375 } 1376 1377 if (iftd && iftd->vendor_elems.data && iftd->vendor_elems.len) 1378 skb_put_data(skb, iftd->vendor_elems.data, iftd->vendor_elems.len); 1379 1380 return offset; 1381} 1382 1383static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb, 1384 const u16 *outer, 1385 const u16 *inner) 1386{ 1387 unsigned int skb_len = skb->len; 1388 bool at_extension = false; 1389 bool added = false; 1390 int i, j; 1391 u8 *len, *list_len = NULL; 1392 1393 skb_put_u8(skb, WLAN_EID_EXTENSION); 1394 len = skb_put(skb, 1); 1395 skb_put_u8(skb, WLAN_EID_EXT_NON_INHERITANCE); 1396 1397 for (i = 0; i < PRESENT_ELEMS_MAX && outer[i]; i++) { 1398 u16 elem = outer[i]; 1399 bool have_inner = false; 1400 1401 /* should at least be sorted in the sense of normal -> ext */ 1402 WARN_ON(at_extension && elem < PRESENT_ELEM_EXT_OFFS); 1403 1404 /* switch to extension list */ 1405 if (!at_extension && elem >= PRESENT_ELEM_EXT_OFFS) { 1406 at_extension = true; 1407 if (!list_len) 1408 skb_put_u8(skb, 0); 1409 list_len = NULL; 1410 } 1411 1412 for (j = 0; j < PRESENT_ELEMS_MAX && inner[j]; j++) { 1413 if (elem == inner[j]) { 1414 have_inner = true; 1415 break; 1416 } 1417 } 1418 1419 if (have_inner) 1420 continue; 1421 1422 if (!list_len) { 1423 list_len = skb_put(skb, 1); 1424 *list_len = 0; 1425 } 1426 *list_len += 1; 1427 skb_put_u8(skb, (u8)elem); 1428 added = true; 1429 } 1430 1431 /* if we added a list but no extension list, make a zero-len one */ 1432 if (added && (!at_extension || !list_len)) 1433 skb_put_u8(skb, 0); 1434 1435 /* if nothing added remove extension element completely */ 1436 if (!added) 1437 skb_trim(skb, skb_len); 1438 else 1439 *len = skb->len - skb_len - 2; 1440} 1441 1442static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata, 1443 struct sk_buff *skb, u16 capab, 1444 const struct element *ext_capa, 1445 const u16 *outer_present_elems) 1446{ 1447 struct ieee80211_local *local = sdata->local; 1448 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1449 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data; 1450 struct ieee80211_multi_link_elem *ml_elem; 1451 struct ieee80211_mle_basic_common_info *common; 1452 const struct wiphy_iftype_ext_capab *ift_ext_capa; 1453 __le16 eml_capa = 0, mld_capa_ops = 0; 1454 unsigned int link_id; 1455 u8 *ml_elem_len; 1456 void *capab_pos; 1457 1458 if (!ieee80211_vif_is_mld(&sdata->vif)) 1459 return; 1460 1461 ift_ext_capa = cfg80211_get_iftype_ext_capa(local->hw.wiphy, 1462 ieee80211_vif_type_p2p(&sdata->vif)); 1463 if (ift_ext_capa) { 1464 eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities); 1465 mld_capa_ops = cpu_to_le16(ift_ext_capa->mld_capa_and_ops); 1466 } 1467 1468 skb_put_u8(skb, WLAN_EID_EXTENSION); 1469 ml_elem_len = skb_put(skb, 1); 1470 skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK); 1471 ml_elem = skb_put(skb, sizeof(*ml_elem)); 1472 ml_elem->control = 1473 cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC | 1474 IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP); 1475 common = skb_put(skb, sizeof(*common)); 1476 common->len = sizeof(*common) + 1477 2; /* MLD capa/ops */ 1478 memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN); 1479 1480 /* add EML_CAPA only if needed, see Draft P802.11be_D2.1, 35.3.17 */ 1481 if (eml_capa & 1482 cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP | 1483 IEEE80211_EML_CAP_EMLMR_SUPPORT))) { 1484 common->len += 2; /* EML capabilities */ 1485 ml_elem->control |= 1486 cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EML_CAPA); 1487 skb_put_data(skb, &eml_capa, sizeof(eml_capa)); 1488 } 1489 skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops)); 1490 1491 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) { 1492 u16 link_present_elems[PRESENT_ELEMS_MAX] = {}; 1493 const u8 *extra_elems; 1494 size_t extra_elems_len; 1495 size_t extra_used; 1496 u8 *subelem_len = NULL; 1497 __le16 ctrl; 1498 1499 if (!assoc_data->link[link_id].bss || 1500 link_id == assoc_data->assoc_link_id) 1501 continue; 1502 1503 extra_elems = assoc_data->link[link_id].elems; 1504 extra_elems_len = assoc_data->link[link_id].elems_len; 1505 1506 skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE); 1507 subelem_len = skb_put(skb, 1); 1508 1509 ctrl = cpu_to_le16(link_id | 1510 IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE | 1511 IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT); 1512 skb_put_data(skb, &ctrl, sizeof(ctrl)); 1513 skb_put_u8(skb, 1 + ETH_ALEN); /* STA Info Length */ 1514 skb_put_data(skb, assoc_data->link[link_id].addr, 1515 ETH_ALEN); 1516 /* 1517 * Now add the contents of the (re)association request, 1518 * but the "listen interval" and "current AP address" 1519 * (if applicable) are skipped. So we only have 1520 * the capability field (remember the position and fill 1521 * later), followed by the elements added below by 1522 * calling ieee80211_assoc_link_elems(). 1523 */ 1524 capab_pos = skb_put(skb, 2); 1525 1526 extra_used = ieee80211_assoc_link_elems(sdata, skb, &capab, 1527 ext_capa, 1528 extra_elems, 1529 extra_elems_len, 1530 link_id, NULL, 1531 link_present_elems); 1532 if (extra_elems) 1533 skb_put_data(skb, extra_elems + extra_used, 1534 extra_elems_len - extra_used); 1535 1536 put_unaligned_le16(capab, capab_pos); 1537 1538 ieee80211_add_non_inheritance_elem(skb, outer_present_elems, 1539 link_present_elems); 1540 1541 ieee80211_fragment_element(skb, subelem_len, 1542 IEEE80211_MLE_SUBELEM_FRAGMENT); 1543 } 1544 1545 ieee80211_fragment_element(skb, ml_elem_len, WLAN_EID_FRAGMENT); 1546} 1547 1548static int ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata) 1549{ 1550 struct ieee80211_local *local = sdata->local; 1551 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1552 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data; 1553 struct ieee80211_link_data *link; 1554 struct sk_buff *skb; 1555 struct ieee80211_mgmt *mgmt; 1556 u8 *pos, qos_info, *ie_start; 1557 size_t offset, noffset; 1558 u16 capab = 0, link_capab; 1559 __le16 listen_int; 1560 struct element *ext_capa = NULL; 1561 enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif); 1562 struct ieee80211_prep_tx_info info = {}; 1563 unsigned int link_id, n_links = 0; 1564 u16 present_elems[PRESENT_ELEMS_MAX] = {}; 1565 void *capab_pos; 1566 size_t size; 1567 int ret; 1568 1569 /* we know it's writable, cast away the const */ 1570 if (assoc_data->ie_len) 1571 ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, 1572 assoc_data->ie, 1573 assoc_data->ie_len); 1574 1575 lockdep_assert_wiphy(sdata->local->hw.wiphy); 1576 1577 size = local->hw.extra_tx_headroom + 1578 sizeof(*mgmt) + /* bit too much but doesn't matter */ 1579 2 + assoc_data->ssid_len + /* SSID */ 1580 assoc_data->ie_len + /* extra IEs */ 1581 (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) + 1582 9; /* WMM */ 1583 1584 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) { 1585 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss; 1586 const struct ieee80211_sband_iftype_data *iftd; 1587 struct ieee80211_supported_band *sband; 1588 1589 if (!cbss) 1590 continue; 1591 1592 sband = local->hw.wiphy->bands[cbss->channel->band]; 1593 1594 n_links++; 1595 /* add STA profile elements length */ 1596 size += assoc_data->link[link_id].elems_len; 1597 /* and supported rates length */ 1598 size += 4 + sband->n_bitrates; 1599 /* supported channels */ 1600 size += 2 + 2 * sband->n_channels; 1601 1602 iftd = ieee80211_get_sband_iftype_data(sband, iftype); 1603 if (iftd) 1604 size += iftd->vendor_elems.len; 1605 1606 /* power capability */ 1607 size += 4; 1608 1609 /* HT, VHT, HE, EHT */ 1610 size += 2 + sizeof(struct ieee80211_ht_cap); 1611 size += 2 + sizeof(struct ieee80211_vht_cap); 1612 size += 2 + 1 + sizeof(struct ieee80211_he_cap_elem) + 1613 sizeof(struct ieee80211_he_mcs_nss_supp) + 1614 IEEE80211_HE_PPE_THRES_MAX_LEN; 1615 1616 if (sband->band == NL80211_BAND_6GHZ) 1617 size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa); 1618 1619 size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) + 1620 sizeof(struct ieee80211_eht_mcs_nss_supp) + 1621 IEEE80211_EHT_PPE_THRES_MAX_LEN; 1622 1623 /* non-inheritance element */ 1624 size += 2 + 2 + PRESENT_ELEMS_MAX; 1625 1626 /* should be the same across all BSSes */ 1627 if (cbss->capability & WLAN_CAPABILITY_PRIVACY) 1628 capab |= WLAN_CAPABILITY_PRIVACY; 1629 } 1630 1631 if (ieee80211_vif_is_mld(&sdata->vif)) { 1632 /* consider the multi-link element with STA profile */ 1633 size += sizeof(struct ieee80211_multi_link_elem); 1634 /* max common info field in basic multi-link element */ 1635 size += sizeof(struct ieee80211_mle_basic_common_info) + 1636 2 + /* capa & op */ 1637 2; /* EML capa */ 1638 1639 /* 1640 * The capability elements were already considered above; 1641 * note this over-estimates a bit because there's no 1642 * STA profile for the assoc link. 1643 */ 1644 size += (n_links - 1) * 1645 (1 + 1 + /* subelement ID/length */ 1646 2 + /* STA control */ 1647 1 + ETH_ALEN + 2 /* STA Info field */); 1648 } 1649 1650 link = sdata_dereference(sdata->link[assoc_data->assoc_link_id], sdata); 1651 if (WARN_ON(!link)) 1652 return -EINVAL; 1653 1654 if (WARN_ON(!assoc_data->link[assoc_data->assoc_link_id].bss)) 1655 return -EINVAL; 1656 1657 skb = alloc_skb(size, GFP_KERNEL); 1658 if (!skb) 1659 return -ENOMEM; 1660 1661 skb_reserve(skb, local->hw.extra_tx_headroom); 1662 1663 if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM) 1664 capab |= WLAN_CAPABILITY_RADIO_MEASURE; 1665 1666 /* Set MBSSID support for HE AP if needed */ 1667 if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) && 1668 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HE && 1669 ext_capa && ext_capa->datalen >= 3) 1670 ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT; 1671 1672 mgmt = skb_put_zero(skb, 24); 1673 memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN); 1674 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN); 1675 memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN); 1676 1677 listen_int = cpu_to_le16(assoc_data->s1g ? 1678 ieee80211_encode_usf(local->hw.conf.listen_interval) : 1679 local->hw.conf.listen_interval); 1680 if (!is_zero_ether_addr(assoc_data->prev_ap_addr)) { 1681 skb_put(skb, 10); 1682 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 1683 IEEE80211_STYPE_REASSOC_REQ); 1684 capab_pos = &mgmt->u.reassoc_req.capab_info; 1685 mgmt->u.reassoc_req.listen_interval = listen_int; 1686 memcpy(mgmt->u.reassoc_req.current_ap, 1687 assoc_data->prev_ap_addr, ETH_ALEN); 1688 info.subtype = IEEE80211_STYPE_REASSOC_REQ; 1689 } else { 1690 skb_put(skb, 4); 1691 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 1692 IEEE80211_STYPE_ASSOC_REQ); 1693 capab_pos = &mgmt->u.assoc_req.capab_info; 1694 mgmt->u.assoc_req.listen_interval = listen_int; 1695 info.subtype = IEEE80211_STYPE_ASSOC_REQ; 1696 } 1697 1698 /* SSID */ 1699 pos = skb_put(skb, 2 + assoc_data->ssid_len); 1700 ie_start = pos; 1701 *pos++ = WLAN_EID_SSID; 1702 *pos++ = assoc_data->ssid_len; 1703 memcpy(pos, assoc_data->ssid, assoc_data->ssid_len); 1704 1705 /* 1706 * This bit is technically reserved, so it shouldn't matter for either 1707 * the AP or us, but it also means we shouldn't set it. However, we've 1708 * always set it in the past, and apparently some EHT APs check that 1709 * we don't set it. To avoid interoperability issues with old APs that 1710 * for some reason check it and want it to be set, set the bit for all 1711 * pre-EHT connections as we used to do. 1712 */ 1713 if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_EHT) 1714 capab |= WLAN_CAPABILITY_ESS; 1715 1716 /* add the elements for the assoc (main) link */ 1717 link_capab = capab; 1718 offset = ieee80211_assoc_link_elems(sdata, skb, &link_capab, 1719 ext_capa, 1720 assoc_data->ie, 1721 assoc_data->ie_len, 1722 assoc_data->assoc_link_id, link, 1723 present_elems); 1724 put_unaligned_le16(link_capab, capab_pos); 1725 1726 /* if present, add any custom non-vendor IEs */ 1727 if (assoc_data->ie_len) { 1728 noffset = ieee80211_ie_split_vendor(assoc_data->ie, 1729 assoc_data->ie_len, 1730 offset); 1731 skb_put_data(skb, assoc_data->ie + offset, noffset - offset); 1732 offset = noffset; 1733 } 1734 1735 if (assoc_data->wmm) { 1736 if (assoc_data->uapsd) { 1737 qos_info = ifmgd->uapsd_queues; 1738 qos_info |= (ifmgd->uapsd_max_sp_len << 1739 IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT); 1740 } else { 1741 qos_info = 0; 1742 } 1743 1744 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info); 1745 } 1746 1747 /* add any remaining custom (i.e. vendor specific here) IEs */ 1748 if (assoc_data->ie_len) { 1749 noffset = assoc_data->ie_len; 1750 skb_put_data(skb, assoc_data->ie + offset, noffset - offset); 1751 } 1752 1753 if (assoc_data->fils_kek_len) { 1754 ret = fils_encrypt_assoc_req(skb, assoc_data); 1755 if (ret < 0) { 1756 dev_kfree_skb(skb); 1757 return ret; 1758 } 1759 } 1760 1761 pos = skb_tail_pointer(skb); 1762 kfree(ifmgd->assoc_req_ies); 1763 ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC); 1764 if (!ifmgd->assoc_req_ies) { 1765 dev_kfree_skb(skb); 1766 return -ENOMEM; 1767 } 1768 1769 ifmgd->assoc_req_ies_len = pos - ie_start; 1770 1771 info.link_id = assoc_data->assoc_link_id; 1772 drv_mgd_prepare_tx(local, sdata, &info); 1773 1774 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; 1775 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) 1776 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS | 1777 IEEE80211_TX_INTFL_MLME_CONN_TX; 1778 ieee80211_tx_skb(sdata, skb); 1779 1780 return 0; 1781} 1782 1783void ieee80211_send_pspoll(struct ieee80211_local *local, 1784 struct ieee80211_sub_if_data *sdata) 1785{ 1786 struct ieee80211_pspoll *pspoll; 1787 struct sk_buff *skb; 1788 1789 skb = ieee80211_pspoll_get(&local->hw, &sdata->vif); 1790 if (!skb) 1791 return; 1792 1793 pspoll = (struct ieee80211_pspoll *) skb->data; 1794 pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM); 1795 1796 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; 1797 ieee80211_tx_skb(sdata, skb); 1798} 1799 1800void ieee80211_send_nullfunc(struct ieee80211_local *local, 1801 struct ieee80211_sub_if_data *sdata, 1802 bool powersave) 1803{ 1804 struct sk_buff *skb; 1805 struct ieee80211_hdr_3addr *nullfunc; 1806 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1807 1808 skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, -1, 1809 !ieee80211_hw_check(&local->hw, 1810 DOESNT_SUPPORT_QOS_NDP)); 1811 if (!skb) 1812 return; 1813 1814 nullfunc = (struct ieee80211_hdr_3addr *) skb->data; 1815 if (powersave) 1816 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM); 1817 1818 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT | 1819 IEEE80211_TX_INTFL_OFFCHAN_TX_OK; 1820 1821 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) 1822 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS; 1823 1824 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) 1825 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE; 1826 1827 ieee80211_tx_skb(sdata, skb); 1828} 1829 1830void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local, 1831 struct ieee80211_sub_if_data *sdata) 1832{ 1833 struct sk_buff *skb; 1834 struct ieee80211_hdr *nullfunc; 1835 __le16 fc; 1836 1837 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION)) 1838 return; 1839 1840 skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30); 1841 if (!skb) 1842 return; 1843 1844 skb_reserve(skb, local->hw.extra_tx_headroom); 1845 1846 nullfunc = skb_put_zero(skb, 30); 1847 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC | 1848 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS); 1849 nullfunc->frame_control = fc; 1850 memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN); 1851 memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN); 1852 memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN); 1853 memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN); 1854 1855 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; 1856 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE; 1857 ieee80211_tx_skb(sdata, skb); 1858} 1859 1860/* spectrum management related things */ 1861static void ieee80211_chswitch_work(struct wiphy *wiphy, 1862 struct wiphy_work *work) 1863{ 1864 struct ieee80211_link_data *link = 1865 container_of(work, struct ieee80211_link_data, 1866 u.mgd.chswitch_work.work); 1867 struct ieee80211_sub_if_data *sdata = link->sdata; 1868 struct ieee80211_local *local = sdata->local; 1869 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1870 int ret; 1871 1872 if (!ieee80211_sdata_running(sdata)) 1873 return; 1874 1875 lockdep_assert_wiphy(local->hw.wiphy); 1876 1877 if (!ifmgd->associated) 1878 return; 1879 1880 if (!link->conf->csa_active) 1881 return; 1882 1883 /* 1884 * using reservation isn't immediate as it may be deferred until later 1885 * with multi-vif. once reservation is complete it will re-schedule the 1886 * work with no reserved_chanctx so verify chandef to check if it 1887 * completed successfully 1888 */ 1889 1890 if (link->reserved_chanctx) { 1891 /* 1892 * with multi-vif csa driver may call ieee80211_csa_finish() 1893 * many times while waiting for other interfaces to use their 1894 * reservations 1895 */ 1896 if (link->reserved_ready) 1897 return; 1898 1899 ret = ieee80211_link_use_reserved_context(link); 1900 if (ret) { 1901 sdata_info(sdata, 1902 "failed to use reserved channel context, disconnecting (err=%d)\n", 1903 ret); 1904 wiphy_work_queue(sdata->local->hw.wiphy, 1905 &ifmgd->csa_connection_drop_work); 1906 } 1907 return; 1908 } 1909 1910 if (!ieee80211_chanreq_identical(&link->conf->chanreq, 1911 &link->csa_chanreq)) { 1912 sdata_info(sdata, 1913 "failed to finalize channel switch, disconnecting\n"); 1914 wiphy_work_queue(sdata->local->hw.wiphy, 1915 &ifmgd->csa_connection_drop_work); 1916 return; 1917 } 1918 1919 link->u.mgd.csa_waiting_bcn = true; 1920 1921 ieee80211_sta_reset_beacon_monitor(sdata); 1922 ieee80211_sta_reset_conn_monitor(sdata); 1923} 1924 1925static void ieee80211_chswitch_post_beacon(struct ieee80211_link_data *link) 1926{ 1927 struct ieee80211_sub_if_data *sdata = link->sdata; 1928 struct ieee80211_local *local = sdata->local; 1929 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 1930 int ret; 1931 1932 lockdep_assert_wiphy(sdata->local->hw.wiphy); 1933 1934 WARN_ON(!link->conf->csa_active); 1935 1936 if (sdata->csa_blocked_tx) { 1937 ieee80211_wake_vif_queues(local, sdata, 1938 IEEE80211_QUEUE_STOP_REASON_CSA); 1939 sdata->csa_blocked_tx = false; 1940 } 1941 1942 link->conf->csa_active = false; 1943 link->u.mgd.csa_waiting_bcn = false; 1944 1945 ret = drv_post_channel_switch(link); 1946 if (ret) { 1947 sdata_info(sdata, 1948 "driver post channel switch failed, disconnecting\n"); 1949 wiphy_work_queue(sdata->local->hw.wiphy, 1950 &ifmgd->csa_connection_drop_work); 1951 return; 1952 } 1953 1954 cfg80211_ch_switch_notify(sdata->dev, &link->reserved.oper, 1955 link->link_id); 1956} 1957 1958void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success, 1959 unsigned int link_id) 1960{ 1961 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 1962 1963 trace_api_chswitch_done(sdata, success, link_id); 1964 1965 rcu_read_lock(); 1966 1967 if (!success) { 1968 sdata_info(sdata, 1969 "driver channel switch failed, disconnecting\n"); 1970 wiphy_work_queue(sdata->local->hw.wiphy, 1971 &sdata->u.mgd.csa_connection_drop_work); 1972 } else { 1973 struct ieee80211_link_data *link = 1974 rcu_dereference(sdata->link[link_id]); 1975 1976 if (WARN_ON(!link)) { 1977 rcu_read_unlock(); 1978 return; 1979 } 1980 1981 wiphy_delayed_work_queue(sdata->local->hw.wiphy, 1982 &link->u.mgd.chswitch_work, 0); 1983 } 1984 1985 rcu_read_unlock(); 1986} 1987EXPORT_SYMBOL(ieee80211_chswitch_done); 1988 1989static void 1990ieee80211_sta_abort_chanswitch(struct ieee80211_link_data *link) 1991{ 1992 struct ieee80211_sub_if_data *sdata = link->sdata; 1993 struct ieee80211_local *local = sdata->local; 1994 1995 lockdep_assert_wiphy(local->hw.wiphy); 1996 1997 if (!local->ops->abort_channel_switch) 1998 return; 1999 2000 ieee80211_link_unreserve_chanctx(link); 2001 2002 if (sdata->csa_blocked_tx) { 2003 ieee80211_wake_vif_queues(local, sdata, 2004 IEEE80211_QUEUE_STOP_REASON_CSA); 2005 sdata->csa_blocked_tx = false; 2006 } 2007 2008 link->conf->csa_active = false; 2009 2010 drv_abort_channel_switch(link); 2011} 2012 2013static void 2014ieee80211_sta_process_chanswitch(struct ieee80211_link_data *link, 2015 u64 timestamp, u32 device_timestamp, 2016 struct ieee802_11_elems *elems, 2017 bool beacon) 2018{ 2019 struct ieee80211_sub_if_data *sdata = link->sdata; 2020 struct ieee80211_local *local = sdata->local; 2021 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2022 struct cfg80211_bss *cbss = link->conf->bss; 2023 struct ieee80211_chanctx_conf *conf; 2024 struct ieee80211_chanctx *chanctx; 2025 enum nl80211_band current_band; 2026 struct ieee80211_csa_ie csa_ie; 2027 struct ieee80211_channel_switch ch_switch = { 2028 .link_id = link->link_id, 2029 }; 2030 struct ieee80211_bss *bss; 2031 unsigned long timeout; 2032 int res; 2033 2034 lockdep_assert_wiphy(local->hw.wiphy); 2035 2036 if (!cbss) 2037 return; 2038 2039 current_band = cbss->channel->band; 2040 bss = (void *)cbss->priv; 2041 res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band, 2042 bss->vht_cap_info, 2043 &link->u.mgd.conn, 2044 link->u.mgd.bssid, &csa_ie); 2045 2046 if (!res) { 2047 ch_switch.timestamp = timestamp; 2048 ch_switch.device_timestamp = device_timestamp; 2049 ch_switch.block_tx = csa_ie.mode; 2050 ch_switch.chandef = csa_ie.chanreq.oper; 2051 ch_switch.count = csa_ie.count; 2052 ch_switch.delay = csa_ie.max_switch_time; 2053 } 2054 2055 if (res < 0) 2056 goto drop_connection; 2057 2058 if (link->conf->csa_active) { 2059 /* already processing - disregard action frames */ 2060 if (!beacon) 2061 return; 2062 2063 if (link->u.mgd.csa_waiting_bcn) { 2064 ieee80211_chswitch_post_beacon(link); 2065 /* 2066 * If the CSA IE is still present in the beacon after 2067 * the switch, we need to consider it as a new CSA 2068 * (possibly to self) - this happens by not returning 2069 * here so we'll get to the check below. 2070 */ 2071 } else if (res) { 2072 ieee80211_sta_abort_chanswitch(link); 2073 return; 2074 } else { 2075 drv_channel_switch_rx_beacon(sdata, &ch_switch); 2076 return; 2077 } 2078 } 2079 2080 /* nothing to do at all - no active CSA nor a new one */ 2081 if (res) 2082 return; 2083 2084 if (link->conf->chanreq.oper.chan->band != 2085 csa_ie.chanreq.oper.chan->band) { 2086 sdata_info(sdata, 2087 "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n", 2088 link->u.mgd.bssid, 2089 csa_ie.chanreq.oper.chan->center_freq, 2090 csa_ie.chanreq.oper.width, 2091 csa_ie.chanreq.oper.center_freq1, 2092 csa_ie.chanreq.oper.center_freq2); 2093 goto drop_connection; 2094 } 2095 2096 if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chanreq.oper, 2097 IEEE80211_CHAN_DISABLED)) { 2098 sdata_info(sdata, 2099 "AP %pM switches to unsupported channel " 2100 "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), " 2101 "disconnecting\n", 2102 link->u.mgd.bssid, 2103 csa_ie.chanreq.oper.chan->center_freq, 2104 csa_ie.chanreq.oper.chan->freq_offset, 2105 csa_ie.chanreq.oper.width, 2106 csa_ie.chanreq.oper.center_freq1, 2107 csa_ie.chanreq.oper.freq1_offset, 2108 csa_ie.chanreq.oper.center_freq2); 2109 goto drop_connection; 2110 } 2111 2112 if (cfg80211_chandef_identical(&csa_ie.chanreq.oper, 2113 &link->conf->chanreq.oper) && 2114 (!csa_ie.mode || !beacon)) { 2115 if (link->u.mgd.csa_ignored_same_chan) 2116 return; 2117 sdata_info(sdata, 2118 "AP %pM tries to chanswitch to same channel, ignore\n", 2119 link->u.mgd.bssid); 2120 link->u.mgd.csa_ignored_same_chan = true; 2121 return; 2122 } 2123 2124 /* 2125 * Drop all TDLS peers on the affected link - either we disconnect or 2126 * move to a different channel from this point on. There's no telling 2127 * what our peer will do. 2128 * The TDLS WIDER_BW scenario is also problematic, as peers might now 2129 * have an incompatible wider chandef. 2130 */ 2131 ieee80211_teardown_tdls_peers(link); 2132 2133 conf = rcu_dereference_protected(link->conf->chanctx_conf, 2134 lockdep_is_held(&local->hw.wiphy->mtx)); 2135 if (!conf) { 2136 sdata_info(sdata, 2137 "no channel context assigned to vif?, disconnecting\n"); 2138 goto drop_connection; 2139 } 2140 2141 chanctx = container_of(conf, struct ieee80211_chanctx, conf); 2142 2143 if (!ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) { 2144 sdata_info(sdata, 2145 "driver doesn't support chan-switch with channel contexts\n"); 2146 goto drop_connection; 2147 } 2148 2149 if (drv_pre_channel_switch(sdata, &ch_switch)) { 2150 sdata_info(sdata, 2151 "preparing for channel switch failed, disconnecting\n"); 2152 goto drop_connection; 2153 } 2154 2155 res = ieee80211_link_reserve_chanctx(link, &csa_ie.chanreq, 2156 chanctx->mode, false); 2157 if (res) { 2158 sdata_info(sdata, 2159 "failed to reserve channel context for channel switch, disconnecting (err=%d)\n", 2160 res); 2161 goto drop_connection; 2162 } 2163 2164 link->conf->csa_active = true; 2165 link->csa_chanreq = csa_ie.chanreq; 2166 link->u.mgd.csa_ignored_same_chan = false; 2167 link->u.mgd.beacon_crc_valid = false; 2168 2169 if (csa_ie.mode && 2170 !ieee80211_hw_check(&local->hw, HANDLES_QUIET_CSA)) { 2171 ieee80211_stop_vif_queues(local, sdata, 2172 IEEE80211_QUEUE_STOP_REASON_CSA); 2173 sdata->csa_blocked_tx = true; 2174 } 2175 2176 cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chanreq.oper, 2177 link->link_id, csa_ie.count, 2178 csa_ie.mode); 2179 2180 if (local->ops->channel_switch) { 2181 /* use driver's channel switch callback */ 2182 drv_channel_switch(local, sdata, &ch_switch); 2183 return; 2184 } 2185 2186 /* channel switch handled in software */ 2187 timeout = TU_TO_JIFFIES((max_t(int, csa_ie.count, 1) - 1) * 2188 cbss->beacon_interval); 2189 wiphy_delayed_work_queue(local->hw.wiphy, 2190 &link->u.mgd.chswitch_work, 2191 timeout); 2192 return; 2193 drop_connection: 2194 /* 2195 * This is just so that the disconnect flow will know that 2196 * we were trying to switch channel and failed. In case the 2197 * mode is 1 (we are not allowed to Tx), we will know not to 2198 * send a deauthentication frame. Those two fields will be 2199 * reset when the disconnection worker runs. 2200 */ 2201 link->conf->csa_active = true; 2202 sdata->csa_blocked_tx = 2203 csa_ie.mode && !ieee80211_hw_check(&local->hw, HANDLES_QUIET_CSA); 2204 2205 wiphy_work_queue(sdata->local->hw.wiphy, 2206 &ifmgd->csa_connection_drop_work); 2207} 2208 2209static bool 2210ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata, 2211 struct ieee80211_channel *channel, 2212 const u8 *country_ie, u8 country_ie_len, 2213 const u8 *pwr_constr_elem, 2214 int *chan_pwr, int *pwr_reduction) 2215{ 2216 struct ieee80211_country_ie_triplet *triplet; 2217 int chan = ieee80211_frequency_to_channel(channel->center_freq); 2218 int i, chan_increment; 2219 bool have_chan_pwr = false; 2220 2221 /* Invalid IE */ 2222 if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN) 2223 return false; 2224 2225 triplet = (void *)(country_ie + 3); 2226 country_ie_len -= 3; 2227 2228 switch (channel->band) { 2229 default: 2230 WARN_ON_ONCE(1); 2231 fallthrough; 2232 case NL80211_BAND_2GHZ: 2233 case NL80211_BAND_60GHZ: 2234 case NL80211_BAND_LC: 2235 chan_increment = 1; 2236 break; 2237 case NL80211_BAND_5GHZ: 2238 chan_increment = 4; 2239 break; 2240 case NL80211_BAND_6GHZ: 2241 /* 2242 * In the 6 GHz band, the "maximum transmit power level" 2243 * field in the triplets is reserved, and thus will be 2244 * zero and we shouldn't use it to control TX power. 2245 * The actual TX power will be given in the transmit 2246 * power envelope element instead. 2247 */ 2248 return false; 2249 } 2250 2251 /* find channel */ 2252 while (country_ie_len >= 3) { 2253 u8 first_channel = triplet->chans.first_channel; 2254 2255 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID) 2256 goto next; 2257 2258 for (i = 0; i < triplet->chans.num_channels; i++) { 2259 if (first_channel + i * chan_increment == chan) { 2260 have_chan_pwr = true; 2261 *chan_pwr = triplet->chans.max_power; 2262 break; 2263 } 2264 } 2265 if (have_chan_pwr) 2266 break; 2267 2268 next: 2269 triplet++; 2270 country_ie_len -= 3; 2271 } 2272 2273 if (have_chan_pwr && pwr_constr_elem) 2274 *pwr_reduction = *pwr_constr_elem; 2275 else 2276 *pwr_reduction = 0; 2277 2278 return have_chan_pwr; 2279} 2280 2281static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata, 2282 struct ieee80211_channel *channel, 2283 const u8 *cisco_dtpc_ie, 2284 int *pwr_level) 2285{ 2286 /* From practical testing, the first data byte of the DTPC element 2287 * seems to contain the requested dBm level, and the CLI on Cisco 2288 * APs clearly state the range is -127 to 127 dBm, which indicates 2289 * a signed byte, although it seemingly never actually goes negative. 2290 * The other byte seems to always be zero. 2291 */ 2292 *pwr_level = (__s8)cisco_dtpc_ie[4]; 2293} 2294 2295static u64 ieee80211_handle_pwr_constr(struct ieee80211_link_data *link, 2296 struct ieee80211_channel *channel, 2297 struct ieee80211_mgmt *mgmt, 2298 const u8 *country_ie, u8 country_ie_len, 2299 const u8 *pwr_constr_ie, 2300 const u8 *cisco_dtpc_ie) 2301{ 2302 struct ieee80211_sub_if_data *sdata = link->sdata; 2303 bool has_80211h_pwr = false, has_cisco_pwr = false; 2304 int chan_pwr = 0, pwr_reduction_80211h = 0; 2305 int pwr_level_cisco, pwr_level_80211h; 2306 int new_ap_level; 2307 __le16 capab = mgmt->u.probe_resp.capab_info; 2308 2309 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) 2310 return 0; /* TODO */ 2311 2312 if (country_ie && 2313 (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) || 2314 capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) { 2315 has_80211h_pwr = ieee80211_find_80211h_pwr_constr( 2316 sdata, channel, country_ie, country_ie_len, 2317 pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h); 2318 pwr_level_80211h = 2319 max_t(int, 0, chan_pwr - pwr_reduction_80211h); 2320 } 2321 2322 if (cisco_dtpc_ie) { 2323 ieee80211_find_cisco_dtpc( 2324 sdata, channel, cisco_dtpc_ie, &pwr_level_cisco); 2325 has_cisco_pwr = true; 2326 } 2327 2328 if (!has_80211h_pwr && !has_cisco_pwr) 2329 return 0; 2330 2331 /* If we have both 802.11h and Cisco DTPC, apply both limits 2332 * by picking the smallest of the two power levels advertised. 2333 */ 2334 if (has_80211h_pwr && 2335 (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) { 2336 new_ap_level = pwr_level_80211h; 2337 2338 if (link->ap_power_level == new_ap_level) 2339 return 0; 2340 2341 sdata_dbg(sdata, 2342 "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n", 2343 pwr_level_80211h, chan_pwr, pwr_reduction_80211h, 2344 link->u.mgd.bssid); 2345 } else { /* has_cisco_pwr is always true here. */ 2346 new_ap_level = pwr_level_cisco; 2347 2348 if (link->ap_power_level == new_ap_level) 2349 return 0; 2350 2351 sdata_dbg(sdata, 2352 "Limiting TX power to %d dBm as advertised by %pM\n", 2353 pwr_level_cisco, link->u.mgd.bssid); 2354 } 2355 2356 link->ap_power_level = new_ap_level; 2357 if (__ieee80211_recalc_txpower(sdata)) 2358 return BSS_CHANGED_TXPOWER; 2359 return 0; 2360} 2361 2362/* powersave */ 2363static void ieee80211_enable_ps(struct ieee80211_local *local, 2364 struct ieee80211_sub_if_data *sdata) 2365{ 2366 struct ieee80211_conf *conf = &local->hw.conf; 2367 2368 /* 2369 * If we are scanning right now then the parameters will 2370 * take effect when scan finishes. 2371 */ 2372 if (local->scanning) 2373 return; 2374 2375 if (conf->dynamic_ps_timeout > 0 && 2376 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) { 2377 mod_timer(&local->dynamic_ps_timer, jiffies + 2378 msecs_to_jiffies(conf->dynamic_ps_timeout)); 2379 } else { 2380 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) 2381 ieee80211_send_nullfunc(local, sdata, true); 2382 2383 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) && 2384 ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) 2385 return; 2386 2387 conf->flags |= IEEE80211_CONF_PS; 2388 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 2389 } 2390} 2391 2392static void ieee80211_change_ps(struct ieee80211_local *local) 2393{ 2394 struct ieee80211_conf *conf = &local->hw.conf; 2395 2396 if (local->ps_sdata) { 2397 ieee80211_enable_ps(local, local->ps_sdata); 2398 } else if (conf->flags & IEEE80211_CONF_PS) { 2399 conf->flags &= ~IEEE80211_CONF_PS; 2400 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 2401 del_timer_sync(&local->dynamic_ps_timer); 2402 wiphy_work_cancel(local->hw.wiphy, 2403 &local->dynamic_ps_enable_work); 2404 } 2405} 2406 2407static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata) 2408{ 2409 struct ieee80211_local *local = sdata->local; 2410 struct ieee80211_if_managed *mgd = &sdata->u.mgd; 2411 struct sta_info *sta = NULL; 2412 bool authorized = false; 2413 2414 if (!mgd->powersave) 2415 return false; 2416 2417 if (mgd->broken_ap) 2418 return false; 2419 2420 if (!mgd->associated) 2421 return false; 2422 2423 if (mgd->flags & IEEE80211_STA_CONNECTION_POLL) 2424 return false; 2425 2426 if (!(local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO) && 2427 !sdata->deflink.u.mgd.have_beacon) 2428 return false; 2429 2430 rcu_read_lock(); 2431 sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr); 2432 if (sta) 2433 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED); 2434 rcu_read_unlock(); 2435 2436 return authorized; 2437} 2438 2439/* need to hold RTNL or interface lock */ 2440void ieee80211_recalc_ps(struct ieee80211_local *local) 2441{ 2442 struct ieee80211_sub_if_data *sdata, *found = NULL; 2443 int count = 0; 2444 int timeout; 2445 2446 if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS) || 2447 ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) { 2448 local->ps_sdata = NULL; 2449 return; 2450 } 2451 2452 list_for_each_entry(sdata, &local->interfaces, list) { 2453 if (!ieee80211_sdata_running(sdata)) 2454 continue; 2455 if (sdata->vif.type == NL80211_IFTYPE_AP) { 2456 /* If an AP vif is found, then disable PS 2457 * by setting the count to zero thereby setting 2458 * ps_sdata to NULL. 2459 */ 2460 count = 0; 2461 break; 2462 } 2463 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2464 continue; 2465 found = sdata; 2466 count++; 2467 } 2468 2469 if (count == 1 && ieee80211_powersave_allowed(found)) { 2470 u8 dtimper = found->deflink.u.mgd.dtim_period; 2471 2472 timeout = local->dynamic_ps_forced_timeout; 2473 if (timeout < 0) 2474 timeout = 100; 2475 local->hw.conf.dynamic_ps_timeout = timeout; 2476 2477 /* If the TIM IE is invalid, pretend the value is 1 */ 2478 if (!dtimper) 2479 dtimper = 1; 2480 2481 local->hw.conf.ps_dtim_period = dtimper; 2482 local->ps_sdata = found; 2483 } else { 2484 local->ps_sdata = NULL; 2485 } 2486 2487 ieee80211_change_ps(local); 2488} 2489 2490void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata) 2491{ 2492 bool ps_allowed = ieee80211_powersave_allowed(sdata); 2493 2494 if (sdata->vif.cfg.ps != ps_allowed) { 2495 sdata->vif.cfg.ps = ps_allowed; 2496 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_PS); 2497 } 2498} 2499 2500void ieee80211_dynamic_ps_disable_work(struct wiphy *wiphy, 2501 struct wiphy_work *work) 2502{ 2503 struct ieee80211_local *local = 2504 container_of(work, struct ieee80211_local, 2505 dynamic_ps_disable_work); 2506 2507 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 2508 local->hw.conf.flags &= ~IEEE80211_CONF_PS; 2509 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 2510 } 2511 2512 ieee80211_wake_queues_by_reason(&local->hw, 2513 IEEE80211_MAX_QUEUE_MAP, 2514 IEEE80211_QUEUE_STOP_REASON_PS, 2515 false); 2516} 2517 2518void ieee80211_dynamic_ps_enable_work(struct wiphy *wiphy, 2519 struct wiphy_work *work) 2520{ 2521 struct ieee80211_local *local = 2522 container_of(work, struct ieee80211_local, 2523 dynamic_ps_enable_work); 2524 struct ieee80211_sub_if_data *sdata = local->ps_sdata; 2525 struct ieee80211_if_managed *ifmgd; 2526 unsigned long flags; 2527 int q; 2528 2529 /* can only happen when PS was just disabled anyway */ 2530 if (!sdata) 2531 return; 2532 2533 ifmgd = &sdata->u.mgd; 2534 2535 if (local->hw.conf.flags & IEEE80211_CONF_PS) 2536 return; 2537 2538 if (local->hw.conf.dynamic_ps_timeout > 0) { 2539 /* don't enter PS if TX frames are pending */ 2540 if (drv_tx_frames_pending(local)) { 2541 mod_timer(&local->dynamic_ps_timer, jiffies + 2542 msecs_to_jiffies( 2543 local->hw.conf.dynamic_ps_timeout)); 2544 return; 2545 } 2546 2547 /* 2548 * transmission can be stopped by others which leads to 2549 * dynamic_ps_timer expiry. Postpone the ps timer if it 2550 * is not the actual idle state. 2551 */ 2552 spin_lock_irqsave(&local->queue_stop_reason_lock, flags); 2553 for (q = 0; q < local->hw.queues; q++) { 2554 if (local->queue_stop_reasons[q]) { 2555 spin_unlock_irqrestore(&local->queue_stop_reason_lock, 2556 flags); 2557 mod_timer(&local->dynamic_ps_timer, jiffies + 2558 msecs_to_jiffies( 2559 local->hw.conf.dynamic_ps_timeout)); 2560 return; 2561 } 2562 } 2563 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); 2564 } 2565 2566 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) && 2567 !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) { 2568 if (drv_tx_frames_pending(local)) { 2569 mod_timer(&local->dynamic_ps_timer, jiffies + 2570 msecs_to_jiffies( 2571 local->hw.conf.dynamic_ps_timeout)); 2572 } else { 2573 ieee80211_send_nullfunc(local, sdata, true); 2574 /* Flush to get the tx status of nullfunc frame */ 2575 ieee80211_flush_queues(local, sdata, false); 2576 } 2577 } 2578 2579 if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) && 2580 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) || 2581 (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) { 2582 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED; 2583 local->hw.conf.flags |= IEEE80211_CONF_PS; 2584 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 2585 } 2586} 2587 2588void ieee80211_dynamic_ps_timer(struct timer_list *t) 2589{ 2590 struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer); 2591 2592 wiphy_work_queue(local->hw.wiphy, &local->dynamic_ps_enable_work); 2593} 2594 2595void ieee80211_dfs_cac_timer_work(struct wiphy *wiphy, struct wiphy_work *work) 2596{ 2597 struct ieee80211_link_data *link = 2598 container_of(work, struct ieee80211_link_data, 2599 dfs_cac_timer_work.work); 2600 struct cfg80211_chan_def chandef = link->conf->chanreq.oper; 2601 struct ieee80211_sub_if_data *sdata = link->sdata; 2602 2603 lockdep_assert_wiphy(sdata->local->hw.wiphy); 2604 2605 if (sdata->wdev.cac_started) { 2606 ieee80211_link_release_channel(link); 2607 cfg80211_cac_event(sdata->dev, &chandef, 2608 NL80211_RADAR_CAC_FINISHED, 2609 GFP_KERNEL); 2610 } 2611} 2612 2613static bool 2614__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata) 2615{ 2616 struct ieee80211_local *local = sdata->local; 2617 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2618 bool ret = false; 2619 int ac; 2620 2621 if (local->hw.queues < IEEE80211_NUM_ACS) 2622 return false; 2623 2624 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { 2625 struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac]; 2626 int non_acm_ac; 2627 unsigned long now = jiffies; 2628 2629 if (tx_tspec->action == TX_TSPEC_ACTION_NONE && 2630 tx_tspec->admitted_time && 2631 time_after(now, tx_tspec->time_slice_start + HZ)) { 2632 tx_tspec->consumed_tx_time = 0; 2633 tx_tspec->time_slice_start = now; 2634 2635 if (tx_tspec->downgraded) 2636 tx_tspec->action = 2637 TX_TSPEC_ACTION_STOP_DOWNGRADE; 2638 } 2639 2640 switch (tx_tspec->action) { 2641 case TX_TSPEC_ACTION_STOP_DOWNGRADE: 2642 /* take the original parameters */ 2643 if (drv_conf_tx(local, &sdata->deflink, ac, 2644 &sdata->deflink.tx_conf[ac])) 2645 link_err(&sdata->deflink, 2646 "failed to set TX queue parameters for queue %d\n", 2647 ac); 2648 tx_tspec->action = TX_TSPEC_ACTION_NONE; 2649 tx_tspec->downgraded = false; 2650 ret = true; 2651 break; 2652 case TX_TSPEC_ACTION_DOWNGRADE: 2653 if (time_after(now, tx_tspec->time_slice_start + HZ)) { 2654 tx_tspec->action = TX_TSPEC_ACTION_NONE; 2655 ret = true; 2656 break; 2657 } 2658 /* downgrade next lower non-ACM AC */ 2659 for (non_acm_ac = ac + 1; 2660 non_acm_ac < IEEE80211_NUM_ACS; 2661 non_acm_ac++) 2662 if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac))) 2663 break; 2664 /* Usually the loop will result in using BK even if it 2665 * requires admission control, but such a configuration 2666 * makes no sense and we have to transmit somehow - the 2667 * AC selection does the same thing. 2668 * If we started out trying to downgrade from BK, then 2669 * the extra condition here might be needed. 2670 */ 2671 if (non_acm_ac >= IEEE80211_NUM_ACS) 2672 non_acm_ac = IEEE80211_AC_BK; 2673 if (drv_conf_tx(local, &sdata->deflink, ac, 2674 &sdata->deflink.tx_conf[non_acm_ac])) 2675 link_err(&sdata->deflink, 2676 "failed to set TX queue parameters for queue %d\n", 2677 ac); 2678 tx_tspec->action = TX_TSPEC_ACTION_NONE; 2679 ret = true; 2680 wiphy_delayed_work_queue(local->hw.wiphy, 2681 &ifmgd->tx_tspec_wk, 2682 tx_tspec->time_slice_start + 2683 HZ - now + 1); 2684 break; 2685 case TX_TSPEC_ACTION_NONE: 2686 /* nothing now */ 2687 break; 2688 } 2689 } 2690 2691 return ret; 2692} 2693 2694void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata) 2695{ 2696 if (__ieee80211_sta_handle_tspec_ac_params(sdata)) 2697 ieee80211_link_info_change_notify(sdata, &sdata->deflink, 2698 BSS_CHANGED_QOS); 2699} 2700 2701static void ieee80211_sta_handle_tspec_ac_params_wk(struct wiphy *wiphy, 2702 struct wiphy_work *work) 2703{ 2704 struct ieee80211_sub_if_data *sdata; 2705 2706 sdata = container_of(work, struct ieee80211_sub_if_data, 2707 u.mgd.tx_tspec_wk.work); 2708 ieee80211_sta_handle_tspec_ac_params(sdata); 2709} 2710 2711void ieee80211_mgd_set_link_qos_params(struct ieee80211_link_data *link) 2712{ 2713 struct ieee80211_sub_if_data *sdata = link->sdata; 2714 struct ieee80211_local *local = sdata->local; 2715 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2716 struct ieee80211_tx_queue_params *params = link->tx_conf; 2717 u8 ac; 2718 2719 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { 2720 mlme_dbg(sdata, 2721 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n", 2722 ac, params[ac].acm, 2723 params[ac].aifs, params[ac].cw_min, params[ac].cw_max, 2724 params[ac].txop, params[ac].uapsd, 2725 ifmgd->tx_tspec[ac].downgraded); 2726 if (!ifmgd->tx_tspec[ac].downgraded && 2727 drv_conf_tx(local, link, ac, ¶ms[ac])) 2728 link_err(link, 2729 "failed to set TX queue parameters for AC %d\n", 2730 ac); 2731 } 2732} 2733 2734/* MLME */ 2735static bool 2736ieee80211_sta_wmm_params(struct ieee80211_local *local, 2737 struct ieee80211_link_data *link, 2738 const u8 *wmm_param, size_t wmm_param_len, 2739 const struct ieee80211_mu_edca_param_set *mu_edca) 2740{ 2741 struct ieee80211_sub_if_data *sdata = link->sdata; 2742 struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS]; 2743 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2744 size_t left; 2745 int count, mu_edca_count, ac; 2746 const u8 *pos; 2747 u8 uapsd_queues = 0; 2748 2749 if (!local->ops->conf_tx) 2750 return false; 2751 2752 if (local->hw.queues < IEEE80211_NUM_ACS) 2753 return false; 2754 2755 if (!wmm_param) 2756 return false; 2757 2758 if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1) 2759 return false; 2760 2761 if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) 2762 uapsd_queues = ifmgd->uapsd_queues; 2763 2764 count = wmm_param[6] & 0x0f; 2765 /* -1 is the initial value of ifmgd->mu_edca_last_param_set. 2766 * if mu_edca was preset before and now it disappeared tell 2767 * the driver about it. 2768 */ 2769 mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1; 2770 if (count == link->u.mgd.wmm_last_param_set && 2771 mu_edca_count == link->u.mgd.mu_edca_last_param_set) 2772 return false; 2773 link->u.mgd.wmm_last_param_set = count; 2774 link->u.mgd.mu_edca_last_param_set = mu_edca_count; 2775 2776 pos = wmm_param + 8; 2777 left = wmm_param_len - 8; 2778 2779 memset(¶ms, 0, sizeof(params)); 2780 2781 sdata->wmm_acm = 0; 2782 for (; left >= 4; left -= 4, pos += 4) { 2783 int aci = (pos[0] >> 5) & 0x03; 2784 int acm = (pos[0] >> 4) & 0x01; 2785 bool uapsd = false; 2786 2787 switch (aci) { 2788 case 1: /* AC_BK */ 2789 ac = IEEE80211_AC_BK; 2790 if (acm) 2791 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */ 2792 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) 2793 uapsd = true; 2794 params[ac].mu_edca = !!mu_edca; 2795 if (mu_edca) 2796 params[ac].mu_edca_param_rec = mu_edca->ac_bk; 2797 break; 2798 case 2: /* AC_VI */ 2799 ac = IEEE80211_AC_VI; 2800 if (acm) 2801 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */ 2802 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) 2803 uapsd = true; 2804 params[ac].mu_edca = !!mu_edca; 2805 if (mu_edca) 2806 params[ac].mu_edca_param_rec = mu_edca->ac_vi; 2807 break; 2808 case 3: /* AC_VO */ 2809 ac = IEEE80211_AC_VO; 2810 if (acm) 2811 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */ 2812 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) 2813 uapsd = true; 2814 params[ac].mu_edca = !!mu_edca; 2815 if (mu_edca) 2816 params[ac].mu_edca_param_rec = mu_edca->ac_vo; 2817 break; 2818 case 0: /* AC_BE */ 2819 default: 2820 ac = IEEE80211_AC_BE; 2821 if (acm) 2822 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */ 2823 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) 2824 uapsd = true; 2825 params[ac].mu_edca = !!mu_edca; 2826 if (mu_edca) 2827 params[ac].mu_edca_param_rec = mu_edca->ac_be; 2828 break; 2829 } 2830 2831 params[ac].aifs = pos[0] & 0x0f; 2832 2833 if (params[ac].aifs < 2) { 2834 link_info(link, 2835 "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n", 2836 params[ac].aifs, aci); 2837 params[ac].aifs = 2; 2838 } 2839 params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4); 2840 params[ac].cw_min = ecw2cw(pos[1] & 0x0f); 2841 params[ac].txop = get_unaligned_le16(pos + 2); 2842 params[ac].acm = acm; 2843 params[ac].uapsd = uapsd; 2844 2845 if (params[ac].cw_min == 0 || 2846 params[ac].cw_min > params[ac].cw_max) { 2847 link_info(link, 2848 "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n", 2849 params[ac].cw_min, params[ac].cw_max, aci); 2850 return false; 2851 } 2852 ieee80211_regulatory_limit_wmm_params(sdata, ¶ms[ac], ac); 2853 } 2854 2855 /* WMM specification requires all 4 ACIs. */ 2856 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { 2857 if (params[ac].cw_min == 0) { 2858 link_info(link, 2859 "AP has invalid WMM params (missing AC %d), using defaults\n", 2860 ac); 2861 return false; 2862 } 2863 } 2864 2865 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) 2866 link->tx_conf[ac] = params[ac]; 2867 2868 ieee80211_mgd_set_link_qos_params(link); 2869 2870 /* enable WMM or activate new settings */ 2871 link->conf->qos = true; 2872 return true; 2873} 2874 2875static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata) 2876{ 2877 lockdep_assert_wiphy(sdata->local->hw.wiphy); 2878 2879 sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL; 2880 ieee80211_run_deferred_scan(sdata->local); 2881} 2882 2883static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata) 2884{ 2885 lockdep_assert_wiphy(sdata->local->hw.wiphy); 2886 2887 __ieee80211_stop_poll(sdata); 2888} 2889 2890static u64 ieee80211_handle_bss_capability(struct ieee80211_link_data *link, 2891 u16 capab, bool erp_valid, u8 erp) 2892{ 2893 struct ieee80211_bss_conf *bss_conf = link->conf; 2894 struct ieee80211_supported_band *sband; 2895 u64 changed = 0; 2896 bool use_protection; 2897 bool use_short_preamble; 2898 bool use_short_slot; 2899 2900 sband = ieee80211_get_link_sband(link); 2901 if (!sband) 2902 return changed; 2903 2904 if (erp_valid) { 2905 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0; 2906 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0; 2907 } else { 2908 use_protection = false; 2909 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE); 2910 } 2911 2912 use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME); 2913 if (sband->band == NL80211_BAND_5GHZ || 2914 sband->band == NL80211_BAND_6GHZ) 2915 use_short_slot = true; 2916 2917 if (use_protection != bss_conf->use_cts_prot) { 2918 bss_conf->use_cts_prot = use_protection; 2919 changed |= BSS_CHANGED_ERP_CTS_PROT; 2920 } 2921 2922 if (use_short_preamble != bss_conf->use_short_preamble) { 2923 bss_conf->use_short_preamble = use_short_preamble; 2924 changed |= BSS_CHANGED_ERP_PREAMBLE; 2925 } 2926 2927 if (use_short_slot != bss_conf->use_short_slot) { 2928 bss_conf->use_short_slot = use_short_slot; 2929 changed |= BSS_CHANGED_ERP_SLOT; 2930 } 2931 2932 return changed; 2933} 2934 2935static u64 ieee80211_link_set_associated(struct ieee80211_link_data *link, 2936 struct cfg80211_bss *cbss) 2937{ 2938 struct ieee80211_sub_if_data *sdata = link->sdata; 2939 struct ieee80211_bss_conf *bss_conf = link->conf; 2940 struct ieee80211_bss *bss = (void *)cbss->priv; 2941 u64 changed = BSS_CHANGED_QOS; 2942 2943 /* not really used in MLO */ 2944 sdata->u.mgd.beacon_timeout = 2945 usecs_to_jiffies(ieee80211_tu_to_usec(beacon_loss_count * 2946 bss_conf->beacon_int)); 2947 2948 changed |= ieee80211_handle_bss_capability(link, 2949 bss_conf->assoc_capability, 2950 bss->has_erp_value, 2951 bss->erp_value); 2952 2953 ieee80211_check_rate_mask(link); 2954 2955 link->conf->bss = cbss; 2956 memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN); 2957 2958 if (sdata->vif.p2p || 2959 sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) { 2960 const struct cfg80211_bss_ies *ies; 2961 2962 rcu_read_lock(); 2963 ies = rcu_dereference(cbss->ies); 2964 if (ies) { 2965 int ret; 2966 2967 ret = cfg80211_get_p2p_attr( 2968 ies->data, ies->len, 2969 IEEE80211_P2P_ATTR_ABSENCE_NOTICE, 2970 (u8 *) &bss_conf->p2p_noa_attr, 2971 sizeof(bss_conf->p2p_noa_attr)); 2972 if (ret >= 2) { 2973 link->u.mgd.p2p_noa_index = 2974 bss_conf->p2p_noa_attr.index; 2975 changed |= BSS_CHANGED_P2P_PS; 2976 } 2977 } 2978 rcu_read_unlock(); 2979 } 2980 2981 if (link->u.mgd.have_beacon) { 2982 bss_conf->beacon_rate = bss->beacon_rate; 2983 changed |= BSS_CHANGED_BEACON_INFO; 2984 } else { 2985 bss_conf->beacon_rate = NULL; 2986 } 2987 2988 /* Tell the driver to monitor connection quality (if supported) */ 2989 if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI && 2990 bss_conf->cqm_rssi_thold) 2991 changed |= BSS_CHANGED_CQM; 2992 2993 return changed; 2994} 2995 2996static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata, 2997 struct ieee80211_mgd_assoc_data *assoc_data, 2998 u64 changed[IEEE80211_MLD_MAX_NUM_LINKS]) 2999{ 3000 struct ieee80211_local *local = sdata->local; 3001 struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg; 3002 u64 vif_changed = BSS_CHANGED_ASSOC; 3003 unsigned int link_id; 3004 3005 lockdep_assert_wiphy(local->hw.wiphy); 3006 3007 sdata->u.mgd.associated = true; 3008 3009 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) { 3010 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss; 3011 struct ieee80211_link_data *link; 3012 3013 if (!cbss || 3014 assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) 3015 continue; 3016 3017 if (ieee80211_vif_is_mld(&sdata->vif) && 3018 !(ieee80211_vif_usable_links(&sdata->vif) & BIT(link_id))) 3019 continue; 3020 3021 link = sdata_dereference(sdata->link[link_id], sdata); 3022 if (WARN_ON(!link)) 3023 return; 3024 3025 changed[link_id] |= ieee80211_link_set_associated(link, cbss); 3026 } 3027 3028 /* just to be sure */ 3029 ieee80211_stop_poll(sdata); 3030 3031 ieee80211_led_assoc(local, 1); 3032 3033 vif_cfg->assoc = 1; 3034 3035 /* Enable ARP filtering */ 3036 if (vif_cfg->arp_addr_cnt) 3037 vif_changed |= BSS_CHANGED_ARP_FILTER; 3038 3039 if (ieee80211_vif_is_mld(&sdata->vif)) { 3040 for (link_id = 0; 3041 link_id < IEEE80211_MLD_MAX_NUM_LINKS; 3042 link_id++) { 3043 struct ieee80211_link_data *link; 3044 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss; 3045 3046 if (!cbss || 3047 !(BIT(link_id) & 3048 ieee80211_vif_usable_links(&sdata->vif)) || 3049 assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) 3050 continue; 3051 3052 link = sdata_dereference(sdata->link[link_id], sdata); 3053 if (WARN_ON(!link)) 3054 return; 3055 3056 ieee80211_link_info_change_notify(sdata, link, 3057 changed[link_id]); 3058 3059 ieee80211_recalc_smps(sdata, link); 3060 } 3061 3062 ieee80211_vif_cfg_change_notify(sdata, vif_changed); 3063 } else { 3064 ieee80211_bss_info_change_notify(sdata, 3065 vif_changed | changed[0]); 3066 } 3067 3068 ieee80211_recalc_ps(local); 3069 3070 /* leave this here to not change ordering in non-MLO cases */ 3071 if (!ieee80211_vif_is_mld(&sdata->vif)) 3072 ieee80211_recalc_smps(sdata, &sdata->deflink); 3073 ieee80211_recalc_ps_vif(sdata); 3074 3075 netif_carrier_on(sdata->dev); 3076} 3077 3078static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata, 3079 u16 stype, u16 reason, bool tx, 3080 u8 *frame_buf) 3081{ 3082 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3083 struct ieee80211_local *local = sdata->local; 3084 unsigned int link_id; 3085 u64 changed = 0; 3086 struct ieee80211_prep_tx_info info = { 3087 .subtype = stype, 3088 }; 3089 3090 lockdep_assert_wiphy(local->hw.wiphy); 3091 3092 if (WARN_ON_ONCE(tx && !frame_buf)) 3093 return; 3094 3095 if (WARN_ON(!ifmgd->associated)) 3096 return; 3097 3098 ieee80211_stop_poll(sdata); 3099 3100 ifmgd->associated = false; 3101 3102 /* other links will be destroyed */ 3103 sdata->deflink.conf->bss = NULL; 3104 sdata->deflink.smps_mode = IEEE80211_SMPS_OFF; 3105 3106 netif_carrier_off(sdata->dev); 3107 3108 /* 3109 * if we want to get out of ps before disassoc (why?) we have 3110 * to do it before sending disassoc, as otherwise the null-packet 3111 * won't be valid. 3112 */ 3113 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 3114 local->hw.conf.flags &= ~IEEE80211_CONF_PS; 3115 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 3116 } 3117 local->ps_sdata = NULL; 3118 3119 /* disable per-vif ps */ 3120 ieee80211_recalc_ps_vif(sdata); 3121 3122 /* make sure ongoing transmission finishes */ 3123 synchronize_net(); 3124 3125 /* 3126 * drop any frame before deauth/disassoc, this can be data or 3127 * management frame. Since we are disconnecting, we should not 3128 * insist sending these frames which can take time and delay 3129 * the disconnection and possible the roaming. 3130 */ 3131 if (tx) 3132 ieee80211_flush_queues(local, sdata, true); 3133 3134 /* deauthenticate/disassociate now */ 3135 if (tx || frame_buf) { 3136 /* 3137 * In multi channel scenarios guarantee that the virtual 3138 * interface is granted immediate airtime to transmit the 3139 * deauthentication frame by calling mgd_prepare_tx, if the 3140 * driver requested so. 3141 */ 3142 if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP)) { 3143 for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); 3144 link_id++) { 3145 struct ieee80211_link_data *link; 3146 3147 link = sdata_dereference(sdata->link[link_id], 3148 sdata); 3149 if (!link) 3150 continue; 3151 if (link->u.mgd.have_beacon) 3152 break; 3153 } 3154 if (link_id == IEEE80211_MLD_MAX_NUM_LINKS) { 3155 info.link_id = ffs(sdata->vif.active_links) - 1; 3156 drv_mgd_prepare_tx(sdata->local, sdata, &info); 3157 } 3158 } 3159 3160 ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr, 3161 sdata->vif.cfg.ap_addr, stype, 3162 reason, tx, frame_buf); 3163 } 3164 3165 /* flush out frame - make sure the deauth was actually sent */ 3166 if (tx) 3167 ieee80211_flush_queues(local, sdata, false); 3168 3169 drv_mgd_complete_tx(sdata->local, sdata, &info); 3170 3171 /* clear AP addr only after building the needed mgmt frames */ 3172 eth_zero_addr(sdata->deflink.u.mgd.bssid); 3173 eth_zero_addr(sdata->vif.cfg.ap_addr); 3174 3175 sdata->vif.cfg.ssid_len = 0; 3176 3177 /* remove AP and TDLS peers */ 3178 sta_info_flush(sdata, -1); 3179 3180 /* finally reset all BSS / config parameters */ 3181 if (!ieee80211_vif_is_mld(&sdata->vif)) 3182 changed |= ieee80211_reset_erp_info(sdata); 3183 3184 ieee80211_led_assoc(local, 0); 3185 changed |= BSS_CHANGED_ASSOC; 3186 sdata->vif.cfg.assoc = false; 3187 3188 sdata->deflink.u.mgd.p2p_noa_index = -1; 3189 memset(&sdata->vif.bss_conf.p2p_noa_attr, 0, 3190 sizeof(sdata->vif.bss_conf.p2p_noa_attr)); 3191 3192 /* on the next assoc, re-program HT/VHT parameters */ 3193 memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa)); 3194 memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask)); 3195 memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa)); 3196 memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask)); 3197 3198 /* 3199 * reset MU-MIMO ownership and group data in default link, 3200 * if used, other links are destroyed 3201 */ 3202 memset(sdata->vif.bss_conf.mu_group.membership, 0, 3203 sizeof(sdata->vif.bss_conf.mu_group.membership)); 3204 memset(sdata->vif.bss_conf.mu_group.position, 0, 3205 sizeof(sdata->vif.bss_conf.mu_group.position)); 3206 if (!ieee80211_vif_is_mld(&sdata->vif)) 3207 changed |= BSS_CHANGED_MU_GROUPS; 3208 sdata->vif.bss_conf.mu_mimo_owner = false; 3209 3210 sdata->deflink.ap_power_level = IEEE80211_UNSET_POWER_LEVEL; 3211 3212 del_timer_sync(&local->dynamic_ps_timer); 3213 wiphy_work_cancel(local->hw.wiphy, &local->dynamic_ps_enable_work); 3214 3215 /* Disable ARP filtering */ 3216 if (sdata->vif.cfg.arp_addr_cnt) 3217 changed |= BSS_CHANGED_ARP_FILTER; 3218 3219 sdata->vif.bss_conf.qos = false; 3220 if (!ieee80211_vif_is_mld(&sdata->vif)) { 3221 changed |= BSS_CHANGED_QOS; 3222 /* The BSSID (not really interesting) and HT changed */ 3223 changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT; 3224 ieee80211_bss_info_change_notify(sdata, changed); 3225 } else { 3226 ieee80211_vif_cfg_change_notify(sdata, changed); 3227 } 3228 3229 /* disassociated - set to defaults now */ 3230 ieee80211_set_wmm_default(&sdata->deflink, false, false); 3231 3232 del_timer_sync(&sdata->u.mgd.conn_mon_timer); 3233 del_timer_sync(&sdata->u.mgd.bcn_mon_timer); 3234 del_timer_sync(&sdata->u.mgd.timer); 3235 3236 sdata->vif.bss_conf.dtim_period = 0; 3237 sdata->vif.bss_conf.beacon_rate = NULL; 3238 3239 sdata->deflink.u.mgd.have_beacon = false; 3240 sdata->deflink.u.mgd.tracking_signal_avg = false; 3241 sdata->deflink.u.mgd.disable_wmm_tracking = false; 3242 3243 ifmgd->flags = 0; 3244 3245 for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) { 3246 struct ieee80211_link_data *link; 3247 3248 link = sdata_dereference(sdata->link[link_id], sdata); 3249 if (!link) 3250 continue; 3251 ieee80211_link_release_channel(link); 3252 } 3253 3254 sdata->vif.bss_conf.csa_active = false; 3255 sdata->deflink.u.mgd.csa_waiting_bcn = false; 3256 sdata->deflink.u.mgd.csa_ignored_same_chan = false; 3257 if (sdata->csa_blocked_tx) { 3258 ieee80211_wake_vif_queues(local, sdata, 3259 IEEE80211_QUEUE_STOP_REASON_CSA); 3260 sdata->csa_blocked_tx = false; 3261 } 3262 3263 /* existing TX TSPEC sessions no longer exist */ 3264 memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec)); 3265 wiphy_delayed_work_cancel(local->hw.wiphy, &ifmgd->tx_tspec_wk); 3266 3267 sdata->vif.bss_conf.power_type = IEEE80211_REG_UNSET_AP; 3268 sdata->vif.bss_conf.pwr_reduction = 0; 3269 sdata->vif.bss_conf.tx_pwr_env_num = 0; 3270 memset(sdata->vif.bss_conf.tx_pwr_env, 0, 3271 sizeof(sdata->vif.bss_conf.tx_pwr_env)); 3272 3273 sdata->vif.cfg.eml_cap = 0; 3274 sdata->vif.cfg.eml_med_sync_delay = 0; 3275 sdata->vif.cfg.mld_capa_op = 0; 3276 3277 memset(&sdata->u.mgd.ttlm_info, 0, 3278 sizeof(sdata->u.mgd.ttlm_info)); 3279 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, &ifmgd->ttlm_work); 3280 3281 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, 3282 &ifmgd->neg_ttlm_timeout_work); 3283 ieee80211_vif_set_links(sdata, 0, 0); 3284 3285 ifmgd->mcast_seq_last = IEEE80211_SN_MODULO; 3286} 3287 3288static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata) 3289{ 3290 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3291 struct ieee80211_local *local = sdata->local; 3292 3293 lockdep_assert_wiphy(local->hw.wiphy); 3294 3295 if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)) 3296 return; 3297 3298 __ieee80211_stop_poll(sdata); 3299 3300 ieee80211_recalc_ps(local); 3301 3302 if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR)) 3303 return; 3304 3305 /* 3306 * We've received a probe response, but are not sure whether 3307 * we have or will be receiving any beacons or data, so let's 3308 * schedule the timers again, just in case. 3309 */ 3310 ieee80211_sta_reset_beacon_monitor(sdata); 3311 3312 mod_timer(&ifmgd->conn_mon_timer, 3313 round_jiffies_up(jiffies + 3314 IEEE80211_CONNECTION_IDLE_TIME)); 3315} 3316 3317static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata, 3318 struct ieee80211_hdr *hdr, 3319 u16 tx_time) 3320{ 3321 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3322 u16 tid; 3323 int ac; 3324 struct ieee80211_sta_tx_tspec *tx_tspec; 3325 unsigned long now = jiffies; 3326 3327 if (!ieee80211_is_data_qos(hdr->frame_control)) 3328 return; 3329 3330 tid = ieee80211_get_tid(hdr); 3331 ac = ieee80211_ac_from_tid(tid); 3332 tx_tspec = &ifmgd->tx_tspec[ac]; 3333 3334 if (likely(!tx_tspec->admitted_time)) 3335 return; 3336 3337 if (time_after(now, tx_tspec->time_slice_start + HZ)) { 3338 tx_tspec->consumed_tx_time = 0; 3339 tx_tspec->time_slice_start = now; 3340 3341 if (tx_tspec->downgraded) { 3342 tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE; 3343 wiphy_delayed_work_queue(sdata->local->hw.wiphy, 3344 &ifmgd->tx_tspec_wk, 0); 3345 } 3346 } 3347 3348 if (tx_tspec->downgraded) 3349 return; 3350 3351 tx_tspec->consumed_tx_time += tx_time; 3352 3353 if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) { 3354 tx_tspec->downgraded = true; 3355 tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE; 3356 wiphy_delayed_work_queue(sdata->local->hw.wiphy, 3357 &ifmgd->tx_tspec_wk, 0); 3358 } 3359} 3360 3361void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata, 3362 struct ieee80211_hdr *hdr, bool ack, u16 tx_time) 3363{ 3364 ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time); 3365 3366 if (!ieee80211_is_any_nullfunc(hdr->frame_control) || 3367 !sdata->u.mgd.probe_send_count) 3368 return; 3369 3370 if (ack) 3371 sdata->u.mgd.probe_send_count = 0; 3372 else 3373 sdata->u.mgd.nullfunc_failed = true; 3374 wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work); 3375} 3376 3377static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata, 3378 const u8 *src, const u8 *dst, 3379 const u8 *ssid, size_t ssid_len, 3380 struct ieee80211_channel *channel) 3381{ 3382 struct sk_buff *skb; 3383 3384 skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel, 3385 ssid, ssid_len, NULL, 0, 3386 IEEE80211_PROBE_FLAG_DIRECTED); 3387 if (skb) 3388 ieee80211_tx_skb(sdata, skb); 3389} 3390 3391static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata) 3392{ 3393 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3394 u8 *dst = sdata->vif.cfg.ap_addr; 3395 u8 unicast_limit = max(1, max_probe_tries - 3); 3396 struct sta_info *sta; 3397 3398 lockdep_assert_wiphy(sdata->local->hw.wiphy); 3399 3400 if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif))) 3401 return; 3402 3403 /* 3404 * Try sending broadcast probe requests for the last three 3405 * probe requests after the first ones failed since some 3406 * buggy APs only support broadcast probe requests. 3407 */ 3408 if (ifmgd->probe_send_count >= unicast_limit) 3409 dst = NULL; 3410 3411 /* 3412 * When the hardware reports an accurate Tx ACK status, it's 3413 * better to send a nullfunc frame instead of a probe request, 3414 * as it will kick us off the AP quickly if we aren't associated 3415 * anymore. The timeout will be reset if the frame is ACKed by 3416 * the AP. 3417 */ 3418 ifmgd->probe_send_count++; 3419 3420 if (dst) { 3421 sta = sta_info_get(sdata, dst); 3422 if (!WARN_ON(!sta)) 3423 ieee80211_check_fast_rx(sta); 3424 } 3425 3426 if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) { 3427 ifmgd->nullfunc_failed = false; 3428 ieee80211_send_nullfunc(sdata->local, sdata, false); 3429 } else { 3430 ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst, 3431 sdata->vif.cfg.ssid, 3432 sdata->vif.cfg.ssid_len, 3433 sdata->deflink.conf->bss->channel); 3434 } 3435 3436 ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms); 3437 run_again(sdata, ifmgd->probe_timeout); 3438} 3439 3440static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata, 3441 bool beacon) 3442{ 3443 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3444 bool already = false; 3445 3446 lockdep_assert_wiphy(sdata->local->hw.wiphy); 3447 3448 if (WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif))) 3449 return; 3450 3451 if (!ieee80211_sdata_running(sdata)) 3452 return; 3453 3454 if (!ifmgd->associated) 3455 return; 3456 3457 if (sdata->local->tmp_channel || sdata->local->scanning) 3458 return; 3459 3460 if (sdata->local->suspending) { 3461 /* reschedule after resume */ 3462 ieee80211_reset_ap_probe(sdata); 3463 return; 3464 } 3465 3466 if (beacon) { 3467 mlme_dbg_ratelimited(sdata, 3468 "detected beacon loss from AP (missed %d beacons) - probing\n", 3469 beacon_loss_count); 3470 3471 ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL); 3472 } 3473 3474 /* 3475 * The driver/our work has already reported this event or the 3476 * connection monitoring has kicked in and we have already sent 3477 * a probe request. Or maybe the AP died and the driver keeps 3478 * reporting until we disassociate... 3479 * 3480 * In either case we have to ignore the current call to this 3481 * function (except for setting the correct probe reason bit) 3482 * because otherwise we would reset the timer every time and 3483 * never check whether we received a probe response! 3484 */ 3485 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) 3486 already = true; 3487 3488 ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL; 3489 3490 if (already) 3491 return; 3492 3493 ieee80211_recalc_ps(sdata->local); 3494 3495 ifmgd->probe_send_count = 0; 3496 ieee80211_mgd_probe_ap_send(sdata); 3497} 3498 3499struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw, 3500 struct ieee80211_vif *vif) 3501{ 3502 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 3503 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3504 struct cfg80211_bss *cbss; 3505 struct sk_buff *skb; 3506 const struct element *ssid; 3507 int ssid_len; 3508 3509 lockdep_assert_wiphy(sdata->local->hw.wiphy); 3510 3511 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION || 3512 ieee80211_vif_is_mld(&sdata->vif))) 3513 return NULL; 3514 3515 if (ifmgd->associated) 3516 cbss = sdata->deflink.conf->bss; 3517 else if (ifmgd->auth_data) 3518 cbss = ifmgd->auth_data->bss; 3519 else if (ifmgd->assoc_data && ifmgd->assoc_data->link[0].bss) 3520 cbss = ifmgd->assoc_data->link[0].bss; 3521 else 3522 return NULL; 3523 3524 rcu_read_lock(); 3525 ssid = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID); 3526 if (WARN_ONCE(!ssid || ssid->datalen > IEEE80211_MAX_SSID_LEN, 3527 "invalid SSID element (len=%d)", 3528 ssid ? ssid->datalen : -1)) 3529 ssid_len = 0; 3530 else 3531 ssid_len = ssid->datalen; 3532 3533 skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid, 3534 (u32) -1, cbss->channel, 3535 ssid->data, ssid_len, 3536 NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED); 3537 rcu_read_unlock(); 3538 3539 return skb; 3540} 3541EXPORT_SYMBOL(ieee80211_ap_probereq_get); 3542 3543static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata, 3544 const u8 *buf, size_t len, bool tx, 3545 u16 reason, bool reconnect) 3546{ 3547 struct ieee80211_event event = { 3548 .type = MLME_EVENT, 3549 .u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT, 3550 .u.mlme.reason = reason, 3551 }; 3552 3553 if (tx) 3554 cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect); 3555 else 3556 cfg80211_rx_mlme_mgmt(sdata->dev, buf, len); 3557 3558 drv_event_callback(sdata->local, sdata, &event); 3559} 3560 3561static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata) 3562{ 3563 struct ieee80211_local *local = sdata->local; 3564 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3565 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 3566 bool tx; 3567 3568 lockdep_assert_wiphy(local->hw.wiphy); 3569 3570 if (!ifmgd->associated) 3571 return; 3572 3573 /* 3574 * MLO drivers should have HANDLES_QUIET_CSA, so that csa_blocked_tx 3575 * is always false; if they don't then this may try to transmit the 3576 * frame but queues will be stopped. 3577 */ 3578 tx = !sdata->csa_blocked_tx; 3579 3580 if (!ifmgd->driver_disconnect) { 3581 unsigned int link_id; 3582 3583 /* 3584 * AP is probably out of range (or not reachable for another 3585 * reason) so remove the bss structs for that AP. In the case 3586 * of multi-link, it's not clear that all of them really are 3587 * out of range, but if they weren't the driver likely would 3588 * have switched to just have a single link active? 3589 */ 3590 for (link_id = 0; 3591 link_id < ARRAY_SIZE(sdata->link); 3592 link_id++) { 3593 struct ieee80211_link_data *link; 3594 3595 link = sdata_dereference(sdata->link[link_id], sdata); 3596 if (!link) 3597 continue; 3598 cfg80211_unlink_bss(local->hw.wiphy, link->conf->bss); 3599 link->conf->bss = NULL; 3600 } 3601 } 3602 3603 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, 3604 ifmgd->driver_disconnect ? 3605 WLAN_REASON_DEAUTH_LEAVING : 3606 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, 3607 tx, frame_buf); 3608 /* the other links will be destroyed */ 3609 sdata->vif.bss_conf.csa_active = false; 3610 sdata->deflink.u.mgd.csa_waiting_bcn = false; 3611 if (sdata->csa_blocked_tx) { 3612 ieee80211_wake_vif_queues(local, sdata, 3613 IEEE80211_QUEUE_STOP_REASON_CSA); 3614 sdata->csa_blocked_tx = false; 3615 } 3616 3617 ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx, 3618 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, 3619 ifmgd->reconnect); 3620 ifmgd->reconnect = false; 3621} 3622 3623static void ieee80211_beacon_connection_loss_work(struct wiphy *wiphy, 3624 struct wiphy_work *work) 3625{ 3626 struct ieee80211_sub_if_data *sdata = 3627 container_of(work, struct ieee80211_sub_if_data, 3628 u.mgd.beacon_connection_loss_work); 3629 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3630 3631 if (ifmgd->connection_loss) { 3632 sdata_info(sdata, "Connection to AP %pM lost\n", 3633 sdata->vif.cfg.ap_addr); 3634 __ieee80211_disconnect(sdata); 3635 ifmgd->connection_loss = false; 3636 } else if (ifmgd->driver_disconnect) { 3637 sdata_info(sdata, 3638 "Driver requested disconnection from AP %pM\n", 3639 sdata->vif.cfg.ap_addr); 3640 __ieee80211_disconnect(sdata); 3641 ifmgd->driver_disconnect = false; 3642 } else { 3643 if (ifmgd->associated) 3644 sdata->deflink.u.mgd.beacon_loss_count++; 3645 ieee80211_mgd_probe_ap(sdata, true); 3646 } 3647} 3648 3649static void ieee80211_csa_connection_drop_work(struct wiphy *wiphy, 3650 struct wiphy_work *work) 3651{ 3652 struct ieee80211_sub_if_data *sdata = 3653 container_of(work, struct ieee80211_sub_if_data, 3654 u.mgd.csa_connection_drop_work); 3655 3656 __ieee80211_disconnect(sdata); 3657} 3658 3659void ieee80211_beacon_loss(struct ieee80211_vif *vif) 3660{ 3661 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 3662 struct ieee80211_hw *hw = &sdata->local->hw; 3663 3664 trace_api_beacon_loss(sdata); 3665 3666 sdata->u.mgd.connection_loss = false; 3667 wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work); 3668} 3669EXPORT_SYMBOL(ieee80211_beacon_loss); 3670 3671void ieee80211_connection_loss(struct ieee80211_vif *vif) 3672{ 3673 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 3674 struct ieee80211_hw *hw = &sdata->local->hw; 3675 3676 trace_api_connection_loss(sdata); 3677 3678 sdata->u.mgd.connection_loss = true; 3679 wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work); 3680} 3681EXPORT_SYMBOL(ieee80211_connection_loss); 3682 3683void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect) 3684{ 3685 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 3686 struct ieee80211_hw *hw = &sdata->local->hw; 3687 3688 trace_api_disconnect(sdata, reconnect); 3689 3690 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION)) 3691 return; 3692 3693 sdata->u.mgd.driver_disconnect = true; 3694 sdata->u.mgd.reconnect = reconnect; 3695 wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work); 3696} 3697EXPORT_SYMBOL(ieee80211_disconnect); 3698 3699static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata, 3700 bool assoc) 3701{ 3702 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data; 3703 3704 lockdep_assert_wiphy(sdata->local->hw.wiphy); 3705 3706 if (!assoc) { 3707 /* 3708 * we are not authenticated yet, the only timer that could be 3709 * running is the timeout for the authentication response which 3710 * which is not relevant anymore. 3711 */ 3712 del_timer_sync(&sdata->u.mgd.timer); 3713 sta_info_destroy_addr(sdata, auth_data->ap_addr); 3714 3715 /* other links are destroyed */ 3716 eth_zero_addr(sdata->deflink.u.mgd.bssid); 3717 ieee80211_link_info_change_notify(sdata, &sdata->deflink, 3718 BSS_CHANGED_BSSID); 3719 sdata->u.mgd.flags = 0; 3720 3721 ieee80211_link_release_channel(&sdata->deflink); 3722 ieee80211_vif_set_links(sdata, 0, 0); 3723 } 3724 3725 cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss); 3726 kfree(auth_data); 3727 sdata->u.mgd.auth_data = NULL; 3728} 3729 3730enum assoc_status { 3731 ASSOC_SUCCESS, 3732 ASSOC_REJECTED, 3733 ASSOC_TIMEOUT, 3734 ASSOC_ABANDON, 3735}; 3736 3737static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata, 3738 enum assoc_status status) 3739{ 3740 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data; 3741 3742 lockdep_assert_wiphy(sdata->local->hw.wiphy); 3743 3744 if (status != ASSOC_SUCCESS) { 3745 /* 3746 * we are not associated yet, the only timer that could be 3747 * running is the timeout for the association response which 3748 * which is not relevant anymore. 3749 */ 3750 del_timer_sync(&sdata->u.mgd.timer); 3751 sta_info_destroy_addr(sdata, assoc_data->ap_addr); 3752 3753 eth_zero_addr(sdata->deflink.u.mgd.bssid); 3754 ieee80211_link_info_change_notify(sdata, &sdata->deflink, 3755 BSS_CHANGED_BSSID); 3756 sdata->u.mgd.flags = 0; 3757 sdata->vif.bss_conf.mu_mimo_owner = false; 3758 3759 if (status != ASSOC_REJECTED) { 3760 struct cfg80211_assoc_failure data = { 3761 .timeout = status == ASSOC_TIMEOUT, 3762 }; 3763 int i; 3764 3765 BUILD_BUG_ON(ARRAY_SIZE(data.bss) != 3766 ARRAY_SIZE(assoc_data->link)); 3767 3768 for (i = 0; i < ARRAY_SIZE(data.bss); i++) 3769 data.bss[i] = assoc_data->link[i].bss; 3770 3771 if (ieee80211_vif_is_mld(&sdata->vif)) 3772 data.ap_mld_addr = assoc_data->ap_addr; 3773 3774 cfg80211_assoc_failure(sdata->dev, &data); 3775 } 3776 3777 ieee80211_link_release_channel(&sdata->deflink); 3778 ieee80211_vif_set_links(sdata, 0, 0); 3779 } 3780 3781 kfree(assoc_data); 3782 sdata->u.mgd.assoc_data = NULL; 3783} 3784 3785static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata, 3786 struct ieee80211_mgmt *mgmt, size_t len) 3787{ 3788 struct ieee80211_local *local = sdata->local; 3789 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data; 3790 const struct element *challenge; 3791 u8 *pos; 3792 u32 tx_flags = 0; 3793 struct ieee80211_prep_tx_info info = { 3794 .subtype = IEEE80211_STYPE_AUTH, 3795 .link_id = auth_data->link_id, 3796 }; 3797 3798 pos = mgmt->u.auth.variable; 3799 challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos, 3800 len - (pos - (u8 *)mgmt)); 3801 if (!challenge) 3802 return; 3803 auth_data->expected_transaction = 4; 3804 drv_mgd_prepare_tx(sdata->local, sdata, &info); 3805 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) 3806 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS | 3807 IEEE80211_TX_INTFL_MLME_CONN_TX; 3808 ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0, 3809 (void *)challenge, 3810 challenge->datalen + sizeof(*challenge), 3811 auth_data->ap_addr, auth_data->ap_addr, 3812 auth_data->key, auth_data->key_len, 3813 auth_data->key_idx, tx_flags); 3814} 3815 3816static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata) 3817{ 3818 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3819 const u8 *ap_addr = ifmgd->auth_data->ap_addr; 3820 struct sta_info *sta; 3821 3822 lockdep_assert_wiphy(sdata->local->hw.wiphy); 3823 3824 sdata_info(sdata, "authenticated\n"); 3825 ifmgd->auth_data->done = true; 3826 ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC; 3827 ifmgd->auth_data->timeout_started = true; 3828 run_again(sdata, ifmgd->auth_data->timeout); 3829 3830 /* move station state to auth */ 3831 sta = sta_info_get(sdata, ap_addr); 3832 if (!sta) { 3833 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, ap_addr); 3834 return false; 3835 } 3836 if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) { 3837 sdata_info(sdata, "failed moving %pM to auth\n", ap_addr); 3838 return false; 3839 } 3840 3841 return true; 3842} 3843 3844static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, 3845 struct ieee80211_mgmt *mgmt, size_t len) 3846{ 3847 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 3848 u16 auth_alg, auth_transaction, status_code; 3849 struct ieee80211_event event = { 3850 .type = MLME_EVENT, 3851 .u.mlme.data = AUTH_EVENT, 3852 }; 3853 struct ieee80211_prep_tx_info info = { 3854 .subtype = IEEE80211_STYPE_AUTH, 3855 }; 3856 3857 lockdep_assert_wiphy(sdata->local->hw.wiphy); 3858 3859 if (len < 24 + 6) 3860 return; 3861 3862 if (!ifmgd->auth_data || ifmgd->auth_data->done) 3863 return; 3864 3865 if (!ether_addr_equal(ifmgd->auth_data->ap_addr, mgmt->bssid)) 3866 return; 3867 3868 auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg); 3869 auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction); 3870 status_code = le16_to_cpu(mgmt->u.auth.status_code); 3871 3872 if (auth_alg != ifmgd->auth_data->algorithm || 3873 (auth_alg != WLAN_AUTH_SAE && 3874 auth_transaction != ifmgd->auth_data->expected_transaction) || 3875 (auth_alg == WLAN_AUTH_SAE && 3876 (auth_transaction < ifmgd->auth_data->expected_transaction || 3877 auth_transaction > 2))) { 3878 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n", 3879 mgmt->sa, auth_alg, ifmgd->auth_data->algorithm, 3880 auth_transaction, 3881 ifmgd->auth_data->expected_transaction); 3882 goto notify_driver; 3883 } 3884 3885 if (status_code != WLAN_STATUS_SUCCESS) { 3886 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len); 3887 3888 if (auth_alg == WLAN_AUTH_SAE && 3889 (status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED || 3890 (auth_transaction == 1 && 3891 (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT || 3892 status_code == WLAN_STATUS_SAE_PK)))) { 3893 /* waiting for userspace now */ 3894 ifmgd->auth_data->waiting = true; 3895 ifmgd->auth_data->timeout = 3896 jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY; 3897 ifmgd->auth_data->timeout_started = true; 3898 run_again(sdata, ifmgd->auth_data->timeout); 3899 goto notify_driver; 3900 } 3901 3902 sdata_info(sdata, "%pM denied authentication (status %d)\n", 3903 mgmt->sa, status_code); 3904 ieee80211_destroy_auth_data(sdata, false); 3905 event.u.mlme.status = MLME_DENIED; 3906 event.u.mlme.reason = status_code; 3907 drv_event_callback(sdata->local, sdata, &event); 3908 goto notify_driver; 3909 } 3910 3911 switch (ifmgd->auth_data->algorithm) { 3912 case WLAN_AUTH_OPEN: 3913 case WLAN_AUTH_LEAP: 3914 case WLAN_AUTH_FT: 3915 case WLAN_AUTH_SAE: 3916 case WLAN_AUTH_FILS_SK: 3917 case WLAN_AUTH_FILS_SK_PFS: 3918 case WLAN_AUTH_FILS_PK: 3919 break; 3920 case WLAN_AUTH_SHARED_KEY: 3921 if (ifmgd->auth_data->expected_transaction != 4) { 3922 ieee80211_auth_challenge(sdata, mgmt, len); 3923 /* need another frame */ 3924 return; 3925 } 3926 break; 3927 default: 3928 WARN_ONCE(1, "invalid auth alg %d", 3929 ifmgd->auth_data->algorithm); 3930 goto notify_driver; 3931 } 3932 3933 event.u.mlme.status = MLME_SUCCESS; 3934 info.success = 1; 3935 drv_event_callback(sdata->local, sdata, &event); 3936 if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE || 3937 (auth_transaction == 2 && 3938 ifmgd->auth_data->expected_transaction == 2)) { 3939 if (!ieee80211_mark_sta_auth(sdata)) 3940 return; /* ignore frame -- wait for timeout */ 3941 } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE && 3942 auth_transaction == 2) { 3943 sdata_info(sdata, "SAE peer confirmed\n"); 3944 ifmgd->auth_data->peer_confirmed = true; 3945 } 3946 3947 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len); 3948notify_driver: 3949 drv_mgd_complete_tx(sdata->local, sdata, &info); 3950} 3951 3952#define case_WLAN(type) \ 3953 case WLAN_REASON_##type: return #type 3954 3955const char *ieee80211_get_reason_code_string(u16 reason_code) 3956{ 3957 switch (reason_code) { 3958 case_WLAN(UNSPECIFIED); 3959 case_WLAN(PREV_AUTH_NOT_VALID); 3960 case_WLAN(DEAUTH_LEAVING); 3961 case_WLAN(DISASSOC_DUE_TO_INACTIVITY); 3962 case_WLAN(DISASSOC_AP_BUSY); 3963 case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA); 3964 case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA); 3965 case_WLAN(DISASSOC_STA_HAS_LEFT); 3966 case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH); 3967 case_WLAN(DISASSOC_BAD_POWER); 3968 case_WLAN(DISASSOC_BAD_SUPP_CHAN); 3969 case_WLAN(INVALID_IE); 3970 case_WLAN(MIC_FAILURE); 3971 case_WLAN(4WAY_HANDSHAKE_TIMEOUT); 3972 case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT); 3973 case_WLAN(IE_DIFFERENT); 3974 case_WLAN(INVALID_GROUP_CIPHER); 3975 case_WLAN(INVALID_PAIRWISE_CIPHER); 3976 case_WLAN(INVALID_AKMP); 3977 case_WLAN(UNSUPP_RSN_VERSION); 3978 case_WLAN(INVALID_RSN_IE_CAP); 3979 case_WLAN(IEEE8021X_FAILED); 3980 case_WLAN(CIPHER_SUITE_REJECTED); 3981 case_WLAN(DISASSOC_UNSPECIFIED_QOS); 3982 case_WLAN(DISASSOC_QAP_NO_BANDWIDTH); 3983 case_WLAN(DISASSOC_LOW_ACK); 3984 case_WLAN(DISASSOC_QAP_EXCEED_TXOP); 3985 case_WLAN(QSTA_LEAVE_QBSS); 3986 case_WLAN(QSTA_NOT_USE); 3987 case_WLAN(QSTA_REQUIRE_SETUP); 3988 case_WLAN(QSTA_TIMEOUT); 3989 case_WLAN(QSTA_CIPHER_NOT_SUPP); 3990 case_WLAN(MESH_PEER_CANCELED); 3991 case_WLAN(MESH_MAX_PEERS); 3992 case_WLAN(MESH_CONFIG); 3993 case_WLAN(MESH_CLOSE); 3994 case_WLAN(MESH_MAX_RETRIES); 3995 case_WLAN(MESH_CONFIRM_TIMEOUT); 3996 case_WLAN(MESH_INVALID_GTK); 3997 case_WLAN(MESH_INCONSISTENT_PARAM); 3998 case_WLAN(MESH_INVALID_SECURITY); 3999 case_WLAN(MESH_PATH_ERROR); 4000 case_WLAN(MESH_PATH_NOFORWARD); 4001 case_WLAN(MESH_PATH_DEST_UNREACHABLE); 4002 case_WLAN(MAC_EXISTS_IN_MBSS); 4003 case_WLAN(MESH_CHAN_REGULATORY); 4004 case_WLAN(MESH_CHAN); 4005 default: return "<unknown>"; 4006 } 4007} 4008 4009static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, 4010 struct ieee80211_mgmt *mgmt, size_t len) 4011{ 4012 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 4013 u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); 4014 4015 lockdep_assert_wiphy(sdata->local->hw.wiphy); 4016 4017 if (len < 24 + 2) 4018 return; 4019 4020 if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) { 4021 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code); 4022 return; 4023 } 4024 4025 if (ifmgd->associated && 4026 ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) { 4027 sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n", 4028 sdata->vif.cfg.ap_addr, reason_code, 4029 ieee80211_get_reason_code_string(reason_code)); 4030 4031 ieee80211_set_disassoc(sdata, 0, 0, false, NULL); 4032 4033 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, 4034 reason_code, false); 4035 return; 4036 } 4037 4038 if (ifmgd->assoc_data && 4039 ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->ap_addr)) { 4040 sdata_info(sdata, 4041 "deauthenticated from %pM while associating (Reason: %u=%s)\n", 4042 ifmgd->assoc_data->ap_addr, reason_code, 4043 ieee80211_get_reason_code_string(reason_code)); 4044 4045 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON); 4046 4047 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len); 4048 return; 4049 } 4050} 4051 4052 4053static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata, 4054 struct ieee80211_mgmt *mgmt, size_t len) 4055{ 4056 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 4057 u16 reason_code; 4058 4059 lockdep_assert_wiphy(sdata->local->hw.wiphy); 4060 4061 if (len < 24 + 2) 4062 return; 4063 4064 if (!ifmgd->associated || 4065 !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) 4066 return; 4067 4068 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code); 4069 4070 if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) { 4071 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code); 4072 return; 4073 } 4074 4075 sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n", 4076 sdata->vif.cfg.ap_addr, reason_code, 4077 ieee80211_get_reason_code_string(reason_code)); 4078 4079 ieee80211_set_disassoc(sdata, 0, 0, false, NULL); 4080 4081 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code, 4082 false); 4083} 4084 4085static void ieee80211_get_rates(struct ieee80211_supported_band *sband, 4086 u8 *supp_rates, unsigned int supp_rates_len, 4087 u32 *rates, u32 *basic_rates, 4088 bool *have_higher_than_11mbit, 4089 int *min_rate, int *min_rate_index) 4090{ 4091 int i, j; 4092 4093 for (i = 0; i < supp_rates_len; i++) { 4094 int rate = supp_rates[i] & 0x7f; 4095 bool is_basic = !!(supp_rates[i] & 0x80); 4096 4097 if ((rate * 5) > 110) 4098 *have_higher_than_11mbit = true; 4099 4100 /* 4101 * Skip HT, VHT, HE, EHT and SAE H2E only BSS membership 4102 * selectors since they're not rates. 4103 * 4104 * Note: Even though the membership selector and the basic 4105 * rate flag share the same bit, they are not exactly 4106 * the same. 4107 */ 4108 if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) || 4109 supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) || 4110 supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY) || 4111 supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_EHT_PHY) || 4112 supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E)) 4113 continue; 4114 4115 for (j = 0; j < sband->n_bitrates; j++) { 4116 struct ieee80211_rate *br; 4117 int brate; 4118 4119 br = &sband->bitrates[j]; 4120 4121 brate = DIV_ROUND_UP(br->bitrate, 5); 4122 if (brate == rate) { 4123 *rates |= BIT(j); 4124 if (is_basic) 4125 *basic_rates |= BIT(j); 4126 if ((rate * 5) < *min_rate) { 4127 *min_rate = rate * 5; 4128 *min_rate_index = j; 4129 } 4130 break; 4131 } 4132 } 4133 } 4134} 4135 4136static bool ieee80211_twt_req_supported(struct ieee80211_sub_if_data *sdata, 4137 struct ieee80211_supported_band *sband, 4138 const struct link_sta_info *link_sta, 4139 const struct ieee802_11_elems *elems) 4140{ 4141 const struct ieee80211_sta_he_cap *own_he_cap = 4142 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif); 4143 4144 if (elems->ext_capab_len < 10) 4145 return false; 4146 4147 if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT)) 4148 return false; 4149 4150 return link_sta->pub->he_cap.he_cap_elem.mac_cap_info[0] & 4151 IEEE80211_HE_MAC_CAP0_TWT_RES && 4152 own_he_cap && 4153 (own_he_cap->he_cap_elem.mac_cap_info[0] & 4154 IEEE80211_HE_MAC_CAP0_TWT_REQ); 4155} 4156 4157static u64 ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata, 4158 struct ieee80211_supported_band *sband, 4159 struct ieee80211_link_data *link, 4160 struct link_sta_info *link_sta, 4161 struct ieee802_11_elems *elems) 4162{ 4163 bool twt = ieee80211_twt_req_supported(sdata, sband, link_sta, elems); 4164 4165 if (link->conf->twt_requester != twt) { 4166 link->conf->twt_requester = twt; 4167 return BSS_CHANGED_TWT; 4168 } 4169 return 0; 4170} 4171 4172static bool ieee80211_twt_bcast_support(struct ieee80211_sub_if_data *sdata, 4173 struct ieee80211_bss_conf *bss_conf, 4174 struct ieee80211_supported_band *sband, 4175 struct link_sta_info *link_sta) 4176{ 4177 const struct ieee80211_sta_he_cap *own_he_cap = 4178 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif); 4179 4180 return bss_conf->he_support && 4181 (link_sta->pub->he_cap.he_cap_elem.mac_cap_info[2] & 4182 IEEE80211_HE_MAC_CAP2_BCAST_TWT) && 4183 own_he_cap && 4184 (own_he_cap->he_cap_elem.mac_cap_info[2] & 4185 IEEE80211_HE_MAC_CAP2_BCAST_TWT); 4186} 4187 4188static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link, 4189 struct link_sta_info *link_sta, 4190 struct cfg80211_bss *cbss, 4191 struct ieee80211_mgmt *mgmt, 4192 const u8 *elem_start, 4193 unsigned int elem_len, 4194 u64 *changed) 4195{ 4196 struct ieee80211_sub_if_data *sdata = link->sdata; 4197 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data; 4198 struct ieee80211_bss_conf *bss_conf = link->conf; 4199 struct ieee80211_local *local = sdata->local; 4200 unsigned int link_id = link->link_id; 4201 struct ieee80211_elems_parse_params parse_params = { 4202 .mode = link->u.mgd.conn.mode, 4203 .start = elem_start, 4204 .len = elem_len, 4205 .link_id = link_id == assoc_data->assoc_link_id ? -1 : link_id, 4206 .from_ap = true, 4207 }; 4208 bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ; 4209 bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ; 4210 bool is_s1g = cbss->channel->band == NL80211_BAND_S1GHZ; 4211 const struct cfg80211_bss_ies *bss_ies = NULL; 4212 struct ieee80211_supported_band *sband; 4213 struct ieee802_11_elems *elems; 4214 const __le16 prof_bss_param_ch_present = 4215 cpu_to_le16(IEEE80211_MLE_STA_CONTROL_BSS_PARAM_CHANGE_CNT_PRESENT); 4216 u16 capab_info; 4217 bool ret; 4218 4219 elems = ieee802_11_parse_elems_full(&parse_params); 4220 if (!elems) 4221 return false; 4222 4223 if (link_id == assoc_data->assoc_link_id) { 4224 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info); 4225 4226 /* 4227 * we should not get to this flow unless the association was 4228 * successful, so set the status directly to success 4229 */ 4230 assoc_data->link[link_id].status = WLAN_STATUS_SUCCESS; 4231 if (elems->ml_basic) { 4232 int bss_param_ch_cnt = 4233 ieee80211_mle_get_bss_param_ch_cnt((const void *)elems->ml_basic); 4234 4235 if (bss_param_ch_cnt < 0) { 4236 ret = false; 4237 goto out; 4238 } 4239 link->u.mgd.bss_param_ch_cnt = bss_param_ch_cnt; 4240 } 4241 } else if (elems->parse_error & IEEE80211_PARSE_ERR_DUP_NEST_ML_BASIC || 4242 !elems->prof || 4243 !(elems->prof->control & prof_bss_param_ch_present)) { 4244 ret = false; 4245 goto out; 4246 } else { 4247 const u8 *ptr = elems->prof->variable + 4248 elems->prof->sta_info_len - 1; 4249 4250 /* 4251 * During parsing, we validated that these fields exist, 4252 * otherwise elems->prof would have been set to NULL. 4253 */ 4254 capab_info = get_unaligned_le16(ptr); 4255 assoc_data->link[link_id].status = get_unaligned_le16(ptr + 2); 4256 link->u.mgd.bss_param_ch_cnt = 4257 ieee80211_mle_basic_sta_prof_bss_param_ch_cnt(elems->prof); 4258 4259 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) { 4260 link_info(link, "association response status code=%u\n", 4261 assoc_data->link[link_id].status); 4262 ret = true; 4263 goto out; 4264 } 4265 } 4266 4267 if (!is_s1g && !elems->supp_rates) { 4268 sdata_info(sdata, "no SuppRates element in AssocResp\n"); 4269 ret = false; 4270 goto out; 4271 } 4272 4273 link->u.mgd.tdls_chan_switch_prohibited = 4274 elems->ext_capab && elems->ext_capab_len >= 5 && 4275 (elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED); 4276 4277 /* 4278 * Some APs are erroneously not including some information in their 4279 * (re)association response frames. Try to recover by using the data 4280 * from the beacon or probe response. This seems to afflict mobile 4281 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T", 4282 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device. 4283 */ 4284 if (!is_6ghz && 4285 ((assoc_data->wmm && !elems->wmm_param) || 4286 (link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT && 4287 (!elems->ht_cap_elem || !elems->ht_operation)) || 4288 (link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT && 4289 (!elems->vht_cap_elem || !elems->vht_operation)))) { 4290 const struct cfg80211_bss_ies *ies; 4291 struct ieee802_11_elems *bss_elems; 4292 4293 rcu_read_lock(); 4294 ies = rcu_dereference(cbss->ies); 4295 if (ies) 4296 bss_ies = kmemdup(ies, sizeof(*ies) + ies->len, 4297 GFP_ATOMIC); 4298 rcu_read_unlock(); 4299 if (!bss_ies) { 4300 ret = false; 4301 goto out; 4302 } 4303 4304 parse_params.start = bss_ies->data; 4305 parse_params.len = bss_ies->len; 4306 parse_params.bss = cbss; 4307 bss_elems = ieee802_11_parse_elems_full(&parse_params); 4308 if (!bss_elems) { 4309 ret = false; 4310 goto out; 4311 } 4312 4313 if (assoc_data->wmm && 4314 !elems->wmm_param && bss_elems->wmm_param) { 4315 elems->wmm_param = bss_elems->wmm_param; 4316 sdata_info(sdata, 4317 "AP bug: WMM param missing from AssocResp\n"); 4318 } 4319 4320 /* 4321 * Also check if we requested HT/VHT, otherwise the AP doesn't 4322 * have to include the IEs in the (re)association response. 4323 */ 4324 if (!elems->ht_cap_elem && bss_elems->ht_cap_elem && 4325 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT) { 4326 elems->ht_cap_elem = bss_elems->ht_cap_elem; 4327 sdata_info(sdata, 4328 "AP bug: HT capability missing from AssocResp\n"); 4329 } 4330 if (!elems->ht_operation && bss_elems->ht_operation && 4331 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT) { 4332 elems->ht_operation = bss_elems->ht_operation; 4333 sdata_info(sdata, 4334 "AP bug: HT operation missing from AssocResp\n"); 4335 } 4336 if (!elems->vht_cap_elem && bss_elems->vht_cap_elem && 4337 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT) { 4338 elems->vht_cap_elem = bss_elems->vht_cap_elem; 4339 sdata_info(sdata, 4340 "AP bug: VHT capa missing from AssocResp\n"); 4341 } 4342 if (!elems->vht_operation && bss_elems->vht_operation && 4343 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT) { 4344 elems->vht_operation = bss_elems->vht_operation; 4345 sdata_info(sdata, 4346 "AP bug: VHT operation missing from AssocResp\n"); 4347 } 4348 4349 kfree(bss_elems); 4350 } 4351 4352 /* 4353 * We previously checked these in the beacon/probe response, so 4354 * they should be present here. This is just a safety net. 4355 * Note that the ieee80211_config_bw() below would also check 4356 * for this (and more), but this has better error reporting. 4357 */ 4358 if (!is_6ghz && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT && 4359 (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) { 4360 sdata_info(sdata, 4361 "HT AP is missing WMM params or HT capability/operation\n"); 4362 ret = false; 4363 goto out; 4364 } 4365 4366 if (is_5ghz && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT && 4367 (!elems->vht_cap_elem || !elems->vht_operation)) { 4368 sdata_info(sdata, 4369 "VHT AP is missing VHT capability/operation\n"); 4370 ret = false; 4371 goto out; 4372 } 4373 4374 /* check/update if AP changed anything in assoc response vs. scan */ 4375 if (ieee80211_config_bw(link, elems, 4376 link_id == assoc_data->assoc_link_id, 4377 changed)) { 4378 ret = false; 4379 goto out; 4380 } 4381 4382 if (WARN_ON(!link->conf->chanreq.oper.chan)) { 4383 ret = false; 4384 goto out; 4385 } 4386 sband = local->hw.wiphy->bands[link->conf->chanreq.oper.chan->band]; 4387 4388 /* Set up internal HT/VHT capabilities */ 4389 if (elems->ht_cap_elem && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT) 4390 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband, 4391 elems->ht_cap_elem, 4392 link_sta); 4393 4394 if (elems->vht_cap_elem && 4395 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT) { 4396 const struct ieee80211_vht_cap *bss_vht_cap = NULL; 4397 const struct cfg80211_bss_ies *ies; 4398 4399 /* 4400 * Cisco AP module 9115 with FW 17.3 has a bug and sends a 4401 * too large maximum MPDU length in the association response 4402 * (indicating 12k) that it cannot actually process ... 4403 * Work around that. 4404 */ 4405 rcu_read_lock(); 4406 ies = rcu_dereference(cbss->ies); 4407 if (ies) { 4408 const struct element *elem; 4409 4410 elem = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, 4411 ies->data, ies->len); 4412 if (elem && elem->datalen >= sizeof(*bss_vht_cap)) 4413 bss_vht_cap = (const void *)elem->data; 4414 } 4415 4416 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband, 4417 elems->vht_cap_elem, 4418 bss_vht_cap, link_sta); 4419 rcu_read_unlock(); 4420 } 4421 4422 if (elems->he_operation && 4423 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HE && 4424 elems->he_cap) { 4425 const struct ieee80211_he_6ghz_oper *he_6ghz_oper; 4426 4427 ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband, 4428 elems->he_cap, 4429 elems->he_cap_len, 4430 elems->he_6ghz_capa, 4431 link_sta); 4432 4433 he_6ghz_oper = ieee80211_he_6ghz_oper(elems->he_operation); 4434 4435 if (is_6ghz && he_6ghz_oper) { 4436 switch (u8_get_bits(he_6ghz_oper->control, 4437 IEEE80211_HE_6GHZ_OPER_CTRL_REG_INFO)) { 4438 case IEEE80211_6GHZ_CTRL_REG_LPI_AP: 4439 bss_conf->power_type = IEEE80211_REG_LPI_AP; 4440 break; 4441 case IEEE80211_6GHZ_CTRL_REG_SP_AP: 4442 bss_conf->power_type = IEEE80211_REG_SP_AP; 4443 break; 4444 case IEEE80211_6GHZ_CTRL_REG_VLP_AP: 4445 bss_conf->power_type = IEEE80211_REG_VLP_AP; 4446 break; 4447 default: 4448 bss_conf->power_type = IEEE80211_REG_UNSET_AP; 4449 break; 4450 } 4451 } else if (is_6ghz) { 4452 link_info(link, 4453 "HE 6 GHz operation missing (on %d MHz), expect issues\n", 4454 bss_conf->chanreq.oper.chan->center_freq); 4455 } 4456 4457 bss_conf->he_support = link_sta->pub->he_cap.has_he; 4458 if (elems->rsnx && elems->rsnx_len && 4459 (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) && 4460 wiphy_ext_feature_isset(local->hw.wiphy, 4461 NL80211_EXT_FEATURE_PROTECTED_TWT)) 4462 bss_conf->twt_protected = true; 4463 else 4464 bss_conf->twt_protected = false; 4465 4466 *changed |= ieee80211_recalc_twt_req(sdata, sband, link, 4467 link_sta, elems); 4468 4469 if (elems->eht_operation && elems->eht_cap && 4470 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_EHT) { 4471 ieee80211_eht_cap_ie_to_sta_eht_cap(sdata, sband, 4472 elems->he_cap, 4473 elems->he_cap_len, 4474 elems->eht_cap, 4475 elems->eht_cap_len, 4476 link_sta); 4477 4478 bss_conf->eht_support = link_sta->pub->eht_cap.has_eht; 4479 } else { 4480 bss_conf->eht_support = false; 4481 } 4482 } else { 4483 bss_conf->he_support = false; 4484 bss_conf->twt_requester = false; 4485 bss_conf->twt_protected = false; 4486 bss_conf->eht_support = false; 4487 } 4488 4489 bss_conf->twt_broadcast = 4490 ieee80211_twt_bcast_support(sdata, bss_conf, sband, link_sta); 4491 4492 if (bss_conf->he_support) { 4493 bss_conf->he_bss_color.color = 4494 le32_get_bits(elems->he_operation->he_oper_params, 4495 IEEE80211_HE_OPERATION_BSS_COLOR_MASK); 4496 bss_conf->he_bss_color.partial = 4497 le32_get_bits(elems->he_operation->he_oper_params, 4498 IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR); 4499 bss_conf->he_bss_color.enabled = 4500 !le32_get_bits(elems->he_operation->he_oper_params, 4501 IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED); 4502 4503 if (bss_conf->he_bss_color.enabled) 4504 *changed |= BSS_CHANGED_HE_BSS_COLOR; 4505 4506 bss_conf->htc_trig_based_pkt_ext = 4507 le32_get_bits(elems->he_operation->he_oper_params, 4508 IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK); 4509 bss_conf->frame_time_rts_th = 4510 le32_get_bits(elems->he_operation->he_oper_params, 4511 IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK); 4512 4513 bss_conf->uora_exists = !!elems->uora_element; 4514 if (elems->uora_element) 4515 bss_conf->uora_ocw_range = elems->uora_element[0]; 4516 4517 ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation); 4518 ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr); 4519 /* TODO: OPEN: what happens if BSS color disable is set? */ 4520 } 4521 4522 if (cbss->transmitted_bss) { 4523 bss_conf->nontransmitted = true; 4524 ether_addr_copy(bss_conf->transmitter_bssid, 4525 cbss->transmitted_bss->bssid); 4526 bss_conf->bssid_indicator = cbss->max_bssid_indicator; 4527 bss_conf->bssid_index = cbss->bssid_index; 4528 } 4529 4530 /* 4531 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data 4532 * in their association response, so ignore that data for our own 4533 * configuration. If it changed since the last beacon, we'll get the 4534 * next beacon and update then. 4535 */ 4536 4537 /* 4538 * If an operating mode notification IE is present, override the 4539 * NSS calculation (that would be done in rate_control_rate_init()) 4540 * and use the # of streams from that element. 4541 */ 4542 if (elems->opmode_notif && 4543 !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) { 4544 u8 nss; 4545 4546 nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK; 4547 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT; 4548 nss += 1; 4549 link_sta->pub->rx_nss = nss; 4550 } 4551 4552 /* 4553 * Always handle WMM once after association regardless 4554 * of the first value the AP uses. Setting -1 here has 4555 * that effect because the AP values is an unsigned 4556 * 4-bit value. 4557 */ 4558 link->u.mgd.wmm_last_param_set = -1; 4559 link->u.mgd.mu_edca_last_param_set = -1; 4560 4561 if (link->u.mgd.disable_wmm_tracking) { 4562 ieee80211_set_wmm_default(link, false, false); 4563 } else if (!ieee80211_sta_wmm_params(local, link, elems->wmm_param, 4564 elems->wmm_param_len, 4565 elems->mu_edca_param_set)) { 4566 /* still enable QoS since we might have HT/VHT */ 4567 ieee80211_set_wmm_default(link, false, true); 4568 /* disable WMM tracking in this case to disable 4569 * tracking WMM parameter changes in the beacon if 4570 * the parameters weren't actually valid. Doing so 4571 * avoids changing parameters very strangely when 4572 * the AP is going back and forth between valid and 4573 * invalid parameters. 4574 */ 4575 link->u.mgd.disable_wmm_tracking = true; 4576 } 4577 4578 if (elems->max_idle_period_ie) { 4579 bss_conf->max_idle_period = 4580 le16_to_cpu(elems->max_idle_period_ie->max_idle_period); 4581 bss_conf->protected_keep_alive = 4582 !!(elems->max_idle_period_ie->idle_options & 4583 WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE); 4584 *changed |= BSS_CHANGED_KEEP_ALIVE; 4585 } else { 4586 bss_conf->max_idle_period = 0; 4587 bss_conf->protected_keep_alive = false; 4588 } 4589 4590 /* set assoc capability (AID was already set earlier), 4591 * ieee80211_set_associated() will tell the driver */ 4592 bss_conf->assoc_capability = capab_info; 4593 4594 ret = true; 4595out: 4596 kfree(elems); 4597 kfree(bss_ies); 4598 return ret; 4599} 4600 4601static int ieee80211_mgd_setup_link_sta(struct ieee80211_link_data *link, 4602 struct sta_info *sta, 4603 struct link_sta_info *link_sta, 4604 struct cfg80211_bss *cbss) 4605{ 4606 struct ieee80211_sub_if_data *sdata = link->sdata; 4607 struct ieee80211_local *local = sdata->local; 4608 struct ieee80211_bss *bss = (void *)cbss->priv; 4609 u32 rates = 0, basic_rates = 0; 4610 bool have_higher_than_11mbit = false; 4611 int min_rate = INT_MAX, min_rate_index = -1; 4612 struct ieee80211_supported_band *sband; 4613 4614 memcpy(link_sta->addr, cbss->bssid, ETH_ALEN); 4615 memcpy(link_sta->pub->addr, cbss->bssid, ETH_ALEN); 4616 4617 /* TODO: S1G Basic Rate Set is expressed elsewhere */ 4618 if (cbss->channel->band == NL80211_BAND_S1GHZ) { 4619 ieee80211_s1g_sta_rate_init(sta); 4620 return 0; 4621 } 4622 4623 sband = local->hw.wiphy->bands[cbss->channel->band]; 4624 4625 ieee80211_get_rates(sband, bss->supp_rates, bss->supp_rates_len, 4626 &rates, &basic_rates, &have_higher_than_11mbit, 4627 &min_rate, &min_rate_index); 4628 4629 /* 4630 * This used to be a workaround for basic rates missing 4631 * in the association response frame. Now that we no 4632 * longer use the basic rates from there, it probably 4633 * doesn't happen any more, but keep the workaround so 4634 * in case some *other* APs are buggy in different ways 4635 * we can connect -- with a warning. 4636 * Allow this workaround only in case the AP provided at least 4637 * one rate. 4638 */ 4639 if (min_rate_index < 0) { 4640 link_info(link, "No legacy rates in association response\n"); 4641 return -EINVAL; 4642 } else if (!basic_rates) { 4643 link_info(link, "No basic rates, using min rate instead\n"); 4644 basic_rates = BIT(min_rate_index); 4645 } 4646 4647 if (rates) 4648 link_sta->pub->supp_rates[cbss->channel->band] = rates; 4649 else 4650 link_info(link, "No rates found, keeping mandatory only\n"); 4651 4652 link->conf->basic_rates = basic_rates; 4653 4654 /* cf. IEEE 802.11 9.2.12 */ 4655 link->operating_11g_mode = sband->band == NL80211_BAND_2GHZ && 4656 have_higher_than_11mbit; 4657 4658 return 0; 4659} 4660 4661static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link, 4662 struct cfg80211_bss *cbss) 4663{ 4664 struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp; 4665 const struct element *ht_cap_elem, *vht_cap_elem; 4666 const struct cfg80211_bss_ies *ies; 4667 const struct ieee80211_ht_cap *ht_cap; 4668 const struct ieee80211_vht_cap *vht_cap; 4669 const struct ieee80211_he_cap_elem *he_cap; 4670 const struct element *he_cap_elem; 4671 u16 mcs_80_map, mcs_160_map; 4672 int i, mcs_nss_size; 4673 bool support_160; 4674 u8 chains = 1; 4675 4676 if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_HT) 4677 return chains; 4678 4679 ht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_CAPABILITY); 4680 if (ht_cap_elem && ht_cap_elem->datalen >= sizeof(*ht_cap)) { 4681 ht_cap = (void *)ht_cap_elem->data; 4682 chains = ieee80211_mcs_to_chains(&ht_cap->mcs); 4683 /* 4684 * TODO: use "Tx Maximum Number Spatial Streams Supported" and 4685 * "Tx Unequal Modulation Supported" fields. 4686 */ 4687 } 4688 4689 if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_VHT) 4690 return chains; 4691 4692 vht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY); 4693 if (vht_cap_elem && vht_cap_elem->datalen >= sizeof(*vht_cap)) { 4694 u8 nss; 4695 u16 tx_mcs_map; 4696 4697 vht_cap = (void *)vht_cap_elem->data; 4698 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map); 4699 for (nss = 8; nss > 0; nss--) { 4700 if (((tx_mcs_map >> (2 * (nss - 1))) & 3) != 4701 IEEE80211_VHT_MCS_NOT_SUPPORTED) 4702 break; 4703 } 4704 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */ 4705 chains = max(chains, nss); 4706 } 4707 4708 if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_HE) 4709 return chains; 4710 4711 ies = rcu_dereference(cbss->ies); 4712 he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, 4713 ies->data, ies->len); 4714 4715 if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap)) 4716 return chains; 4717 4718 /* skip one byte ext_tag_id */ 4719 he_cap = (void *)(he_cap_elem->data + 1); 4720 mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap); 4721 4722 /* invalid HE IE */ 4723 if (he_cap_elem->datalen < 1 + mcs_nss_size + sizeof(*he_cap)) 4724 return chains; 4725 4726 /* mcs_nss is right after he_cap info */ 4727 he_mcs_nss_supp = (void *)(he_cap + 1); 4728 4729 mcs_80_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80); 4730 4731 for (i = 7; i >= 0; i--) { 4732 u8 mcs_80 = mcs_80_map >> (2 * i) & 3; 4733 4734 if (mcs_80 != IEEE80211_VHT_MCS_NOT_SUPPORTED) { 4735 chains = max_t(u8, chains, i + 1); 4736 break; 4737 } 4738 } 4739 4740 support_160 = he_cap->phy_cap_info[0] & 4741 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G; 4742 4743 if (!support_160) 4744 return chains; 4745 4746 mcs_160_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_160); 4747 for (i = 7; i >= 0; i--) { 4748 u8 mcs_160 = mcs_160_map >> (2 * i) & 3; 4749 4750 if (mcs_160 != IEEE80211_VHT_MCS_NOT_SUPPORTED) { 4751 chains = max_t(u8, chains, i + 1); 4752 break; 4753 } 4754 } 4755 4756 return chains; 4757} 4758 4759static void 4760ieee80211_determine_our_sta_mode(struct ieee80211_sub_if_data *sdata, 4761 struct ieee80211_supported_band *sband, 4762 struct cfg80211_assoc_request *req, 4763 bool wmm_used, int link_id, 4764 struct ieee80211_conn_settings *conn) 4765{ 4766 struct ieee80211_sta_ht_cap sta_ht_cap = sband->ht_cap; 4767 bool is_5ghz = sband->band == NL80211_BAND_5GHZ; 4768 bool is_6ghz = sband->band == NL80211_BAND_6GHZ; 4769 const struct ieee80211_sta_he_cap *he_cap; 4770 const struct ieee80211_sta_eht_cap *eht_cap; 4771 struct ieee80211_sta_vht_cap vht_cap; 4772 4773 if (sband->band == NL80211_BAND_S1GHZ) { 4774 conn->mode = IEEE80211_CONN_MODE_S1G; 4775 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20; 4776 mlme_dbg(sdata, "operating as S1G STA\n"); 4777 return; 4778 } 4779 4780 conn->mode = IEEE80211_CONN_MODE_LEGACY; 4781 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20; 4782 4783 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap); 4784 4785 if (req && req->flags & ASSOC_REQ_DISABLE_HT) { 4786 mlme_link_id_dbg(sdata, link_id, 4787 "HT disabled by flag, limiting to legacy\n"); 4788 goto out; 4789 } 4790 4791 if (!wmm_used) { 4792 mlme_link_id_dbg(sdata, link_id, 4793 "WMM/QoS not supported, limiting to legacy\n"); 4794 goto out; 4795 } 4796 4797 if (req) { 4798 unsigned int i; 4799 4800 for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) { 4801 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 || 4802 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP || 4803 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) { 4804 netdev_info(sdata->dev, 4805 "WEP/TKIP use, limiting to legacy\n"); 4806 goto out; 4807 } 4808 } 4809 } 4810 4811 if (!sta_ht_cap.ht_supported && !is_6ghz) { 4812 mlme_link_id_dbg(sdata, link_id, 4813 "HT not supported (and not on 6 GHz), limiting to legacy\n"); 4814 goto out; 4815 } 4816 4817 /* HT is fine */ 4818 conn->mode = IEEE80211_CONN_MODE_HT; 4819 conn->bw_limit = sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ? 4820 IEEE80211_CONN_BW_LIMIT_40 : 4821 IEEE80211_CONN_BW_LIMIT_20; 4822 4823 memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap)); 4824 ieee80211_apply_vhtcap_overrides(sdata, &vht_cap); 4825 4826 if (req && req->flags & ASSOC_REQ_DISABLE_VHT) { 4827 mlme_link_id_dbg(sdata, link_id, 4828 "VHT disabled by flag, limiting to HT\n"); 4829 goto out; 4830 } 4831 4832 if (vht_cap.vht_supported && is_5ghz) { 4833 bool have_80mhz = false; 4834 unsigned int i; 4835 4836 if (conn->bw_limit == IEEE80211_CONN_BW_LIMIT_20) { 4837 mlme_link_id_dbg(sdata, link_id, 4838 "no 40 MHz support on 5 GHz, limiting to HT\n"); 4839 goto out; 4840 } 4841 4842 /* Allow VHT if at least one channel on the sband supports 80 MHz */ 4843 for (i = 0; i < sband->n_channels; i++) { 4844 if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED | 4845 IEEE80211_CHAN_NO_80MHZ)) 4846 continue; 4847 4848 have_80mhz = true; 4849 break; 4850 } 4851 4852 if (!have_80mhz) { 4853 mlme_link_id_dbg(sdata, link_id, 4854 "no 80 MHz channel support on 5 GHz, limiting to HT\n"); 4855 goto out; 4856 } 4857 } else if (is_5ghz) { /* !vht_supported but on 5 GHz */ 4858 mlme_link_id_dbg(sdata, link_id, 4859 "no VHT support on 5 GHz, limiting to HT\n"); 4860 goto out; 4861 } 4862 4863 /* VHT - if we have - is fine, including 80 MHz, check 160 below again */ 4864 if (sband->band != NL80211_BAND_2GHZ) { 4865 conn->mode = IEEE80211_CONN_MODE_VHT; 4866 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_160; 4867 } 4868 4869 if (is_5ghz && 4870 !(vht_cap.cap & (IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ | 4871 IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))) { 4872 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_80; 4873 mlme_link_id_dbg(sdata, link_id, 4874 "no VHT 160 MHz capability on 5 GHz, limiting to 80 MHz"); 4875 } 4876 4877 if (req && req->flags & ASSOC_REQ_DISABLE_HE) { 4878 mlme_link_id_dbg(sdata, link_id, 4879 "HE disabled by flag, limiting to HT/VHT\n"); 4880 goto out; 4881 } 4882 4883 he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif); 4884 if (!he_cap) { 4885 WARN_ON(is_6ghz); 4886 mlme_link_id_dbg(sdata, link_id, 4887 "no HE support, limiting to HT/VHT\n"); 4888 goto out; 4889 } 4890 4891 /* so we have HE */ 4892 conn->mode = IEEE80211_CONN_MODE_HE; 4893 4894 /* check bandwidth */ 4895 switch (sband->band) { 4896 default: 4897 case NL80211_BAND_2GHZ: 4898 if (he_cap->he_cap_elem.phy_cap_info[0] & 4899 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G) 4900 break; 4901 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20; 4902 mlme_link_id_dbg(sdata, link_id, 4903 "no 40 MHz HE cap in 2.4 GHz, limiting to 20 MHz\n"); 4904 break; 4905 case NL80211_BAND_5GHZ: 4906 if (!(he_cap->he_cap_elem.phy_cap_info[0] & 4907 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G)) { 4908 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20; 4909 mlme_link_id_dbg(sdata, link_id, 4910 "no 40/80 MHz HE cap in 5 GHz, limiting to 20 MHz\n"); 4911 break; 4912 } 4913 if (!(he_cap->he_cap_elem.phy_cap_info[0] & 4914 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G)) { 4915 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit, 4916 conn->bw_limit, 4917 IEEE80211_CONN_BW_LIMIT_80); 4918 mlme_link_id_dbg(sdata, link_id, 4919 "no 160 MHz HE cap in 5 GHz, limiting to 80 MHz\n"); 4920 } 4921 break; 4922 case NL80211_BAND_6GHZ: 4923 if (he_cap->he_cap_elem.phy_cap_info[0] & 4924 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) 4925 break; 4926 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit, 4927 conn->bw_limit, 4928 IEEE80211_CONN_BW_LIMIT_80); 4929 mlme_link_id_dbg(sdata, link_id, 4930 "no 160 MHz HE cap in 6 GHz, limiting to 80 MHz\n"); 4931 break; 4932 } 4933 4934 if (req && req->flags & ASSOC_REQ_DISABLE_EHT) { 4935 mlme_link_id_dbg(sdata, link_id, 4936 "EHT disabled by flag, limiting to HE\n"); 4937 goto out; 4938 } 4939 4940 eht_cap = ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif); 4941 if (!eht_cap) { 4942 mlme_link_id_dbg(sdata, link_id, 4943 "no EHT support, limiting to HE\n"); 4944 goto out; 4945 } 4946 4947 /* we have EHT */ 4948 4949 conn->mode = IEEE80211_CONN_MODE_EHT; 4950 4951 /* check bandwidth */ 4952 if (is_6ghz && 4953 eht_cap->eht_cap_elem.phy_cap_info[0] & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ) 4954 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_320; 4955 else if (is_6ghz) 4956 mlme_link_id_dbg(sdata, link_id, 4957 "no EHT 320 MHz cap in 6 GHz, limiting to 160 MHz\n"); 4958 4959out: 4960 mlme_link_id_dbg(sdata, link_id, 4961 "determined local STA to be %s, BW limited to %d MHz\n", 4962 ieee80211_conn_mode_str(conn->mode), 4963 20 * (1 << conn->bw_limit)); 4964} 4965 4966static void 4967ieee80211_determine_our_sta_mode_auth(struct ieee80211_sub_if_data *sdata, 4968 struct ieee80211_supported_band *sband, 4969 struct cfg80211_auth_request *req, 4970 bool wmm_used, 4971 struct ieee80211_conn_settings *conn) 4972{ 4973 ieee80211_determine_our_sta_mode(sdata, sband, NULL, wmm_used, 4974 req->link_id > 0 ? req->link_id : 0, 4975 conn); 4976} 4977 4978static void 4979ieee80211_determine_our_sta_mode_assoc(struct ieee80211_sub_if_data *sdata, 4980 struct ieee80211_supported_band *sband, 4981 struct cfg80211_assoc_request *req, 4982 bool wmm_used, int link_id, 4983 struct ieee80211_conn_settings *conn) 4984{ 4985 struct ieee80211_conn_settings tmp; 4986 4987 WARN_ON(!req); 4988 4989 ieee80211_determine_our_sta_mode(sdata, sband, req, wmm_used, link_id, 4990 &tmp); 4991 4992 conn->mode = min_t(enum ieee80211_conn_mode, 4993 conn->mode, tmp.mode); 4994 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit, 4995 conn->bw_limit, tmp.bw_limit); 4996} 4997 4998static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata, 4999 struct ieee80211_link_data *link, 5000 int link_id, 5001 struct cfg80211_bss *cbss, bool mlo, 5002 struct ieee80211_conn_settings *conn) 5003{ 5004 struct ieee80211_local *local = sdata->local; 5005 bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ; 5006 struct ieee80211_chan_req chanreq = {}; 5007 struct ieee802_11_elems *elems; 5008 int ret; 5009 u32 i; 5010 5011 lockdep_assert_wiphy(local->hw.wiphy); 5012 5013 rcu_read_lock(); 5014 elems = ieee80211_determine_chan_mode(sdata, conn, cbss, link_id, 5015 &chanreq); 5016 5017 if (IS_ERR(elems)) { 5018 rcu_read_unlock(); 5019 return PTR_ERR(elems); 5020 } 5021 5022 if (mlo && !elems->ml_basic) { 5023 sdata_info(sdata, "Rejecting MLO as it is not supported by AP\n"); 5024 rcu_read_unlock(); 5025 kfree(elems); 5026 return -EINVAL; 5027 } 5028 5029 if (link && is_6ghz && conn->mode >= IEEE80211_CONN_MODE_HE) { 5030 struct ieee80211_bss_conf *bss_conf; 5031 u8 j = 0; 5032 5033 bss_conf = link->conf; 5034 5035 if (elems->pwr_constr_elem) 5036 bss_conf->pwr_reduction = *elems->pwr_constr_elem; 5037 5038 BUILD_BUG_ON(ARRAY_SIZE(bss_conf->tx_pwr_env) != 5039 ARRAY_SIZE(elems->tx_pwr_env)); 5040 5041 for (i = 0; i < elems->tx_pwr_env_num; i++) { 5042 if (elems->tx_pwr_env_len[i] > sizeof(bss_conf->tx_pwr_env[j])) 5043 continue; 5044 5045 bss_conf->tx_pwr_env_num++; 5046 memcpy(&bss_conf->tx_pwr_env[j], elems->tx_pwr_env[i], 5047 elems->tx_pwr_env_len[i]); 5048 j++; 5049 } 5050 } 5051 rcu_read_unlock(); 5052 /* the element data was RCU protected so no longer valid anyway */ 5053 kfree(elems); 5054 elems = NULL; 5055 5056 if (!link) 5057 return 0; 5058 5059 rcu_read_lock(); 5060 link->needed_rx_chains = min(ieee80211_max_rx_chains(link, cbss), 5061 local->rx_chains); 5062 rcu_read_unlock(); 5063 5064 /* 5065 * If this fails (possibly due to channel context sharing 5066 * on incompatible channels, e.g. 80+80 and 160 sharing the 5067 * same control channel) try to use a smaller bandwidth. 5068 */ 5069 ret = ieee80211_link_use_channel(link, &chanreq, 5070 IEEE80211_CHANCTX_SHARED); 5071 5072 /* don't downgrade for 5 and 10 MHz channels, though. */ 5073 if (chanreq.oper.width == NL80211_CHAN_WIDTH_5 || 5074 chanreq.oper.width == NL80211_CHAN_WIDTH_10) 5075 return ret; 5076 5077 while (ret && chanreq.oper.width != NL80211_CHAN_WIDTH_20_NOHT) { 5078 ieee80211_chanreq_downgrade(&chanreq, conn); 5079 5080 ret = ieee80211_link_use_channel(link, &chanreq, 5081 IEEE80211_CHANCTX_SHARED); 5082 } 5083 5084 return ret; 5085} 5086 5087static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies, 5088 u8 *dtim_count, u8 *dtim_period) 5089{ 5090 const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len); 5091 const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data, 5092 ies->len); 5093 const struct ieee80211_tim_ie *tim = NULL; 5094 const struct ieee80211_bssid_index *idx; 5095 bool valid = tim_ie && tim_ie[1] >= 2; 5096 5097 if (valid) 5098 tim = (void *)(tim_ie + 2); 5099 5100 if (dtim_count) 5101 *dtim_count = valid ? tim->dtim_count : 0; 5102 5103 if (dtim_period) 5104 *dtim_period = valid ? tim->dtim_period : 0; 5105 5106 /* Check if value is overridden by non-transmitted profile */ 5107 if (!idx_ie || idx_ie[1] < 3) 5108 return valid; 5109 5110 idx = (void *)(idx_ie + 2); 5111 5112 if (dtim_count) 5113 *dtim_count = idx->dtim_count; 5114 5115 if (dtim_period) 5116 *dtim_period = idx->dtim_period; 5117 5118 return true; 5119} 5120 5121static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata, 5122 struct ieee80211_mgmt *mgmt, 5123 struct ieee802_11_elems *elems, 5124 const u8 *elem_start, unsigned int elem_len) 5125{ 5126 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 5127 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data; 5128 struct ieee80211_local *local = sdata->local; 5129 unsigned int link_id; 5130 struct sta_info *sta; 5131 u64 changed[IEEE80211_MLD_MAX_NUM_LINKS] = {}; 5132 u16 valid_links = 0, dormant_links = 0; 5133 int err; 5134 5135 lockdep_assert_wiphy(sdata->local->hw.wiphy); 5136 /* 5137 * station info was already allocated and inserted before 5138 * the association and should be available to us 5139 */ 5140 sta = sta_info_get(sdata, assoc_data->ap_addr); 5141 if (WARN_ON(!sta)) 5142 goto out_err; 5143 5144 sta->sta.spp_amsdu = assoc_data->spp_amsdu; 5145 5146 if (ieee80211_vif_is_mld(&sdata->vif)) { 5147 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) { 5148 if (!assoc_data->link[link_id].bss) 5149 continue; 5150 5151 valid_links |= BIT(link_id); 5152 if (assoc_data->link[link_id].disabled) 5153 dormant_links |= BIT(link_id); 5154 5155 if (link_id != assoc_data->assoc_link_id) { 5156 err = ieee80211_sta_allocate_link(sta, link_id); 5157 if (err) 5158 goto out_err; 5159 } 5160 } 5161 5162 ieee80211_vif_set_links(sdata, valid_links, dormant_links); 5163 } 5164 5165 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) { 5166 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss; 5167 struct ieee80211_link_data *link; 5168 struct link_sta_info *link_sta; 5169 5170 if (!cbss) 5171 continue; 5172 5173 link = sdata_dereference(sdata->link[link_id], sdata); 5174 if (WARN_ON(!link)) 5175 goto out_err; 5176 5177 if (ieee80211_vif_is_mld(&sdata->vif)) 5178 link_info(link, 5179 "local address %pM, AP link address %pM%s\n", 5180 link->conf->addr, 5181 assoc_data->link[link_id].bss->bssid, 5182 link_id == assoc_data->assoc_link_id ? 5183 " (assoc)" : ""); 5184 5185 link_sta = rcu_dereference_protected(sta->link[link_id], 5186 lockdep_is_held(&local->hw.wiphy->mtx)); 5187 if (WARN_ON(!link_sta)) 5188 goto out_err; 5189 5190 if (!link->u.mgd.have_beacon) { 5191 const struct cfg80211_bss_ies *ies; 5192 5193 rcu_read_lock(); 5194 ies = rcu_dereference(cbss->beacon_ies); 5195 if (ies) 5196 link->u.mgd.have_beacon = true; 5197 else 5198 ies = rcu_dereference(cbss->ies); 5199 ieee80211_get_dtim(ies, 5200 &link->conf->sync_dtim_count, 5201 &link->u.mgd.dtim_period); 5202 link->conf->beacon_int = cbss->beacon_interval; 5203 rcu_read_unlock(); 5204 } 5205 5206 link->conf->dtim_period = link->u.mgd.dtim_period ?: 1; 5207 5208 if (link_id != assoc_data->assoc_link_id) { 5209 link->u.mgd.conn = assoc_data->link[link_id].conn; 5210 5211 err = ieee80211_prep_channel(sdata, link, link_id, cbss, 5212 true, &link->u.mgd.conn); 5213 if (err) { 5214 link_info(link, "prep_channel failed\n"); 5215 goto out_err; 5216 } 5217 } 5218 5219 err = ieee80211_mgd_setup_link_sta(link, sta, link_sta, 5220 assoc_data->link[link_id].bss); 5221 if (err) 5222 goto out_err; 5223 5224 if (!ieee80211_assoc_config_link(link, link_sta, 5225 assoc_data->link[link_id].bss, 5226 mgmt, elem_start, elem_len, 5227 &changed[link_id])) 5228 goto out_err; 5229 5230 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) { 5231 valid_links &= ~BIT(link_id); 5232 ieee80211_sta_remove_link(sta, link_id); 5233 continue; 5234 } 5235 5236 if (link_id != assoc_data->assoc_link_id) { 5237 err = ieee80211_sta_activate_link(sta, link_id); 5238 if (err) 5239 goto out_err; 5240 } 5241 } 5242 5243 /* links might have changed due to rejected ones, set them again */ 5244 ieee80211_vif_set_links(sdata, valid_links, dormant_links); 5245 5246 rate_control_rate_init(sta); 5247 5248 if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) { 5249 set_sta_flag(sta, WLAN_STA_MFP); 5250 sta->sta.mfp = true; 5251 } else { 5252 sta->sta.mfp = false; 5253 } 5254 5255 ieee80211_sta_set_max_amsdu_subframes(sta, elems->ext_capab, 5256 elems->ext_capab_len); 5257 5258 sta->sta.wme = (elems->wmm_param || elems->s1g_capab) && 5259 local->hw.queues >= IEEE80211_NUM_ACS; 5260 5261 err = sta_info_move_state(sta, IEEE80211_STA_ASSOC); 5262 if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT)) 5263 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED); 5264 if (err) { 5265 sdata_info(sdata, 5266 "failed to move station %pM to desired state\n", 5267 sta->sta.addr); 5268 WARN_ON(__sta_info_destroy(sta)); 5269 goto out_err; 5270 } 5271 5272 if (sdata->wdev.use_4addr) 5273 drv_sta_set_4addr(local, sdata, &sta->sta, true); 5274 5275 ieee80211_set_associated(sdata, assoc_data, changed); 5276 5277 /* 5278 * If we're using 4-addr mode, let the AP know that we're 5279 * doing so, so that it can create the STA VLAN on its side 5280 */ 5281 if (ifmgd->use_4addr) 5282 ieee80211_send_4addr_nullfunc(local, sdata); 5283 5284 /* 5285 * Start timer to probe the connection to the AP now. 5286 * Also start the timer that will detect beacon loss. 5287 */ 5288 ieee80211_sta_reset_beacon_monitor(sdata); 5289 ieee80211_sta_reset_conn_monitor(sdata); 5290 5291 return true; 5292out_err: 5293 eth_zero_addr(sdata->vif.cfg.ap_addr); 5294 return false; 5295} 5296 5297static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, 5298 struct ieee80211_mgmt *mgmt, 5299 size_t len) 5300{ 5301 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 5302 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data; 5303 u16 capab_info, status_code, aid; 5304 struct ieee80211_elems_parse_params parse_params = { 5305 .bss = NULL, 5306 .link_id = -1, 5307 .from_ap = true, 5308 }; 5309 struct ieee802_11_elems *elems; 5310 int ac; 5311 const u8 *elem_start; 5312 unsigned int elem_len; 5313 bool reassoc; 5314 struct ieee80211_event event = { 5315 .type = MLME_EVENT, 5316 .u.mlme.data = ASSOC_EVENT, 5317 }; 5318 struct ieee80211_prep_tx_info info = {}; 5319 struct cfg80211_rx_assoc_resp_data resp = { 5320 .uapsd_queues = -1, 5321 }; 5322 u8 ap_mld_addr[ETH_ALEN] __aligned(2); 5323 unsigned int link_id; 5324 5325 lockdep_assert_wiphy(sdata->local->hw.wiphy); 5326 5327 if (!assoc_data) 5328 return; 5329 5330 parse_params.mode = 5331 assoc_data->link[assoc_data->assoc_link_id].conn.mode; 5332 5333 if (!ether_addr_equal(assoc_data->ap_addr, mgmt->bssid) || 5334 !ether_addr_equal(assoc_data->ap_addr, mgmt->sa)) 5335 return; 5336 5337 /* 5338 * AssocResp and ReassocResp have identical structure, so process both 5339 * of them in this function. 5340 */ 5341 5342 if (len < 24 + 6) 5343 return; 5344 5345 reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control); 5346 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info); 5347 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code); 5348 if (assoc_data->s1g) 5349 elem_start = mgmt->u.s1g_assoc_resp.variable; 5350 else 5351 elem_start = mgmt->u.assoc_resp.variable; 5352 5353 /* 5354 * Note: this may not be perfect, AP might misbehave - if 5355 * anyone needs to rely on perfect complete notification 5356 * with the exact right subtype, then we need to track what 5357 * we actually transmitted. 5358 */ 5359 info.subtype = reassoc ? IEEE80211_STYPE_REASSOC_REQ : 5360 IEEE80211_STYPE_ASSOC_REQ; 5361 5362 if (assoc_data->fils_kek_len && 5363 fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0) 5364 return; 5365 5366 elem_len = len - (elem_start - (u8 *)mgmt); 5367 parse_params.start = elem_start; 5368 parse_params.len = elem_len; 5369 elems = ieee802_11_parse_elems_full(&parse_params); 5370 if (!elems) 5371 goto notify_driver; 5372 5373 if (elems->aid_resp) 5374 aid = le16_to_cpu(elems->aid_resp->aid); 5375 else if (assoc_data->s1g) 5376 aid = 0; /* TODO */ 5377 else 5378 aid = le16_to_cpu(mgmt->u.assoc_resp.aid); 5379 5380 /* 5381 * The 5 MSB of the AID field are reserved 5382 * (802.11-2016 9.4.1.8 AID field) 5383 */ 5384 aid &= 0x7ff; 5385 5386 sdata_info(sdata, 5387 "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n", 5388 reassoc ? "Rea" : "A", assoc_data->ap_addr, 5389 capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14)))); 5390 5391 ifmgd->broken_ap = false; 5392 5393 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY && 5394 elems->timeout_int && 5395 elems->timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) { 5396 u32 tu, ms; 5397 5398 cfg80211_assoc_comeback(sdata->dev, assoc_data->ap_addr, 5399 le32_to_cpu(elems->timeout_int->value)); 5400 5401 tu = le32_to_cpu(elems->timeout_int->value); 5402 ms = tu * 1024 / 1000; 5403 sdata_info(sdata, 5404 "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n", 5405 assoc_data->ap_addr, tu, ms); 5406 assoc_data->timeout = jiffies + msecs_to_jiffies(ms); 5407 assoc_data->timeout_started = true; 5408 assoc_data->comeback = true; 5409 if (ms > IEEE80211_ASSOC_TIMEOUT) 5410 run_again(sdata, assoc_data->timeout); 5411 goto notify_driver; 5412 } 5413 5414 if (status_code != WLAN_STATUS_SUCCESS) { 5415 sdata_info(sdata, "%pM denied association (code=%d)\n", 5416 assoc_data->ap_addr, status_code); 5417 event.u.mlme.status = MLME_DENIED; 5418 event.u.mlme.reason = status_code; 5419 drv_event_callback(sdata->local, sdata, &event); 5420 } else { 5421 if (aid == 0 || aid > IEEE80211_MAX_AID) { 5422 sdata_info(sdata, 5423 "invalid AID value %d (out of range), turn off PS\n", 5424 aid); 5425 aid = 0; 5426 ifmgd->broken_ap = true; 5427 } 5428 5429 if (ieee80211_vif_is_mld(&sdata->vif)) { 5430 struct ieee80211_mle_basic_common_info *common; 5431 5432 if (!elems->ml_basic) { 5433 sdata_info(sdata, 5434 "MLO association with %pM but no (basic) multi-link element in response!\n", 5435 assoc_data->ap_addr); 5436 goto abandon_assoc; 5437 } 5438 5439 common = (void *)elems->ml_basic->variable; 5440 5441 if (memcmp(assoc_data->ap_addr, 5442 common->mld_mac_addr, ETH_ALEN)) { 5443 sdata_info(sdata, 5444 "AP MLD MAC address mismatch: got %pM expected %pM\n", 5445 common->mld_mac_addr, 5446 assoc_data->ap_addr); 5447 goto abandon_assoc; 5448 } 5449 5450 sdata->vif.cfg.eml_cap = 5451 ieee80211_mle_get_eml_cap((const void *)elems->ml_basic); 5452 sdata->vif.cfg.eml_med_sync_delay = 5453 ieee80211_mle_get_eml_med_sync_delay((const void *)elems->ml_basic); 5454 sdata->vif.cfg.mld_capa_op = 5455 ieee80211_mle_get_mld_capa_op((const void *)elems->ml_basic); 5456 } 5457 5458 sdata->vif.cfg.aid = aid; 5459 5460 if (!ieee80211_assoc_success(sdata, mgmt, elems, 5461 elem_start, elem_len)) { 5462 /* oops -- internal error -- send timeout for now */ 5463 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT); 5464 goto notify_driver; 5465 } 5466 event.u.mlme.status = MLME_SUCCESS; 5467 drv_event_callback(sdata->local, sdata, &event); 5468 sdata_info(sdata, "associated\n"); 5469 5470 info.success = 1; 5471 } 5472 5473 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) { 5474 struct ieee80211_link_data *link; 5475 5476 if (!assoc_data->link[link_id].bss) 5477 continue; 5478 5479 resp.links[link_id].bss = assoc_data->link[link_id].bss; 5480 ether_addr_copy(resp.links[link_id].addr, 5481 assoc_data->link[link_id].addr); 5482 resp.links[link_id].status = assoc_data->link[link_id].status; 5483 5484 link = sdata_dereference(sdata->link[link_id], sdata); 5485 if (!link) 5486 continue; 5487 5488 /* get uapsd queues configuration - same for all links */ 5489 resp.uapsd_queues = 0; 5490 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) 5491 if (link->tx_conf[ac].uapsd) 5492 resp.uapsd_queues |= ieee80211_ac_to_qos_mask[ac]; 5493 } 5494 5495 if (ieee80211_vif_is_mld(&sdata->vif)) { 5496 ether_addr_copy(ap_mld_addr, sdata->vif.cfg.ap_addr); 5497 resp.ap_mld_addr = ap_mld_addr; 5498 } 5499 5500 ieee80211_destroy_assoc_data(sdata, 5501 status_code == WLAN_STATUS_SUCCESS ? 5502 ASSOC_SUCCESS : 5503 ASSOC_REJECTED); 5504 5505 resp.buf = (u8 *)mgmt; 5506 resp.len = len; 5507 resp.req_ies = ifmgd->assoc_req_ies; 5508 resp.req_ies_len = ifmgd->assoc_req_ies_len; 5509 cfg80211_rx_assoc_resp(sdata->dev, &resp); 5510notify_driver: 5511 drv_mgd_complete_tx(sdata->local, sdata, &info); 5512 kfree(elems); 5513 return; 5514abandon_assoc: 5515 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON); 5516 goto notify_driver; 5517} 5518 5519static void ieee80211_rx_bss_info(struct ieee80211_link_data *link, 5520 struct ieee80211_mgmt *mgmt, size_t len, 5521 struct ieee80211_rx_status *rx_status) 5522{ 5523 struct ieee80211_sub_if_data *sdata = link->sdata; 5524 struct ieee80211_local *local = sdata->local; 5525 struct ieee80211_bss *bss; 5526 struct ieee80211_channel *channel; 5527 5528 lockdep_assert_wiphy(sdata->local->hw.wiphy); 5529 5530 channel = ieee80211_get_channel_khz(local->hw.wiphy, 5531 ieee80211_rx_status_to_khz(rx_status)); 5532 if (!channel) 5533 return; 5534 5535 bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel); 5536 if (bss) { 5537 link->conf->beacon_rate = bss->beacon_rate; 5538 ieee80211_rx_bss_put(local, bss); 5539 } 5540} 5541 5542 5543static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_link_data *link, 5544 struct sk_buff *skb) 5545{ 5546 struct ieee80211_sub_if_data *sdata = link->sdata; 5547 struct ieee80211_mgmt *mgmt = (void *)skb->data; 5548 struct ieee80211_if_managed *ifmgd; 5549 struct ieee80211_rx_status *rx_status = (void *) skb->cb; 5550 struct ieee80211_channel *channel; 5551 size_t baselen, len = skb->len; 5552 5553 ifmgd = &sdata->u.mgd; 5554 5555 lockdep_assert_wiphy(sdata->local->hw.wiphy); 5556 5557 /* 5558 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2: 5559 * "If a 6 GHz AP receives a Probe Request frame and responds with 5560 * a Probe Response frame [..], the Address 1 field of the Probe 5561 * Response frame shall be set to the broadcast address [..]" 5562 * So, on 6GHz band we should also accept broadcast responses. 5563 */ 5564 channel = ieee80211_get_channel(sdata->local->hw.wiphy, 5565 rx_status->freq); 5566 if (!channel) 5567 return; 5568 5569 if (!ether_addr_equal(mgmt->da, sdata->vif.addr) && 5570 (channel->band != NL80211_BAND_6GHZ || 5571 !is_broadcast_ether_addr(mgmt->da))) 5572 return; /* ignore ProbeResp to foreign address */ 5573 5574 baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt; 5575 if (baselen > len) 5576 return; 5577 5578 ieee80211_rx_bss_info(link, mgmt, len, rx_status); 5579 5580 if (ifmgd->associated && 5581 ether_addr_equal(mgmt->bssid, link->u.mgd.bssid)) 5582 ieee80211_reset_ap_probe(sdata); 5583} 5584 5585/* 5586 * This is the canonical list of information elements we care about, 5587 * the filter code also gives us all changes to the Microsoft OUI 5588 * (00:50:F2) vendor IE which is used for WMM which we need to track, 5589 * as well as the DTPC IE (part of the Cisco OUI) used for signaling 5590 * changes to requested client power. 5591 * 5592 * We implement beacon filtering in software since that means we can 5593 * avoid processing the frame here and in cfg80211, and userspace 5594 * will not be able to tell whether the hardware supports it or not. 5595 * 5596 * XXX: This list needs to be dynamic -- userspace needs to be able to 5597 * add items it requires. It also needs to be able to tell us to 5598 * look out for other vendor IEs. 5599 */ 5600static const u64 care_about_ies = 5601 (1ULL << WLAN_EID_COUNTRY) | 5602 (1ULL << WLAN_EID_ERP_INFO) | 5603 (1ULL << WLAN_EID_CHANNEL_SWITCH) | 5604 (1ULL << WLAN_EID_PWR_CONSTRAINT) | 5605 (1ULL << WLAN_EID_HT_CAPABILITY) | 5606 (1ULL << WLAN_EID_HT_OPERATION) | 5607 (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN); 5608 5609static void ieee80211_handle_beacon_sig(struct ieee80211_link_data *link, 5610 struct ieee80211_if_managed *ifmgd, 5611 struct ieee80211_bss_conf *bss_conf, 5612 struct ieee80211_local *local, 5613 struct ieee80211_rx_status *rx_status) 5614{ 5615 struct ieee80211_sub_if_data *sdata = link->sdata; 5616 5617 /* Track average RSSI from the Beacon frames of the current AP */ 5618 5619 if (!link->u.mgd.tracking_signal_avg) { 5620 link->u.mgd.tracking_signal_avg = true; 5621 ewma_beacon_signal_init(&link->u.mgd.ave_beacon_signal); 5622 link->u.mgd.last_cqm_event_signal = 0; 5623 link->u.mgd.count_beacon_signal = 1; 5624 link->u.mgd.last_ave_beacon_signal = 0; 5625 } else { 5626 link->u.mgd.count_beacon_signal++; 5627 } 5628 5629 ewma_beacon_signal_add(&link->u.mgd.ave_beacon_signal, 5630 -rx_status->signal); 5631 5632 if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold && 5633 link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) { 5634 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal); 5635 int last_sig = link->u.mgd.last_ave_beacon_signal; 5636 struct ieee80211_event event = { 5637 .type = RSSI_EVENT, 5638 }; 5639 5640 /* 5641 * if signal crosses either of the boundaries, invoke callback 5642 * with appropriate parameters 5643 */ 5644 if (sig > ifmgd->rssi_max_thold && 5645 (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) { 5646 link->u.mgd.last_ave_beacon_signal = sig; 5647 event.u.rssi.data = RSSI_EVENT_HIGH; 5648 drv_event_callback(local, sdata, &event); 5649 } else if (sig < ifmgd->rssi_min_thold && 5650 (last_sig >= ifmgd->rssi_max_thold || 5651 last_sig == 0)) { 5652 link->u.mgd.last_ave_beacon_signal = sig; 5653 event.u.rssi.data = RSSI_EVENT_LOW; 5654 drv_event_callback(local, sdata, &event); 5655 } 5656 } 5657 5658 if (bss_conf->cqm_rssi_thold && 5659 link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT && 5660 !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) { 5661 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal); 5662 int last_event = link->u.mgd.last_cqm_event_signal; 5663 int thold = bss_conf->cqm_rssi_thold; 5664 int hyst = bss_conf->cqm_rssi_hyst; 5665 5666 if (sig < thold && 5667 (last_event == 0 || sig < last_event - hyst)) { 5668 link->u.mgd.last_cqm_event_signal = sig; 5669 ieee80211_cqm_rssi_notify( 5670 &sdata->vif, 5671 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW, 5672 sig, GFP_KERNEL); 5673 } else if (sig > thold && 5674 (last_event == 0 || sig > last_event + hyst)) { 5675 link->u.mgd.last_cqm_event_signal = sig; 5676 ieee80211_cqm_rssi_notify( 5677 &sdata->vif, 5678 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH, 5679 sig, GFP_KERNEL); 5680 } 5681 } 5682 5683 if (bss_conf->cqm_rssi_low && 5684 link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) { 5685 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal); 5686 int last_event = link->u.mgd.last_cqm_event_signal; 5687 int low = bss_conf->cqm_rssi_low; 5688 int high = bss_conf->cqm_rssi_high; 5689 5690 if (sig < low && 5691 (last_event == 0 || last_event >= low)) { 5692 link->u.mgd.last_cqm_event_signal = sig; 5693 ieee80211_cqm_rssi_notify( 5694 &sdata->vif, 5695 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW, 5696 sig, GFP_KERNEL); 5697 } else if (sig > high && 5698 (last_event == 0 || last_event <= high)) { 5699 link->u.mgd.last_cqm_event_signal = sig; 5700 ieee80211_cqm_rssi_notify( 5701 &sdata->vif, 5702 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH, 5703 sig, GFP_KERNEL); 5704 } 5705 } 5706} 5707 5708static bool ieee80211_rx_our_beacon(const u8 *tx_bssid, 5709 struct cfg80211_bss *bss) 5710{ 5711 if (ether_addr_equal(tx_bssid, bss->bssid)) 5712 return true; 5713 if (!bss->transmitted_bss) 5714 return false; 5715 return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid); 5716} 5717 5718static void ieee80211_ml_reconf_work(struct wiphy *wiphy, 5719 struct wiphy_work *work) 5720{ 5721 struct ieee80211_sub_if_data *sdata = 5722 container_of(work, struct ieee80211_sub_if_data, 5723 u.mgd.ml_reconf_work.work); 5724 u16 new_valid_links, new_active_links, new_dormant_links; 5725 int ret; 5726 5727 if (!sdata->u.mgd.removed_links) 5728 return; 5729 5730 sdata_info(sdata, 5731 "MLO Reconfiguration: work: valid=0x%x, removed=0x%x\n", 5732 sdata->vif.valid_links, sdata->u.mgd.removed_links); 5733 5734 new_valid_links = sdata->vif.valid_links & ~sdata->u.mgd.removed_links; 5735 if (new_valid_links == sdata->vif.valid_links) 5736 return; 5737 5738 if (!new_valid_links || 5739 !(new_valid_links & ~sdata->vif.dormant_links)) { 5740 sdata_info(sdata, "No valid links after reconfiguration\n"); 5741 ret = -EINVAL; 5742 goto out; 5743 } 5744 5745 new_active_links = sdata->vif.active_links & ~sdata->u.mgd.removed_links; 5746 if (new_active_links != sdata->vif.active_links) { 5747 if (!new_active_links) 5748 new_active_links = 5749 BIT(ffs(new_valid_links & 5750 ~sdata->vif.dormant_links) - 1); 5751 5752 ret = ieee80211_set_active_links(&sdata->vif, new_active_links); 5753 if (ret) { 5754 sdata_info(sdata, 5755 "Failed setting active links\n"); 5756 goto out; 5757 } 5758 } 5759 5760 new_dormant_links = sdata->vif.dormant_links & ~sdata->u.mgd.removed_links; 5761 5762 ret = ieee80211_vif_set_links(sdata, new_valid_links, 5763 new_dormant_links); 5764 if (ret) 5765 sdata_info(sdata, "Failed setting valid links\n"); 5766 5767 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_MLD_VALID_LINKS); 5768 5769out: 5770 if (!ret) 5771 cfg80211_links_removed(sdata->dev, sdata->u.mgd.removed_links); 5772 else 5773 __ieee80211_disconnect(sdata); 5774 5775 sdata->u.mgd.removed_links = 0; 5776} 5777 5778static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata, 5779 struct ieee802_11_elems *elems) 5780{ 5781 const struct element *sub; 5782 unsigned long removed_links = 0; 5783 u16 link_removal_timeout[IEEE80211_MLD_MAX_NUM_LINKS] = {}; 5784 u8 link_id; 5785 u32 delay; 5786 5787 if (!ieee80211_vif_is_mld(&sdata->vif) || !elems->ml_reconf) 5788 return; 5789 5790 /* Directly parse the sub elements as the common information doesn't 5791 * hold any useful information. 5792 */ 5793 for_each_mle_subelement(sub, (const u8 *)elems->ml_reconf, 5794 elems->ml_reconf_len) { 5795 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data; 5796 u8 *pos = prof->variable; 5797 u16 control; 5798 5799 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE) 5800 continue; 5801 5802 if (!ieee80211_mle_reconf_sta_prof_size_ok(sub->data, 5803 sub->datalen)) 5804 return; 5805 5806 control = le16_to_cpu(prof->control); 5807 link_id = control & IEEE80211_MLE_STA_RECONF_CONTROL_LINK_ID; 5808 5809 removed_links |= BIT(link_id); 5810 5811 /* the MAC address should not be included, but handle it */ 5812 if (control & 5813 IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT) 5814 pos += 6; 5815 5816 /* According to Draft P802.11be_D3.0, the control should 5817 * include the AP Removal Timer present. If the AP Removal Timer 5818 * is not present assume immediate removal. 5819 */ 5820 if (control & 5821 IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT) 5822 link_removal_timeout[link_id] = get_unaligned_le16(pos); 5823 } 5824 5825 removed_links &= sdata->vif.valid_links; 5826 if (!removed_links) { 5827 /* In case the removal was cancelled, abort it */ 5828 if (sdata->u.mgd.removed_links) { 5829 sdata->u.mgd.removed_links = 0; 5830 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, 5831 &sdata->u.mgd.ml_reconf_work); 5832 } 5833 return; 5834 } 5835 5836 delay = 0; 5837 for_each_set_bit(link_id, &removed_links, IEEE80211_MLD_MAX_NUM_LINKS) { 5838 struct ieee80211_bss_conf *link_conf = 5839 sdata_dereference(sdata->vif.link_conf[link_id], sdata); 5840 u32 link_delay; 5841 5842 if (!link_conf) { 5843 removed_links &= ~BIT(link_id); 5844 continue; 5845 } 5846 5847 if (link_removal_timeout[link_id] < 1) 5848 link_delay = 0; 5849 else 5850 link_delay = link_conf->beacon_int * 5851 (link_removal_timeout[link_id] - 1); 5852 5853 if (!delay) 5854 delay = link_delay; 5855 else 5856 delay = min(delay, link_delay); 5857 } 5858 5859 sdata->u.mgd.removed_links = removed_links; 5860 wiphy_delayed_work_queue(sdata->local->hw.wiphy, 5861 &sdata->u.mgd.ml_reconf_work, 5862 TU_TO_JIFFIES(delay)); 5863} 5864 5865static int ieee80211_ttlm_set_links(struct ieee80211_sub_if_data *sdata, 5866 u16 active_links, u16 dormant_links, 5867 u16 suspended_links) 5868{ 5869 u64 changed = 0; 5870 int ret; 5871 5872 if (!active_links) { 5873 ret = -EINVAL; 5874 goto out; 5875 } 5876 5877 /* If there is an active negotiated TTLM, it should be discarded by 5878 * the new negotiated/advertised TTLM. 5879 */ 5880 if (sdata->vif.neg_ttlm.valid) { 5881 memset(&sdata->vif.neg_ttlm, 0, sizeof(sdata->vif.neg_ttlm)); 5882 sdata->vif.suspended_links = 0; 5883 changed = BSS_CHANGED_MLD_TTLM; 5884 } 5885 5886 if (sdata->vif.active_links != active_links) { 5887 /* usable links are affected when active_links are changed, 5888 * so notify the driver about the status change 5889 */ 5890 changed |= BSS_CHANGED_MLD_VALID_LINKS; 5891 active_links &= sdata->vif.active_links; 5892 if (!active_links) 5893 active_links = 5894 BIT(__ffs(sdata->vif.valid_links & 5895 ~dormant_links)); 5896 ret = ieee80211_set_active_links(&sdata->vif, active_links); 5897 if (ret) { 5898 sdata_info(sdata, "Failed to set TTLM active links\n"); 5899 goto out; 5900 } 5901 } 5902 5903 ret = ieee80211_vif_set_links(sdata, sdata->vif.valid_links, 5904 dormant_links); 5905 if (ret) { 5906 sdata_info(sdata, "Failed to set TTLM dormant links\n"); 5907 goto out; 5908 } 5909 5910 sdata->vif.suspended_links = suspended_links; 5911 if (sdata->vif.suspended_links) 5912 changed |= BSS_CHANGED_MLD_TTLM; 5913 5914 ieee80211_vif_cfg_change_notify(sdata, changed); 5915 5916out: 5917 if (ret) 5918 ieee80211_disconnect(&sdata->vif, false); 5919 5920 return ret; 5921} 5922 5923static void ieee80211_tid_to_link_map_work(struct wiphy *wiphy, 5924 struct wiphy_work *work) 5925{ 5926 u16 new_active_links, new_dormant_links; 5927 struct ieee80211_sub_if_data *sdata = 5928 container_of(work, struct ieee80211_sub_if_data, 5929 u.mgd.ttlm_work.work); 5930 5931 new_active_links = sdata->u.mgd.ttlm_info.map & 5932 sdata->vif.valid_links; 5933 new_dormant_links = ~sdata->u.mgd.ttlm_info.map & 5934 sdata->vif.valid_links; 5935 5936 ieee80211_vif_set_links(sdata, sdata->vif.valid_links, 0); 5937 if (ieee80211_ttlm_set_links(sdata, new_active_links, new_dormant_links, 5938 0)) 5939 return; 5940 5941 sdata->u.mgd.ttlm_info.active = true; 5942 sdata->u.mgd.ttlm_info.switch_time = 0; 5943} 5944 5945static u16 ieee80211_get_ttlm(u8 bm_size, u8 *data) 5946{ 5947 if (bm_size == 1) 5948 return *data; 5949 else 5950 return get_unaligned_le16(data); 5951} 5952 5953static int 5954ieee80211_parse_adv_t2l(struct ieee80211_sub_if_data *sdata, 5955 const struct ieee80211_ttlm_elem *ttlm, 5956 struct ieee80211_adv_ttlm_info *ttlm_info) 5957{ 5958 /* The element size was already validated in 5959 * ieee80211_tid_to_link_map_size_ok() 5960 */ 5961 u8 control, link_map_presence, map_size, tid; 5962 u8 *pos; 5963 5964 memset(ttlm_info, 0, sizeof(*ttlm_info)); 5965 pos = (void *)ttlm->optional; 5966 control = ttlm->control; 5967 5968 if ((control & IEEE80211_TTLM_CONTROL_DEF_LINK_MAP) || 5969 !(control & IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT)) 5970 return 0; 5971 5972 if ((control & IEEE80211_TTLM_CONTROL_DIRECTION) != 5973 IEEE80211_TTLM_DIRECTION_BOTH) { 5974 sdata_info(sdata, "Invalid advertised T2L map direction\n"); 5975 return -EINVAL; 5976 } 5977 5978 link_map_presence = *pos; 5979 pos++; 5980 5981 ttlm_info->switch_time = get_unaligned_le16(pos); 5982 5983 /* Since ttlm_info->switch_time == 0 means no switch time, bump it 5984 * by 1. 5985 */ 5986 if (!ttlm_info->switch_time) 5987 ttlm_info->switch_time = 1; 5988 5989 pos += 2; 5990 5991 if (control & IEEE80211_TTLM_CONTROL_EXPECTED_DUR_PRESENT) { 5992 ttlm_info->duration = pos[0] | pos[1] << 8 | pos[2] << 16; 5993 pos += 3; 5994 } 5995 5996 if (control & IEEE80211_TTLM_CONTROL_LINK_MAP_SIZE) 5997 map_size = 1; 5998 else 5999 map_size = 2; 6000 6001 /* According to Draft P802.11be_D3.0 clause 35.3.7.1.7, an AP MLD shall 6002 * not advertise a TID-to-link mapping that does not map all TIDs to the 6003 * same link set, reject frame if not all links have mapping 6004 */ 6005 if (link_map_presence != 0xff) { 6006 sdata_info(sdata, 6007 "Invalid advertised T2L mapping presence indicator\n"); 6008 return -EINVAL; 6009 } 6010 6011 ttlm_info->map = ieee80211_get_ttlm(map_size, pos); 6012 if (!ttlm_info->map) { 6013 sdata_info(sdata, 6014 "Invalid advertised T2L map for TID 0\n"); 6015 return -EINVAL; 6016 } 6017 6018 pos += map_size; 6019 6020 for (tid = 1; tid < 8; tid++) { 6021 u16 map = ieee80211_get_ttlm(map_size, pos); 6022 6023 if (map != ttlm_info->map) { 6024 sdata_info(sdata, "Invalid advertised T2L map for tid %d\n", 6025 tid); 6026 return -EINVAL; 6027 } 6028 6029 pos += map_size; 6030 } 6031 return 0; 6032} 6033 6034static void ieee80211_process_adv_ttlm(struct ieee80211_sub_if_data *sdata, 6035 struct ieee802_11_elems *elems, 6036 u64 beacon_ts) 6037{ 6038 u8 i; 6039 int ret; 6040 6041 if (!ieee80211_vif_is_mld(&sdata->vif)) 6042 return; 6043 6044 if (!elems->ttlm_num) { 6045 if (sdata->u.mgd.ttlm_info.switch_time) { 6046 /* if a planned TID-to-link mapping was cancelled - 6047 * abort it 6048 */ 6049 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, 6050 &sdata->u.mgd.ttlm_work); 6051 } else if (sdata->u.mgd.ttlm_info.active) { 6052 /* if no TID-to-link element, set to default mapping in 6053 * which all TIDs are mapped to all setup links 6054 */ 6055 ret = ieee80211_vif_set_links(sdata, 6056 sdata->vif.valid_links, 6057 0); 6058 if (ret) { 6059 sdata_info(sdata, "Failed setting valid/dormant links\n"); 6060 return; 6061 } 6062 ieee80211_vif_cfg_change_notify(sdata, 6063 BSS_CHANGED_MLD_VALID_LINKS); 6064 } 6065 memset(&sdata->u.mgd.ttlm_info, 0, 6066 sizeof(sdata->u.mgd.ttlm_info)); 6067 return; 6068 } 6069 6070 for (i = 0; i < elems->ttlm_num; i++) { 6071 struct ieee80211_adv_ttlm_info ttlm_info; 6072 u32 res; 6073 6074 res = ieee80211_parse_adv_t2l(sdata, elems->ttlm[i], 6075 &ttlm_info); 6076 6077 if (res) { 6078 __ieee80211_disconnect(sdata); 6079 return; 6080 } 6081 6082 if (ttlm_info.switch_time) { 6083 u16 beacon_ts_tu, st_tu, delay; 6084 u32 delay_jiffies; 6085 u64 mask; 6086 6087 /* The t2l map switch time is indicated with a partial 6088 * TSF value (bits 10 to 25), get the partial beacon TS 6089 * as well, and calc the delay to the start time. 6090 */ 6091 mask = GENMASK_ULL(25, 10); 6092 beacon_ts_tu = (beacon_ts & mask) >> 10; 6093 st_tu = ttlm_info.switch_time; 6094 delay = st_tu - beacon_ts_tu; 6095 6096 /* 6097 * If the switch time is far in the future, then it 6098 * could also be the previous switch still being 6099 * announced. 6100 * We can simply ignore it for now, if it is a future 6101 * switch the AP will continue to announce it anyway. 6102 */ 6103 if (delay > IEEE80211_ADV_TTLM_ST_UNDERFLOW) 6104 return; 6105 6106 delay_jiffies = TU_TO_JIFFIES(delay); 6107 6108 /* Link switching can take time, so schedule it 6109 * 100ms before to be ready on time 6110 */ 6111 if (delay_jiffies > IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS) 6112 delay_jiffies -= 6113 IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS; 6114 else 6115 delay_jiffies = 0; 6116 6117 sdata->u.mgd.ttlm_info = ttlm_info; 6118 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, 6119 &sdata->u.mgd.ttlm_work); 6120 wiphy_delayed_work_queue(sdata->local->hw.wiphy, 6121 &sdata->u.mgd.ttlm_work, 6122 delay_jiffies); 6123 return; 6124 } 6125 } 6126} 6127 6128static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link, 6129 struct ieee80211_hdr *hdr, size_t len, 6130 struct ieee80211_rx_status *rx_status) 6131{ 6132 struct ieee80211_sub_if_data *sdata = link->sdata; 6133 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 6134 struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf; 6135 struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg; 6136 struct ieee80211_mgmt *mgmt = (void *) hdr; 6137 size_t baselen; 6138 struct ieee802_11_elems *elems; 6139 struct ieee80211_local *local = sdata->local; 6140 struct ieee80211_chanctx_conf *chanctx_conf; 6141 struct ieee80211_supported_band *sband; 6142 struct ieee80211_channel *chan; 6143 struct link_sta_info *link_sta; 6144 struct sta_info *sta; 6145 u64 changed = 0; 6146 bool erp_valid; 6147 u8 erp_value = 0; 6148 u32 ncrc = 0; 6149 u8 *bssid, *variable = mgmt->u.beacon.variable; 6150 u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN]; 6151 struct ieee80211_elems_parse_params parse_params = { 6152 .mode = link->u.mgd.conn.mode, 6153 .link_id = -1, 6154 .from_ap = true, 6155 }; 6156 6157 lockdep_assert_wiphy(local->hw.wiphy); 6158 6159 /* Process beacon from the current BSS */ 6160 bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type); 6161 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) { 6162 struct ieee80211_ext *ext = (void *) mgmt; 6163 6164 if (ieee80211_is_s1g_short_beacon(ext->frame_control)) 6165 variable = ext->u.s1g_short_beacon.variable; 6166 else 6167 variable = ext->u.s1g_beacon.variable; 6168 } 6169 6170 baselen = (u8 *) variable - (u8 *) mgmt; 6171 if (baselen > len) 6172 return; 6173 6174 parse_params.start = variable; 6175 parse_params.len = len - baselen; 6176 6177 rcu_read_lock(); 6178 chanctx_conf = rcu_dereference(link->conf->chanctx_conf); 6179 if (!chanctx_conf) { 6180 rcu_read_unlock(); 6181 return; 6182 } 6183 6184 if (ieee80211_rx_status_to_khz(rx_status) != 6185 ieee80211_channel_to_khz(chanctx_conf->def.chan)) { 6186 rcu_read_unlock(); 6187 return; 6188 } 6189 chan = chanctx_conf->def.chan; 6190 rcu_read_unlock(); 6191 6192 if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon && 6193 !WARN_ON(ieee80211_vif_is_mld(&sdata->vif)) && 6194 ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) { 6195 parse_params.bss = ifmgd->assoc_data->link[0].bss; 6196 elems = ieee802_11_parse_elems_full(&parse_params); 6197 if (!elems) 6198 return; 6199 6200 ieee80211_rx_bss_info(link, mgmt, len, rx_status); 6201 6202 if (elems->dtim_period) 6203 link->u.mgd.dtim_period = elems->dtim_period; 6204 link->u.mgd.have_beacon = true; 6205 ifmgd->assoc_data->need_beacon = false; 6206 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) && 6207 !ieee80211_is_s1g_beacon(hdr->frame_control)) { 6208 link->conf->sync_tsf = 6209 le64_to_cpu(mgmt->u.beacon.timestamp); 6210 link->conf->sync_device_ts = 6211 rx_status->device_timestamp; 6212 link->conf->sync_dtim_count = elems->dtim_count; 6213 } 6214 6215 if (elems->mbssid_config_ie) 6216 bss_conf->profile_periodicity = 6217 elems->mbssid_config_ie->profile_periodicity; 6218 else 6219 bss_conf->profile_periodicity = 0; 6220 6221 if (elems->ext_capab_len >= 11 && 6222 (elems->ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT)) 6223 bss_conf->ema_ap = true; 6224 else 6225 bss_conf->ema_ap = false; 6226 6227 /* continue assoc process */ 6228 ifmgd->assoc_data->timeout = jiffies; 6229 ifmgd->assoc_data->timeout_started = true; 6230 run_again(sdata, ifmgd->assoc_data->timeout); 6231 kfree(elems); 6232 return; 6233 } 6234 6235 if (!ifmgd->associated || 6236 !ieee80211_rx_our_beacon(bssid, link->conf->bss)) 6237 return; 6238 bssid = link->u.mgd.bssid; 6239 6240 if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL)) 6241 ieee80211_handle_beacon_sig(link, ifmgd, bss_conf, 6242 local, rx_status); 6243 6244 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) { 6245 mlme_dbg_ratelimited(sdata, 6246 "cancelling AP probe due to a received beacon\n"); 6247 ieee80211_reset_ap_probe(sdata); 6248 } 6249 6250 /* 6251 * Push the beacon loss detection into the future since 6252 * we are processing a beacon from the AP just now. 6253 */ 6254 ieee80211_sta_reset_beacon_monitor(sdata); 6255 6256 /* TODO: CRC urrently not calculated on S1G Beacon Compatibility 6257 * element (which carries the beacon interval). Don't forget to add a 6258 * bit to care_about_ies[] above if mac80211 is interested in a 6259 * changing S1G element. 6260 */ 6261 if (!ieee80211_is_s1g_beacon(hdr->frame_control)) 6262 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4); 6263 parse_params.bss = link->conf->bss; 6264 parse_params.filter = care_about_ies; 6265 parse_params.crc = ncrc; 6266 elems = ieee802_11_parse_elems_full(&parse_params); 6267 if (!elems) 6268 return; 6269 ncrc = elems->crc; 6270 6271 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) && 6272 ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid)) { 6273 if (local->hw.conf.dynamic_ps_timeout > 0) { 6274 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 6275 local->hw.conf.flags &= ~IEEE80211_CONF_PS; 6276 ieee80211_hw_config(local, 6277 IEEE80211_CONF_CHANGE_PS); 6278 } 6279 ieee80211_send_nullfunc(local, sdata, false); 6280 } else if (!local->pspolling && sdata->u.mgd.powersave) { 6281 local->pspolling = true; 6282 6283 /* 6284 * Here is assumed that the driver will be 6285 * able to send ps-poll frame and receive a 6286 * response even though power save mode is 6287 * enabled, but some drivers might require 6288 * to disable power save here. This needs 6289 * to be investigated. 6290 */ 6291 ieee80211_send_pspoll(local, sdata); 6292 } 6293 } 6294 6295 if (sdata->vif.p2p || 6296 sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) { 6297 struct ieee80211_p2p_noa_attr noa = {}; 6298 int ret; 6299 6300 ret = cfg80211_get_p2p_attr(variable, 6301 len - baselen, 6302 IEEE80211_P2P_ATTR_ABSENCE_NOTICE, 6303 (u8 *) &noa, sizeof(noa)); 6304 if (ret >= 2) { 6305 if (link->u.mgd.p2p_noa_index != noa.index) { 6306 /* valid noa_attr and index changed */ 6307 link->u.mgd.p2p_noa_index = noa.index; 6308 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa)); 6309 changed |= BSS_CHANGED_P2P_PS; 6310 /* 6311 * make sure we update all information, the CRC 6312 * mechanism doesn't look at P2P attributes. 6313 */ 6314 link->u.mgd.beacon_crc_valid = false; 6315 } 6316 } else if (link->u.mgd.p2p_noa_index != -1) { 6317 /* noa_attr not found and we had valid noa_attr before */ 6318 link->u.mgd.p2p_noa_index = -1; 6319 memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr)); 6320 changed |= BSS_CHANGED_P2P_PS; 6321 link->u.mgd.beacon_crc_valid = false; 6322 } 6323 } 6324 6325 /* 6326 * Update beacon timing and dtim count on every beacon appearance. This 6327 * will allow the driver to use the most updated values. Do it before 6328 * comparing this one with last received beacon. 6329 * IMPORTANT: These parameters would possibly be out of sync by the time 6330 * the driver will use them. The synchronized view is currently 6331 * guaranteed only in certain callbacks. 6332 */ 6333 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) && 6334 !ieee80211_is_s1g_beacon(hdr->frame_control)) { 6335 link->conf->sync_tsf = 6336 le64_to_cpu(mgmt->u.beacon.timestamp); 6337 link->conf->sync_device_ts = 6338 rx_status->device_timestamp; 6339 link->conf->sync_dtim_count = elems->dtim_count; 6340 } 6341 6342 if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) || 6343 ieee80211_is_s1g_short_beacon(mgmt->frame_control)) 6344 goto free; 6345 link->u.mgd.beacon_crc = ncrc; 6346 link->u.mgd.beacon_crc_valid = true; 6347 6348 ieee80211_rx_bss_info(link, mgmt, len, rx_status); 6349 6350 ieee80211_sta_process_chanswitch(link, rx_status->mactime, 6351 rx_status->device_timestamp, 6352 elems, true); 6353 6354 if (!link->u.mgd.disable_wmm_tracking && 6355 ieee80211_sta_wmm_params(local, link, elems->wmm_param, 6356 elems->wmm_param_len, 6357 elems->mu_edca_param_set)) 6358 changed |= BSS_CHANGED_QOS; 6359 6360 /* 6361 * If we haven't had a beacon before, tell the driver about the 6362 * DTIM period (and beacon timing if desired) now. 6363 */ 6364 if (!link->u.mgd.have_beacon) { 6365 /* a few bogus AP send dtim_period = 0 or no TIM IE */ 6366 bss_conf->dtim_period = elems->dtim_period ?: 1; 6367 6368 changed |= BSS_CHANGED_BEACON_INFO; 6369 link->u.mgd.have_beacon = true; 6370 6371 ieee80211_recalc_ps(local); 6372 6373 ieee80211_recalc_ps_vif(sdata); 6374 } 6375 6376 if (elems->erp_info) { 6377 erp_valid = true; 6378 erp_value = elems->erp_info[0]; 6379 } else { 6380 erp_valid = false; 6381 } 6382 6383 if (!ieee80211_is_s1g_beacon(hdr->frame_control)) 6384 changed |= ieee80211_handle_bss_capability(link, 6385 le16_to_cpu(mgmt->u.beacon.capab_info), 6386 erp_valid, erp_value); 6387 6388 sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr); 6389 if (WARN_ON(!sta)) { 6390 goto free; 6391 } 6392 link_sta = rcu_dereference_protected(sta->link[link->link_id], 6393 lockdep_is_held(&local->hw.wiphy->mtx)); 6394 if (WARN_ON(!link_sta)) { 6395 goto free; 6396 } 6397 6398 if (WARN_ON(!link->conf->chanreq.oper.chan)) 6399 goto free; 6400 6401 sband = local->hw.wiphy->bands[link->conf->chanreq.oper.chan->band]; 6402 6403 changed |= ieee80211_recalc_twt_req(sdata, sband, link, link_sta, elems); 6404 6405 if (ieee80211_config_bw(link, elems, true, &changed)) { 6406 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, 6407 WLAN_REASON_DEAUTH_LEAVING, 6408 true, deauth_buf); 6409 ieee80211_report_disconnect(sdata, deauth_buf, 6410 sizeof(deauth_buf), true, 6411 WLAN_REASON_DEAUTH_LEAVING, 6412 false); 6413 goto free; 6414 } 6415 6416 if (elems->opmode_notif) 6417 ieee80211_vht_handle_opmode(sdata, link_sta, 6418 *elems->opmode_notif, 6419 rx_status->band); 6420 6421 changed |= ieee80211_handle_pwr_constr(link, chan, mgmt, 6422 elems->country_elem, 6423 elems->country_elem_len, 6424 elems->pwr_constr_elem, 6425 elems->cisco_dtpc_elem); 6426 6427 ieee80211_ml_reconfiguration(sdata, elems); 6428 ieee80211_process_adv_ttlm(sdata, elems, 6429 le64_to_cpu(mgmt->u.beacon.timestamp)); 6430 6431 ieee80211_link_info_change_notify(sdata, link, changed); 6432free: 6433 kfree(elems); 6434} 6435 6436static void ieee80211_apply_neg_ttlm(struct ieee80211_sub_if_data *sdata, 6437 struct ieee80211_neg_ttlm neg_ttlm) 6438{ 6439 u16 new_active_links, new_dormant_links, new_suspended_links, map = 0; 6440 u8 i; 6441 6442 for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) 6443 map |= neg_ttlm.downlink[i] | neg_ttlm.uplink[i]; 6444 6445 /* If there is an active TTLM, unset previously suspended links */ 6446 if (sdata->vif.neg_ttlm.valid) 6447 sdata->vif.dormant_links &= ~sdata->vif.suspended_links; 6448 6449 /* exclude links that are already disabled by advertised TTLM */ 6450 new_active_links = 6451 map & sdata->vif.valid_links & ~sdata->vif.dormant_links; 6452 new_suspended_links = 6453 (~map & sdata->vif.valid_links) & ~sdata->vif.dormant_links; 6454 new_dormant_links = sdata->vif.dormant_links | new_suspended_links; 6455 if (ieee80211_ttlm_set_links(sdata, new_active_links, 6456 new_dormant_links, new_suspended_links)) 6457 return; 6458 6459 sdata->vif.neg_ttlm = neg_ttlm; 6460 sdata->vif.neg_ttlm.valid = true; 6461} 6462 6463static void ieee80211_neg_ttlm_timeout_work(struct wiphy *wiphy, 6464 struct wiphy_work *work) 6465{ 6466 struct ieee80211_sub_if_data *sdata = 6467 container_of(work, struct ieee80211_sub_if_data, 6468 u.mgd.neg_ttlm_timeout_work.work); 6469 6470 sdata_info(sdata, 6471 "No negotiated TTLM response from AP, disconnecting.\n"); 6472 6473 __ieee80211_disconnect(sdata); 6474} 6475 6476static void 6477ieee80211_neg_ttlm_add_suggested_map(struct sk_buff *skb, 6478 struct ieee80211_neg_ttlm *neg_ttlm) 6479{ 6480 u8 i, direction[IEEE80211_TTLM_MAX_CNT]; 6481 6482 if (memcmp(neg_ttlm->downlink, neg_ttlm->uplink, 6483 sizeof(neg_ttlm->downlink))) { 6484 direction[0] = IEEE80211_TTLM_DIRECTION_DOWN; 6485 direction[1] = IEEE80211_TTLM_DIRECTION_UP; 6486 } else { 6487 direction[0] = IEEE80211_TTLM_DIRECTION_BOTH; 6488 } 6489 6490 for (i = 0; i < ARRAY_SIZE(direction); i++) { 6491 u8 tid, len, map_ind = 0, *len_pos, *map_ind_pos, *pos; 6492 __le16 map; 6493 6494 len = sizeof(struct ieee80211_ttlm_elem) + 1 + 1; 6495 6496 pos = skb_put(skb, len + 2); 6497 *pos++ = WLAN_EID_EXTENSION; 6498 len_pos = pos++; 6499 *pos++ = WLAN_EID_EXT_TID_TO_LINK_MAPPING; 6500 *pos++ = direction[i]; 6501 map_ind_pos = pos++; 6502 for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) { 6503 map = direction[i] == IEEE80211_TTLM_DIRECTION_UP ? 6504 cpu_to_le16(neg_ttlm->uplink[tid]) : 6505 cpu_to_le16(neg_ttlm->downlink[tid]); 6506 if (!map) 6507 continue; 6508 6509 len += 2; 6510 map_ind |= BIT(tid); 6511 skb_put_data(skb, &map, sizeof(map)); 6512 } 6513 6514 *map_ind_pos = map_ind; 6515 *len_pos = len; 6516 6517 if (direction[i] == IEEE80211_TTLM_DIRECTION_BOTH) 6518 break; 6519 } 6520} 6521 6522static void 6523ieee80211_send_neg_ttlm_req(struct ieee80211_sub_if_data *sdata, 6524 struct ieee80211_neg_ttlm *neg_ttlm, 6525 u8 dialog_token) 6526{ 6527 struct ieee80211_local *local = sdata->local; 6528 struct ieee80211_mgmt *mgmt; 6529 struct sk_buff *skb; 6530 int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.ttlm_req); 6531 int ttlm_max_len = 2 + 1 + sizeof(struct ieee80211_ttlm_elem) + 1 + 6532 2 * 2 * IEEE80211_TTLM_NUM_TIDS; 6533 6534 skb = dev_alloc_skb(local->tx_headroom + hdr_len + ttlm_max_len); 6535 if (!skb) 6536 return; 6537 6538 skb_reserve(skb, local->tx_headroom); 6539 mgmt = skb_put_zero(skb, hdr_len); 6540 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 6541 IEEE80211_STYPE_ACTION); 6542 memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN); 6543 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN); 6544 memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN); 6545 6546 mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT; 6547 mgmt->u.action.u.ttlm_req.action_code = 6548 WLAN_PROTECTED_EHT_ACTION_TTLM_REQ; 6549 mgmt->u.action.u.ttlm_req.dialog_token = dialog_token; 6550 ieee80211_neg_ttlm_add_suggested_map(skb, neg_ttlm); 6551 ieee80211_tx_skb(sdata, skb); 6552} 6553 6554int ieee80211_req_neg_ttlm(struct ieee80211_sub_if_data *sdata, 6555 struct cfg80211_ttlm_params *params) 6556{ 6557 struct ieee80211_neg_ttlm neg_ttlm = {}; 6558 u8 i; 6559 6560 if (!ieee80211_vif_is_mld(&sdata->vif) || 6561 !(sdata->vif.cfg.mld_capa_op & 6562 IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP)) 6563 return -EINVAL; 6564 6565 for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) { 6566 if ((params->dlink[i] & ~sdata->vif.valid_links) || 6567 (params->ulink[i] & ~sdata->vif.valid_links)) 6568 return -EINVAL; 6569 6570 neg_ttlm.downlink[i] = params->dlink[i]; 6571 neg_ttlm.uplink[i] = params->ulink[i]; 6572 } 6573 6574 if (drv_can_neg_ttlm(sdata->local, sdata, &neg_ttlm) != 6575 NEG_TTLM_RES_ACCEPT) 6576 return -EINVAL; 6577 6578 ieee80211_apply_neg_ttlm(sdata, neg_ttlm); 6579 sdata->u.mgd.dialog_token_alloc++; 6580 ieee80211_send_neg_ttlm_req(sdata, &sdata->vif.neg_ttlm, 6581 sdata->u.mgd.dialog_token_alloc); 6582 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, 6583 &sdata->u.mgd.neg_ttlm_timeout_work); 6584 wiphy_delayed_work_queue(sdata->local->hw.wiphy, 6585 &sdata->u.mgd.neg_ttlm_timeout_work, 6586 IEEE80211_NEG_TTLM_REQ_TIMEOUT); 6587 return 0; 6588} 6589 6590static void 6591ieee80211_send_neg_ttlm_res(struct ieee80211_sub_if_data *sdata, 6592 enum ieee80211_neg_ttlm_res ttlm_res, 6593 u8 dialog_token, 6594 struct ieee80211_neg_ttlm *neg_ttlm) 6595{ 6596 struct ieee80211_local *local = sdata->local; 6597 struct ieee80211_mgmt *mgmt; 6598 struct sk_buff *skb; 6599 int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.ttlm_res); 6600 int ttlm_max_len = 2 + 1 + sizeof(struct ieee80211_ttlm_elem) + 1 + 6601 2 * 2 * IEEE80211_TTLM_NUM_TIDS; 6602 6603 skb = dev_alloc_skb(local->tx_headroom + hdr_len + ttlm_max_len); 6604 if (!skb) 6605 return; 6606 6607 skb_reserve(skb, local->tx_headroom); 6608 mgmt = skb_put_zero(skb, hdr_len); 6609 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 6610 IEEE80211_STYPE_ACTION); 6611 memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN); 6612 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN); 6613 memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN); 6614 6615 mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT; 6616 mgmt->u.action.u.ttlm_res.action_code = 6617 WLAN_PROTECTED_EHT_ACTION_TTLM_RES; 6618 mgmt->u.action.u.ttlm_res.dialog_token = dialog_token; 6619 switch (ttlm_res) { 6620 default: 6621 WARN_ON(1); 6622 fallthrough; 6623 case NEG_TTLM_RES_REJECT: 6624 mgmt->u.action.u.ttlm_res.status_code = 6625 WLAN_STATUS_DENIED_TID_TO_LINK_MAPPING; 6626 break; 6627 case NEG_TTLM_RES_ACCEPT: 6628 mgmt->u.action.u.ttlm_res.status_code = WLAN_STATUS_SUCCESS; 6629 break; 6630 case NEG_TTLM_RES_SUGGEST_PREFERRED: 6631 mgmt->u.action.u.ttlm_res.status_code = 6632 WLAN_STATUS_PREF_TID_TO_LINK_MAPPING_SUGGESTED; 6633 ieee80211_neg_ttlm_add_suggested_map(skb, neg_ttlm); 6634 break; 6635 } 6636 6637 ieee80211_tx_skb(sdata, skb); 6638} 6639 6640static int 6641ieee80211_parse_neg_ttlm(struct ieee80211_sub_if_data *sdata, 6642 const struct ieee80211_ttlm_elem *ttlm, 6643 struct ieee80211_neg_ttlm *neg_ttlm, 6644 u8 *direction) 6645{ 6646 u8 control, link_map_presence, map_size, tid; 6647 u8 *pos; 6648 6649 /* The element size was already validated in 6650 * ieee80211_tid_to_link_map_size_ok() 6651 */ 6652 pos = (void *)ttlm->optional; 6653 6654 control = ttlm->control; 6655 6656 /* mapping switch time and expected duration fields are not expected 6657 * in case of negotiated TTLM 6658 */ 6659 if (control & (IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT | 6660 IEEE80211_TTLM_CONTROL_EXPECTED_DUR_PRESENT)) { 6661 mlme_dbg(sdata, 6662 "Invalid TTLM element in negotiated TTLM request\n"); 6663 return -EINVAL; 6664 } 6665 6666 if (control & IEEE80211_TTLM_CONTROL_DEF_LINK_MAP) { 6667 for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) { 6668 neg_ttlm->downlink[tid] = sdata->vif.valid_links; 6669 neg_ttlm->uplink[tid] = sdata->vif.valid_links; 6670 } 6671 *direction = IEEE80211_TTLM_DIRECTION_BOTH; 6672 return 0; 6673 } 6674 6675 *direction = u8_get_bits(control, IEEE80211_TTLM_CONTROL_DIRECTION); 6676 if (*direction != IEEE80211_TTLM_DIRECTION_DOWN && 6677 *direction != IEEE80211_TTLM_DIRECTION_UP && 6678 *direction != IEEE80211_TTLM_DIRECTION_BOTH) 6679 return -EINVAL; 6680 6681 link_map_presence = *pos; 6682 pos++; 6683 6684 if (control & IEEE80211_TTLM_CONTROL_LINK_MAP_SIZE) 6685 map_size = 1; 6686 else 6687 map_size = 2; 6688 6689 for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) { 6690 u16 map; 6691 6692 if (link_map_presence & BIT(tid)) { 6693 map = ieee80211_get_ttlm(map_size, pos); 6694 if (!map) { 6695 mlme_dbg(sdata, 6696 "No active links for TID %d", tid); 6697 return -EINVAL; 6698 } 6699 } else { 6700 map = 0; 6701 } 6702 6703 switch (*direction) { 6704 case IEEE80211_TTLM_DIRECTION_BOTH: 6705 neg_ttlm->downlink[tid] = map; 6706 neg_ttlm->uplink[tid] = map; 6707 break; 6708 case IEEE80211_TTLM_DIRECTION_DOWN: 6709 neg_ttlm->downlink[tid] = map; 6710 break; 6711 case IEEE80211_TTLM_DIRECTION_UP: 6712 neg_ttlm->uplink[tid] = map; 6713 break; 6714 default: 6715 return -EINVAL; 6716 } 6717 pos += map_size; 6718 } 6719 return 0; 6720} 6721 6722void ieee80211_process_neg_ttlm_req(struct ieee80211_sub_if_data *sdata, 6723 struct ieee80211_mgmt *mgmt, size_t len) 6724{ 6725 u8 dialog_token, direction[IEEE80211_TTLM_MAX_CNT] = {}, i; 6726 size_t ies_len; 6727 enum ieee80211_neg_ttlm_res ttlm_res = NEG_TTLM_RES_ACCEPT; 6728 struct ieee802_11_elems *elems = NULL; 6729 struct ieee80211_neg_ttlm neg_ttlm = {}; 6730 6731 BUILD_BUG_ON(ARRAY_SIZE(direction) != ARRAY_SIZE(elems->ttlm)); 6732 6733 if (!ieee80211_vif_is_mld(&sdata->vif)) 6734 return; 6735 6736 dialog_token = mgmt->u.action.u.ttlm_req.dialog_token; 6737 ies_len = len - offsetof(struct ieee80211_mgmt, 6738 u.action.u.ttlm_req.variable); 6739 elems = ieee802_11_parse_elems(mgmt->u.action.u.ttlm_req.variable, 6740 ies_len, true, NULL); 6741 if (!elems) { 6742 ttlm_res = NEG_TTLM_RES_REJECT; 6743 goto out; 6744 } 6745 6746 for (i = 0; i < elems->ttlm_num; i++) { 6747 if (ieee80211_parse_neg_ttlm(sdata, elems->ttlm[i], 6748 &neg_ttlm, &direction[i]) || 6749 (direction[i] == IEEE80211_TTLM_DIRECTION_BOTH && 6750 elems->ttlm_num != 1)) { 6751 ttlm_res = NEG_TTLM_RES_REJECT; 6752 goto out; 6753 } 6754 } 6755 6756 if (!elems->ttlm_num || 6757 (elems->ttlm_num == 2 && direction[0] == direction[1])) { 6758 ttlm_res = NEG_TTLM_RES_REJECT; 6759 goto out; 6760 } 6761 6762 for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) { 6763 if ((neg_ttlm.downlink[i] && 6764 (neg_ttlm.downlink[i] & ~sdata->vif.valid_links)) || 6765 (neg_ttlm.uplink[i] && 6766 (neg_ttlm.uplink[i] & ~sdata->vif.valid_links))) { 6767 ttlm_res = NEG_TTLM_RES_REJECT; 6768 goto out; 6769 } 6770 } 6771 6772 ttlm_res = drv_can_neg_ttlm(sdata->local, sdata, &neg_ttlm); 6773 6774 if (ttlm_res != NEG_TTLM_RES_ACCEPT) 6775 goto out; 6776 6777 ieee80211_apply_neg_ttlm(sdata, neg_ttlm); 6778out: 6779 kfree(elems); 6780 ieee80211_send_neg_ttlm_res(sdata, ttlm_res, dialog_token, &neg_ttlm); 6781} 6782 6783void ieee80211_process_neg_ttlm_res(struct ieee80211_sub_if_data *sdata, 6784 struct ieee80211_mgmt *mgmt, size_t len) 6785{ 6786 if (!ieee80211_vif_is_mld(&sdata->vif) || 6787 mgmt->u.action.u.ttlm_req.dialog_token != 6788 sdata->u.mgd.dialog_token_alloc) 6789 return; 6790 6791 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, 6792 &sdata->u.mgd.neg_ttlm_timeout_work); 6793 6794 /* MLD station sends a TID to link mapping request, mainly to handle 6795 * BTM (BSS transition management) request, in which case it needs to 6796 * restrict the active links set. 6797 * In this case it's not expected that the MLD AP will reject the 6798 * negotiated TTLM request. 6799 * This can be better implemented in the future, to handle request 6800 * rejections. 6801 */ 6802 if (mgmt->u.action.u.ttlm_res.status_code != WLAN_STATUS_SUCCESS) 6803 __ieee80211_disconnect(sdata); 6804} 6805 6806void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata, 6807 struct sk_buff *skb) 6808{ 6809 struct ieee80211_link_data *link = &sdata->deflink; 6810 struct ieee80211_rx_status *rx_status; 6811 struct ieee80211_hdr *hdr; 6812 u16 fc; 6813 6814 lockdep_assert_wiphy(sdata->local->hw.wiphy); 6815 6816 rx_status = (struct ieee80211_rx_status *) skb->cb; 6817 hdr = (struct ieee80211_hdr *) skb->data; 6818 fc = le16_to_cpu(hdr->frame_control); 6819 6820 switch (fc & IEEE80211_FCTL_STYPE) { 6821 case IEEE80211_STYPE_S1G_BEACON: 6822 ieee80211_rx_mgmt_beacon(link, hdr, skb->len, rx_status); 6823 break; 6824 } 6825} 6826 6827void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, 6828 struct sk_buff *skb) 6829{ 6830 struct ieee80211_link_data *link = &sdata->deflink; 6831 struct ieee80211_rx_status *rx_status; 6832 struct ieee80211_mgmt *mgmt; 6833 u16 fc; 6834 int ies_len; 6835 6836 lockdep_assert_wiphy(sdata->local->hw.wiphy); 6837 6838 rx_status = (struct ieee80211_rx_status *) skb->cb; 6839 mgmt = (struct ieee80211_mgmt *) skb->data; 6840 fc = le16_to_cpu(mgmt->frame_control); 6841 6842 if (rx_status->link_valid) { 6843 link = sdata_dereference(sdata->link[rx_status->link_id], 6844 sdata); 6845 if (!link) 6846 return; 6847 } 6848 6849 switch (fc & IEEE80211_FCTL_STYPE) { 6850 case IEEE80211_STYPE_BEACON: 6851 ieee80211_rx_mgmt_beacon(link, (void *)mgmt, 6852 skb->len, rx_status); 6853 break; 6854 case IEEE80211_STYPE_PROBE_RESP: 6855 ieee80211_rx_mgmt_probe_resp(link, skb); 6856 break; 6857 case IEEE80211_STYPE_AUTH: 6858 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len); 6859 break; 6860 case IEEE80211_STYPE_DEAUTH: 6861 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len); 6862 break; 6863 case IEEE80211_STYPE_DISASSOC: 6864 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len); 6865 break; 6866 case IEEE80211_STYPE_ASSOC_RESP: 6867 case IEEE80211_STYPE_REASSOC_RESP: 6868 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len); 6869 break; 6870 case IEEE80211_STYPE_ACTION: 6871 if (!sdata->u.mgd.associated || 6872 !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) 6873 break; 6874 6875 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) { 6876 struct ieee802_11_elems *elems; 6877 6878 ies_len = skb->len - 6879 offsetof(struct ieee80211_mgmt, 6880 u.action.u.chan_switch.variable); 6881 6882 if (ies_len < 0) 6883 break; 6884 6885 /* CSA IE cannot be overridden, no need for BSSID */ 6886 elems = ieee802_11_parse_elems( 6887 mgmt->u.action.u.chan_switch.variable, 6888 ies_len, true, NULL); 6889 6890 if (elems && !elems->parse_error) 6891 ieee80211_sta_process_chanswitch(link, 6892 rx_status->mactime, 6893 rx_status->device_timestamp, 6894 elems, false); 6895 kfree(elems); 6896 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) { 6897 struct ieee802_11_elems *elems; 6898 6899 ies_len = skb->len - 6900 offsetof(struct ieee80211_mgmt, 6901 u.action.u.ext_chan_switch.variable); 6902 6903 if (ies_len < 0) 6904 break; 6905 6906 /* 6907 * extended CSA IE can't be overridden, no need for 6908 * BSSID 6909 */ 6910 elems = ieee802_11_parse_elems( 6911 mgmt->u.action.u.ext_chan_switch.variable, 6912 ies_len, true, NULL); 6913 6914 if (elems && !elems->parse_error) { 6915 /* for the handling code pretend it was an IE */ 6916 elems->ext_chansw_ie = 6917 &mgmt->u.action.u.ext_chan_switch.data; 6918 6919 ieee80211_sta_process_chanswitch(link, 6920 rx_status->mactime, 6921 rx_status->device_timestamp, 6922 elems, false); 6923 } 6924 6925 kfree(elems); 6926 } 6927 break; 6928 } 6929} 6930 6931static void ieee80211_sta_timer(struct timer_list *t) 6932{ 6933 struct ieee80211_sub_if_data *sdata = 6934 from_timer(sdata, t, u.mgd.timer); 6935 6936 wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work); 6937} 6938 6939void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata, 6940 u8 reason, bool tx) 6941{ 6942 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 6943 6944 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason, 6945 tx, frame_buf); 6946 6947 ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true, 6948 reason, false); 6949} 6950 6951static int ieee80211_auth(struct ieee80211_sub_if_data *sdata) 6952{ 6953 struct ieee80211_local *local = sdata->local; 6954 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 6955 struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data; 6956 u32 tx_flags = 0; 6957 u16 trans = 1; 6958 u16 status = 0; 6959 struct ieee80211_prep_tx_info info = { 6960 .subtype = IEEE80211_STYPE_AUTH, 6961 }; 6962 6963 lockdep_assert_wiphy(sdata->local->hw.wiphy); 6964 6965 if (WARN_ON_ONCE(!auth_data)) 6966 return -EINVAL; 6967 6968 auth_data->tries++; 6969 6970 if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) { 6971 sdata_info(sdata, "authentication with %pM timed out\n", 6972 auth_data->ap_addr); 6973 6974 /* 6975 * Most likely AP is not in the range so remove the 6976 * bss struct for that AP. 6977 */ 6978 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss); 6979 6980 return -ETIMEDOUT; 6981 } 6982 6983 if (auth_data->algorithm == WLAN_AUTH_SAE) 6984 info.duration = jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE); 6985 6986 info.link_id = auth_data->link_id; 6987 drv_mgd_prepare_tx(local, sdata, &info); 6988 6989 sdata_info(sdata, "send auth to %pM (try %d/%d)\n", 6990 auth_data->ap_addr, auth_data->tries, 6991 IEEE80211_AUTH_MAX_TRIES); 6992 6993 auth_data->expected_transaction = 2; 6994 6995 if (auth_data->algorithm == WLAN_AUTH_SAE) { 6996 trans = auth_data->sae_trans; 6997 status = auth_data->sae_status; 6998 auth_data->expected_transaction = trans; 6999 } 7000 7001 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) 7002 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS | 7003 IEEE80211_TX_INTFL_MLME_CONN_TX; 7004 7005 ieee80211_send_auth(sdata, trans, auth_data->algorithm, status, 7006 auth_data->data, auth_data->data_len, 7007 auth_data->ap_addr, auth_data->ap_addr, 7008 NULL, 0, 0, tx_flags); 7009 7010 if (tx_flags == 0) { 7011 if (auth_data->algorithm == WLAN_AUTH_SAE) 7012 auth_data->timeout = jiffies + 7013 IEEE80211_AUTH_TIMEOUT_SAE; 7014 else 7015 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT; 7016 } else { 7017 auth_data->timeout = 7018 round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG); 7019 } 7020 7021 auth_data->timeout_started = true; 7022 run_again(sdata, auth_data->timeout); 7023 7024 return 0; 7025} 7026 7027static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata) 7028{ 7029 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data; 7030 struct ieee80211_local *local = sdata->local; 7031 int ret; 7032 7033 lockdep_assert_wiphy(sdata->local->hw.wiphy); 7034 7035 assoc_data->tries++; 7036 if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) { 7037 sdata_info(sdata, "association with %pM timed out\n", 7038 assoc_data->ap_addr); 7039 7040 /* 7041 * Most likely AP is not in the range so remove the 7042 * bss struct for that AP. 7043 */ 7044 cfg80211_unlink_bss(local->hw.wiphy, 7045 assoc_data->link[assoc_data->assoc_link_id].bss); 7046 7047 return -ETIMEDOUT; 7048 } 7049 7050 sdata_info(sdata, "associate with %pM (try %d/%d)\n", 7051 assoc_data->ap_addr, assoc_data->tries, 7052 IEEE80211_ASSOC_MAX_TRIES); 7053 ret = ieee80211_send_assoc(sdata); 7054 if (ret) 7055 return ret; 7056 7057 if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) { 7058 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT; 7059 assoc_data->timeout_started = true; 7060 run_again(sdata, assoc_data->timeout); 7061 } else { 7062 assoc_data->timeout = 7063 round_jiffies_up(jiffies + 7064 IEEE80211_ASSOC_TIMEOUT_LONG); 7065 assoc_data->timeout_started = true; 7066 run_again(sdata, assoc_data->timeout); 7067 } 7068 7069 return 0; 7070} 7071 7072void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata, 7073 __le16 fc, bool acked) 7074{ 7075 struct ieee80211_local *local = sdata->local; 7076 7077 sdata->u.mgd.status_fc = fc; 7078 sdata->u.mgd.status_acked = acked; 7079 sdata->u.mgd.status_received = true; 7080 7081 wiphy_work_queue(local->hw.wiphy, &sdata->work); 7082} 7083 7084void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata) 7085{ 7086 struct ieee80211_local *local = sdata->local; 7087 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 7088 7089 lockdep_assert_wiphy(sdata->local->hw.wiphy); 7090 7091 if (ifmgd->status_received) { 7092 __le16 fc = ifmgd->status_fc; 7093 bool status_acked = ifmgd->status_acked; 7094 7095 ifmgd->status_received = false; 7096 if (ifmgd->auth_data && ieee80211_is_auth(fc)) { 7097 if (status_acked) { 7098 if (ifmgd->auth_data->algorithm == 7099 WLAN_AUTH_SAE) 7100 ifmgd->auth_data->timeout = 7101 jiffies + 7102 IEEE80211_AUTH_TIMEOUT_SAE; 7103 else 7104 ifmgd->auth_data->timeout = 7105 jiffies + 7106 IEEE80211_AUTH_TIMEOUT_SHORT; 7107 run_again(sdata, ifmgd->auth_data->timeout); 7108 } else { 7109 ifmgd->auth_data->timeout = jiffies - 1; 7110 } 7111 ifmgd->auth_data->timeout_started = true; 7112 } else if (ifmgd->assoc_data && 7113 !ifmgd->assoc_data->comeback && 7114 (ieee80211_is_assoc_req(fc) || 7115 ieee80211_is_reassoc_req(fc))) { 7116 /* 7117 * Update association timeout based on the TX status 7118 * for the (Re)Association Request frame. Skip this if 7119 * we have already processed a (Re)Association Response 7120 * frame that indicated need for association comeback 7121 * at a specific time in the future. This could happen 7122 * if the TX status information is delayed enough for 7123 * the response to be received and processed first. 7124 */ 7125 if (status_acked) { 7126 ifmgd->assoc_data->timeout = 7127 jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT; 7128 run_again(sdata, ifmgd->assoc_data->timeout); 7129 } else { 7130 ifmgd->assoc_data->timeout = jiffies - 1; 7131 } 7132 ifmgd->assoc_data->timeout_started = true; 7133 } 7134 } 7135 7136 if (ifmgd->auth_data && ifmgd->auth_data->timeout_started && 7137 time_after(jiffies, ifmgd->auth_data->timeout)) { 7138 if (ifmgd->auth_data->done || ifmgd->auth_data->waiting) { 7139 /* 7140 * ok ... we waited for assoc or continuation but 7141 * userspace didn't do it, so kill the auth data 7142 */ 7143 ieee80211_destroy_auth_data(sdata, false); 7144 } else if (ieee80211_auth(sdata)) { 7145 u8 ap_addr[ETH_ALEN]; 7146 struct ieee80211_event event = { 7147 .type = MLME_EVENT, 7148 .u.mlme.data = AUTH_EVENT, 7149 .u.mlme.status = MLME_TIMEOUT, 7150 }; 7151 7152 memcpy(ap_addr, ifmgd->auth_data->ap_addr, ETH_ALEN); 7153 7154 ieee80211_destroy_auth_data(sdata, false); 7155 7156 cfg80211_auth_timeout(sdata->dev, ap_addr); 7157 drv_event_callback(sdata->local, sdata, &event); 7158 } 7159 } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started) 7160 run_again(sdata, ifmgd->auth_data->timeout); 7161 7162 if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started && 7163 time_after(jiffies, ifmgd->assoc_data->timeout)) { 7164 if ((ifmgd->assoc_data->need_beacon && 7165 !sdata->deflink.u.mgd.have_beacon) || 7166 ieee80211_do_assoc(sdata)) { 7167 struct ieee80211_event event = { 7168 .type = MLME_EVENT, 7169 .u.mlme.data = ASSOC_EVENT, 7170 .u.mlme.status = MLME_TIMEOUT, 7171 }; 7172 7173 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT); 7174 drv_event_callback(sdata->local, sdata, &event); 7175 } 7176 } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started) 7177 run_again(sdata, ifmgd->assoc_data->timeout); 7178 7179 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL && 7180 ifmgd->associated) { 7181 u8 *bssid = sdata->deflink.u.mgd.bssid; 7182 int max_tries; 7183 7184 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) 7185 max_tries = max_nullfunc_tries; 7186 else 7187 max_tries = max_probe_tries; 7188 7189 /* ACK received for nullfunc probing frame */ 7190 if (!ifmgd->probe_send_count) 7191 ieee80211_reset_ap_probe(sdata); 7192 else if (ifmgd->nullfunc_failed) { 7193 if (ifmgd->probe_send_count < max_tries) { 7194 mlme_dbg(sdata, 7195 "No ack for nullfunc frame to AP %pM, try %d/%i\n", 7196 bssid, ifmgd->probe_send_count, 7197 max_tries); 7198 ieee80211_mgd_probe_ap_send(sdata); 7199 } else { 7200 mlme_dbg(sdata, 7201 "No ack for nullfunc frame to AP %pM, disconnecting.\n", 7202 bssid); 7203 ieee80211_sta_connection_lost(sdata, 7204 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, 7205 false); 7206 } 7207 } else if (time_is_after_jiffies(ifmgd->probe_timeout)) 7208 run_again(sdata, ifmgd->probe_timeout); 7209 else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) { 7210 mlme_dbg(sdata, 7211 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n", 7212 bssid, probe_wait_ms); 7213 ieee80211_sta_connection_lost(sdata, 7214 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false); 7215 } else if (ifmgd->probe_send_count < max_tries) { 7216 mlme_dbg(sdata, 7217 "No probe response from AP %pM after %dms, try %d/%i\n", 7218 bssid, probe_wait_ms, 7219 ifmgd->probe_send_count, max_tries); 7220 ieee80211_mgd_probe_ap_send(sdata); 7221 } else { 7222 /* 7223 * We actually lost the connection ... or did we? 7224 * Let's make sure! 7225 */ 7226 mlme_dbg(sdata, 7227 "No probe response from AP %pM after %dms, disconnecting.\n", 7228 bssid, probe_wait_ms); 7229 7230 ieee80211_sta_connection_lost(sdata, 7231 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false); 7232 } 7233 } 7234} 7235 7236static void ieee80211_sta_bcn_mon_timer(struct timer_list *t) 7237{ 7238 struct ieee80211_sub_if_data *sdata = 7239 from_timer(sdata, t, u.mgd.bcn_mon_timer); 7240 7241 if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif))) 7242 return; 7243 7244 if (sdata->vif.bss_conf.csa_active && 7245 !sdata->deflink.u.mgd.csa_waiting_bcn) 7246 return; 7247 7248 if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER) 7249 return; 7250 7251 sdata->u.mgd.connection_loss = false; 7252 wiphy_work_queue(sdata->local->hw.wiphy, 7253 &sdata->u.mgd.beacon_connection_loss_work); 7254} 7255 7256static void ieee80211_sta_conn_mon_timer(struct timer_list *t) 7257{ 7258 struct ieee80211_sub_if_data *sdata = 7259 from_timer(sdata, t, u.mgd.conn_mon_timer); 7260 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 7261 struct ieee80211_local *local = sdata->local; 7262 struct sta_info *sta; 7263 unsigned long timeout; 7264 7265 if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif))) 7266 return; 7267 7268 if (sdata->vif.bss_conf.csa_active && 7269 !sdata->deflink.u.mgd.csa_waiting_bcn) 7270 return; 7271 7272 sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr); 7273 if (!sta) 7274 return; 7275 7276 timeout = sta->deflink.status_stats.last_ack; 7277 if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx)) 7278 timeout = sta->deflink.rx_stats.last_rx; 7279 timeout += IEEE80211_CONNECTION_IDLE_TIME; 7280 7281 /* If timeout is after now, then update timer to fire at 7282 * the later date, but do not actually probe at this time. 7283 */ 7284 if (time_is_after_jiffies(timeout)) { 7285 mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout)); 7286 return; 7287 } 7288 7289 wiphy_work_queue(local->hw.wiphy, &sdata->u.mgd.monitor_work); 7290} 7291 7292static void ieee80211_sta_monitor_work(struct wiphy *wiphy, 7293 struct wiphy_work *work) 7294{ 7295 struct ieee80211_sub_if_data *sdata = 7296 container_of(work, struct ieee80211_sub_if_data, 7297 u.mgd.monitor_work); 7298 7299 ieee80211_mgd_probe_ap(sdata, false); 7300} 7301 7302static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata) 7303{ 7304 if (sdata->vif.type == NL80211_IFTYPE_STATION) { 7305 __ieee80211_stop_poll(sdata); 7306 7307 /* let's probe the connection once */ 7308 if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR)) 7309 wiphy_work_queue(sdata->local->hw.wiphy, 7310 &sdata->u.mgd.monitor_work); 7311 } 7312} 7313 7314#ifdef CONFIG_PM 7315void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata) 7316{ 7317 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 7318 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 7319 7320 lockdep_assert_wiphy(sdata->local->hw.wiphy); 7321 7322 if (ifmgd->auth_data || ifmgd->assoc_data) { 7323 const u8 *ap_addr = ifmgd->auth_data ? 7324 ifmgd->auth_data->ap_addr : 7325 ifmgd->assoc_data->ap_addr; 7326 7327 /* 7328 * If we are trying to authenticate / associate while suspending, 7329 * cfg80211 won't know and won't actually abort those attempts, 7330 * thus we need to do that ourselves. 7331 */ 7332 ieee80211_send_deauth_disassoc(sdata, ap_addr, ap_addr, 7333 IEEE80211_STYPE_DEAUTH, 7334 WLAN_REASON_DEAUTH_LEAVING, 7335 false, frame_buf); 7336 if (ifmgd->assoc_data) 7337 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON); 7338 if (ifmgd->auth_data) 7339 ieee80211_destroy_auth_data(sdata, false); 7340 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf, 7341 IEEE80211_DEAUTH_FRAME_LEN, 7342 false); 7343 } 7344 7345 /* This is a bit of a hack - we should find a better and more generic 7346 * solution to this. Normally when suspending, cfg80211 will in fact 7347 * deauthenticate. However, it doesn't (and cannot) stop an ongoing 7348 * auth (not so important) or assoc (this is the problem) process. 7349 * 7350 * As a consequence, it can happen that we are in the process of both 7351 * associating and suspending, and receive an association response 7352 * after cfg80211 has checked if it needs to disconnect, but before 7353 * we actually set the flag to drop incoming frames. This will then 7354 * cause the workqueue flush to process the association response in 7355 * the suspend, resulting in a successful association just before it 7356 * tries to remove the interface from the driver, which now though 7357 * has a channel context assigned ... this results in issues. 7358 * 7359 * To work around this (for now) simply deauth here again if we're 7360 * now connected. 7361 */ 7362 if (ifmgd->associated && !sdata->local->wowlan) { 7363 u8 bssid[ETH_ALEN]; 7364 struct cfg80211_deauth_request req = { 7365 .reason_code = WLAN_REASON_DEAUTH_LEAVING, 7366 .bssid = bssid, 7367 }; 7368 7369 memcpy(bssid, sdata->vif.cfg.ap_addr, ETH_ALEN); 7370 ieee80211_mgd_deauth(sdata, &req); 7371 } 7372} 7373#endif 7374 7375void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata) 7376{ 7377 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 7378 7379 lockdep_assert_wiphy(sdata->local->hw.wiphy); 7380 7381 if (!ifmgd->associated) 7382 return; 7383 7384 if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) { 7385 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME; 7386 mlme_dbg(sdata, "driver requested disconnect after resume\n"); 7387 ieee80211_sta_connection_lost(sdata, 7388 WLAN_REASON_UNSPECIFIED, 7389 true); 7390 return; 7391 } 7392 7393 if (sdata->flags & IEEE80211_SDATA_DISCONNECT_HW_RESTART) { 7394 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_HW_RESTART; 7395 mlme_dbg(sdata, "driver requested disconnect after hardware restart\n"); 7396 ieee80211_sta_connection_lost(sdata, 7397 WLAN_REASON_UNSPECIFIED, 7398 true); 7399 return; 7400 } 7401} 7402 7403static void ieee80211_request_smps_mgd_work(struct wiphy *wiphy, 7404 struct wiphy_work *work) 7405{ 7406 struct ieee80211_link_data *link = 7407 container_of(work, struct ieee80211_link_data, 7408 u.mgd.request_smps_work); 7409 7410 __ieee80211_request_smps_mgd(link->sdata, link, 7411 link->u.mgd.driver_smps_mode); 7412} 7413 7414/* interface setup */ 7415void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata) 7416{ 7417 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 7418 7419 wiphy_work_init(&ifmgd->monitor_work, ieee80211_sta_monitor_work); 7420 wiphy_work_init(&ifmgd->beacon_connection_loss_work, 7421 ieee80211_beacon_connection_loss_work); 7422 wiphy_work_init(&ifmgd->csa_connection_drop_work, 7423 ieee80211_csa_connection_drop_work); 7424 wiphy_delayed_work_init(&ifmgd->tdls_peer_del_work, 7425 ieee80211_tdls_peer_del_work); 7426 wiphy_delayed_work_init(&ifmgd->ml_reconf_work, 7427 ieee80211_ml_reconf_work); 7428 timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0); 7429 timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0); 7430 timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0); 7431 wiphy_delayed_work_init(&ifmgd->tx_tspec_wk, 7432 ieee80211_sta_handle_tspec_ac_params_wk); 7433 wiphy_delayed_work_init(&ifmgd->ttlm_work, 7434 ieee80211_tid_to_link_map_work); 7435 wiphy_delayed_work_init(&ifmgd->neg_ttlm_timeout_work, 7436 ieee80211_neg_ttlm_timeout_work); 7437 7438 ifmgd->flags = 0; 7439 ifmgd->powersave = sdata->wdev.ps; 7440 ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues; 7441 ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len; 7442 /* Setup TDLS data */ 7443 spin_lock_init(&ifmgd->teardown_lock); 7444 ifmgd->teardown_skb = NULL; 7445 ifmgd->orig_teardown_skb = NULL; 7446 ifmgd->mcast_seq_last = IEEE80211_SN_MODULO; 7447} 7448 7449static void ieee80211_recalc_smps_work(struct wiphy *wiphy, 7450 struct wiphy_work *work) 7451{ 7452 struct ieee80211_link_data *link = 7453 container_of(work, struct ieee80211_link_data, 7454 u.mgd.recalc_smps); 7455 7456 ieee80211_recalc_smps(link->sdata, link); 7457} 7458 7459void ieee80211_mgd_setup_link(struct ieee80211_link_data *link) 7460{ 7461 struct ieee80211_sub_if_data *sdata = link->sdata; 7462 struct ieee80211_local *local = sdata->local; 7463 unsigned int link_id = link->link_id; 7464 7465 link->u.mgd.p2p_noa_index = -1; 7466 link->conf->bssid = link->u.mgd.bssid; 7467 link->smps_mode = IEEE80211_SMPS_OFF; 7468 7469 wiphy_work_init(&link->u.mgd.request_smps_work, 7470 ieee80211_request_smps_mgd_work); 7471 wiphy_work_init(&link->u.mgd.recalc_smps, 7472 ieee80211_recalc_smps_work); 7473 if (local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS) 7474 link->u.mgd.req_smps = IEEE80211_SMPS_AUTOMATIC; 7475 else 7476 link->u.mgd.req_smps = IEEE80211_SMPS_OFF; 7477 7478 wiphy_delayed_work_init(&link->u.mgd.chswitch_work, 7479 ieee80211_chswitch_work); 7480 7481 if (sdata->u.mgd.assoc_data) 7482 ether_addr_copy(link->conf->addr, 7483 sdata->u.mgd.assoc_data->link[link_id].addr); 7484 else if (!is_valid_ether_addr(link->conf->addr)) 7485 eth_random_addr(link->conf->addr); 7486} 7487 7488/* scan finished notification */ 7489void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local) 7490{ 7491 struct ieee80211_sub_if_data *sdata; 7492 7493 /* Restart STA timers */ 7494 rcu_read_lock(); 7495 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 7496 if (ieee80211_sdata_running(sdata)) 7497 ieee80211_restart_sta_timer(sdata); 7498 } 7499 rcu_read_unlock(); 7500} 7501 7502static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, 7503 struct cfg80211_bss *cbss, s8 link_id, 7504 const u8 *ap_mld_addr, bool assoc, 7505 struct ieee80211_conn_settings *conn, 7506 bool override) 7507{ 7508 struct ieee80211_local *local = sdata->local; 7509 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 7510 struct ieee80211_bss *bss = (void *)cbss->priv; 7511 struct sta_info *new_sta = NULL; 7512 struct ieee80211_link_data *link; 7513 bool have_sta = false; 7514 bool mlo; 7515 int err; 7516 7517 if (link_id >= 0) { 7518 mlo = true; 7519 if (WARN_ON(!ap_mld_addr)) 7520 return -EINVAL; 7521 err = ieee80211_vif_set_links(sdata, BIT(link_id), 0); 7522 } else { 7523 if (WARN_ON(ap_mld_addr)) 7524 return -EINVAL; 7525 ap_mld_addr = cbss->bssid; 7526 err = ieee80211_vif_set_links(sdata, 0, 0); 7527 link_id = 0; 7528 mlo = false; 7529 } 7530 7531 if (err) 7532 return err; 7533 7534 link = sdata_dereference(sdata->link[link_id], sdata); 7535 if (WARN_ON(!link)) { 7536 err = -ENOLINK; 7537 goto out_err; 7538 } 7539 7540 if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) { 7541 err = -EINVAL; 7542 goto out_err; 7543 } 7544 7545 /* If a reconfig is happening, bail out */ 7546 if (local->in_reconfig) { 7547 err = -EBUSY; 7548 goto out_err; 7549 } 7550 7551 if (assoc) { 7552 rcu_read_lock(); 7553 have_sta = sta_info_get(sdata, ap_mld_addr); 7554 rcu_read_unlock(); 7555 } 7556 7557 if (!have_sta) { 7558 if (mlo) 7559 new_sta = sta_info_alloc_with_link(sdata, ap_mld_addr, 7560 link_id, cbss->bssid, 7561 GFP_KERNEL); 7562 else 7563 new_sta = sta_info_alloc(sdata, ap_mld_addr, GFP_KERNEL); 7564 7565 if (!new_sta) { 7566 err = -ENOMEM; 7567 goto out_err; 7568 } 7569 7570 new_sta->sta.mlo = mlo; 7571 } 7572 7573 /* 7574 * Set up the information for the new channel before setting the 7575 * new channel. We can't - completely race-free - change the basic 7576 * rates bitmap and the channel (sband) that it refers to, but if 7577 * we set it up before we at least avoid calling into the driver's 7578 * bss_info_changed() method with invalid information (since we do 7579 * call that from changing the channel - only for IDLE and perhaps 7580 * some others, but ...). 7581 * 7582 * So to avoid that, just set up all the new information before the 7583 * channel, but tell the driver to apply it only afterwards, since 7584 * it might need the new channel for that. 7585 */ 7586 if (new_sta) { 7587 const struct cfg80211_bss_ies *ies; 7588 struct link_sta_info *link_sta; 7589 7590 rcu_read_lock(); 7591 link_sta = rcu_dereference(new_sta->link[link_id]); 7592 if (WARN_ON(!link_sta)) { 7593 rcu_read_unlock(); 7594 sta_info_free(local, new_sta); 7595 err = -EINVAL; 7596 goto out_err; 7597 } 7598 7599 err = ieee80211_mgd_setup_link_sta(link, new_sta, 7600 link_sta, cbss); 7601 if (err) { 7602 rcu_read_unlock(); 7603 sta_info_free(local, new_sta); 7604 goto out_err; 7605 } 7606 7607 memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN); 7608 7609 /* set timing information */ 7610 link->conf->beacon_int = cbss->beacon_interval; 7611 ies = rcu_dereference(cbss->beacon_ies); 7612 if (ies) { 7613 link->conf->sync_tsf = ies->tsf; 7614 link->conf->sync_device_ts = 7615 bss->device_ts_beacon; 7616 7617 ieee80211_get_dtim(ies, 7618 &link->conf->sync_dtim_count, 7619 NULL); 7620 } else if (!ieee80211_hw_check(&sdata->local->hw, 7621 TIMING_BEACON_ONLY)) { 7622 ies = rcu_dereference(cbss->proberesp_ies); 7623 /* must be non-NULL since beacon IEs were NULL */ 7624 link->conf->sync_tsf = ies->tsf; 7625 link->conf->sync_device_ts = 7626 bss->device_ts_presp; 7627 link->conf->sync_dtim_count = 0; 7628 } else { 7629 link->conf->sync_tsf = 0; 7630 link->conf->sync_device_ts = 0; 7631 link->conf->sync_dtim_count = 0; 7632 } 7633 rcu_read_unlock(); 7634 } 7635 7636 if (new_sta || override) { 7637 /* 7638 * Only set this if we're also going to calculate the AP 7639 * settings etc., otherwise this was set before in a 7640 * previous call. Note override is set to %true in assoc 7641 * if the settings were changed. 7642 */ 7643 link->u.mgd.conn = *conn; 7644 err = ieee80211_prep_channel(sdata, link, link->link_id, cbss, 7645 mlo, &link->u.mgd.conn); 7646 if (err) { 7647 if (new_sta) 7648 sta_info_free(local, new_sta); 7649 goto out_err; 7650 } 7651 /* pass out for use in assoc */ 7652 *conn = link->u.mgd.conn; 7653 } 7654 7655 if (new_sta) { 7656 /* 7657 * tell driver about BSSID, basic rates and timing 7658 * this was set up above, before setting the channel 7659 */ 7660 ieee80211_link_info_change_notify(sdata, link, 7661 BSS_CHANGED_BSSID | 7662 BSS_CHANGED_BASIC_RATES | 7663 BSS_CHANGED_BEACON_INT); 7664 7665 if (assoc) 7666 sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH); 7667 7668 err = sta_info_insert(new_sta); 7669 new_sta = NULL; 7670 if (err) { 7671 sdata_info(sdata, 7672 "failed to insert STA entry for the AP (error %d)\n", 7673 err); 7674 goto out_release_chan; 7675 } 7676 } else 7677 WARN_ON_ONCE(!ether_addr_equal(link->u.mgd.bssid, cbss->bssid)); 7678 7679 /* Cancel scan to ensure that nothing interferes with connection */ 7680 if (local->scanning) 7681 ieee80211_scan_cancel(local); 7682 7683 return 0; 7684 7685out_release_chan: 7686 ieee80211_link_release_channel(link); 7687out_err: 7688 ieee80211_vif_set_links(sdata, 0, 0); 7689 return err; 7690} 7691 7692static bool ieee80211_mgd_csa_present(struct ieee80211_sub_if_data *sdata, 7693 const struct cfg80211_bss_ies *ies, 7694 u8 cur_channel, bool ignore_ecsa) 7695{ 7696 const struct element *csa_elem, *ecsa_elem; 7697 struct ieee80211_channel_sw_ie *csa = NULL; 7698 struct ieee80211_ext_chansw_ie *ecsa = NULL; 7699 7700 if (!ies) 7701 return false; 7702 7703 csa_elem = cfg80211_find_elem(WLAN_EID_CHANNEL_SWITCH, 7704 ies->data, ies->len); 7705 if (csa_elem && csa_elem->datalen == sizeof(*csa)) 7706 csa = (void *)csa_elem->data; 7707 7708 ecsa_elem = cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN, 7709 ies->data, ies->len); 7710 if (ecsa_elem && ecsa_elem->datalen == sizeof(*ecsa)) 7711 ecsa = (void *)ecsa_elem->data; 7712 7713 if (csa && csa->count == 0) 7714 csa = NULL; 7715 if (csa && !csa->mode && csa->new_ch_num == cur_channel) 7716 csa = NULL; 7717 7718 if (ecsa && ecsa->count == 0) 7719 ecsa = NULL; 7720 if (ecsa && !ecsa->mode && ecsa->new_ch_num == cur_channel) 7721 ecsa = NULL; 7722 7723 if (ignore_ecsa && ecsa) { 7724 sdata_info(sdata, 7725 "Ignoring ECSA in probe response - was considered stuck!\n"); 7726 return csa; 7727 } 7728 7729 return csa || ecsa; 7730} 7731 7732static bool ieee80211_mgd_csa_in_process(struct ieee80211_sub_if_data *sdata, 7733 struct cfg80211_bss *bss) 7734{ 7735 u8 cur_channel; 7736 bool ret; 7737 7738 cur_channel = ieee80211_frequency_to_channel(bss->channel->center_freq); 7739 7740 rcu_read_lock(); 7741 if (ieee80211_mgd_csa_present(sdata, 7742 rcu_dereference(bss->beacon_ies), 7743 cur_channel, false)) { 7744 ret = true; 7745 goto out; 7746 } 7747 7748 if (ieee80211_mgd_csa_present(sdata, 7749 rcu_dereference(bss->proberesp_ies), 7750 cur_channel, bss->proberesp_ecsa_stuck)) { 7751 ret = true; 7752 goto out; 7753 } 7754 7755 ret = false; 7756out: 7757 rcu_read_unlock(); 7758 return ret; 7759} 7760 7761/* config hooks */ 7762int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata, 7763 struct cfg80211_auth_request *req) 7764{ 7765 struct ieee80211_local *local = sdata->local; 7766 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 7767 struct ieee80211_mgd_auth_data *auth_data; 7768 struct ieee80211_conn_settings conn; 7769 struct ieee80211_link_data *link; 7770 struct ieee80211_supported_band *sband; 7771 struct ieee80211_bss *bss; 7772 u16 auth_alg; 7773 int err; 7774 bool cont_auth, wmm_used; 7775 7776 lockdep_assert_wiphy(sdata->local->hw.wiphy); 7777 7778 /* prepare auth data structure */ 7779 7780 switch (req->auth_type) { 7781 case NL80211_AUTHTYPE_OPEN_SYSTEM: 7782 auth_alg = WLAN_AUTH_OPEN; 7783 break; 7784 case NL80211_AUTHTYPE_SHARED_KEY: 7785 if (fips_enabled) 7786 return -EOPNOTSUPP; 7787 auth_alg = WLAN_AUTH_SHARED_KEY; 7788 break; 7789 case NL80211_AUTHTYPE_FT: 7790 auth_alg = WLAN_AUTH_FT; 7791 break; 7792 case NL80211_AUTHTYPE_NETWORK_EAP: 7793 auth_alg = WLAN_AUTH_LEAP; 7794 break; 7795 case NL80211_AUTHTYPE_SAE: 7796 auth_alg = WLAN_AUTH_SAE; 7797 break; 7798 case NL80211_AUTHTYPE_FILS_SK: 7799 auth_alg = WLAN_AUTH_FILS_SK; 7800 break; 7801 case NL80211_AUTHTYPE_FILS_SK_PFS: 7802 auth_alg = WLAN_AUTH_FILS_SK_PFS; 7803 break; 7804 case NL80211_AUTHTYPE_FILS_PK: 7805 auth_alg = WLAN_AUTH_FILS_PK; 7806 break; 7807 default: 7808 return -EOPNOTSUPP; 7809 } 7810 7811 if (ifmgd->assoc_data) 7812 return -EBUSY; 7813 7814 if (ieee80211_mgd_csa_in_process(sdata, req->bss)) { 7815 sdata_info(sdata, "AP is in CSA process, reject auth\n"); 7816 return -EINVAL; 7817 } 7818 7819 auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len + 7820 req->ie_len, GFP_KERNEL); 7821 if (!auth_data) 7822 return -ENOMEM; 7823 7824 memcpy(auth_data->ap_addr, 7825 req->ap_mld_addr ?: req->bss->bssid, 7826 ETH_ALEN); 7827 auth_data->bss = req->bss; 7828 auth_data->link_id = req->link_id; 7829 7830 if (req->auth_data_len >= 4) { 7831 if (req->auth_type == NL80211_AUTHTYPE_SAE) { 7832 __le16 *pos = (__le16 *) req->auth_data; 7833 7834 auth_data->sae_trans = le16_to_cpu(pos[0]); 7835 auth_data->sae_status = le16_to_cpu(pos[1]); 7836 } 7837 memcpy(auth_data->data, req->auth_data + 4, 7838 req->auth_data_len - 4); 7839 auth_data->data_len += req->auth_data_len - 4; 7840 } 7841 7842 /* Check if continuing authentication or trying to authenticate with the 7843 * same BSS that we were in the process of authenticating with and avoid 7844 * removal and re-addition of the STA entry in 7845 * ieee80211_prep_connection(). 7846 */ 7847 cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss && 7848 ifmgd->auth_data->link_id == req->link_id; 7849 7850 if (req->ie && req->ie_len) { 7851 memcpy(&auth_data->data[auth_data->data_len], 7852 req->ie, req->ie_len); 7853 auth_data->data_len += req->ie_len; 7854 } 7855 7856 if (req->key && req->key_len) { 7857 auth_data->key_len = req->key_len; 7858 auth_data->key_idx = req->key_idx; 7859 memcpy(auth_data->key, req->key, req->key_len); 7860 } 7861 7862 auth_data->algorithm = auth_alg; 7863 7864 /* try to authenticate/probe */ 7865 7866 if (ifmgd->auth_data) { 7867 if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) { 7868 auth_data->peer_confirmed = 7869 ifmgd->auth_data->peer_confirmed; 7870 } 7871 ieee80211_destroy_auth_data(sdata, cont_auth); 7872 } 7873 7874 /* prep auth_data so we don't go into idle on disassoc */ 7875 ifmgd->auth_data = auth_data; 7876 7877 /* If this is continuation of an ongoing SAE authentication exchange 7878 * (i.e., request to send SAE Confirm) and the peer has already 7879 * confirmed, mark authentication completed since we are about to send 7880 * out SAE Confirm. 7881 */ 7882 if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE && 7883 auth_data->peer_confirmed && auth_data->sae_trans == 2) 7884 ieee80211_mark_sta_auth(sdata); 7885 7886 if (ifmgd->associated) { 7887 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 7888 7889 sdata_info(sdata, 7890 "disconnect from AP %pM for new auth to %pM\n", 7891 sdata->vif.cfg.ap_addr, auth_data->ap_addr); 7892 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, 7893 WLAN_REASON_UNSPECIFIED, 7894 false, frame_buf); 7895 7896 ieee80211_report_disconnect(sdata, frame_buf, 7897 sizeof(frame_buf), true, 7898 WLAN_REASON_UNSPECIFIED, 7899 false); 7900 } 7901 7902 /* needed for transmitting the auth frame(s) properly */ 7903 memcpy(sdata->vif.cfg.ap_addr, auth_data->ap_addr, ETH_ALEN); 7904 7905 bss = (void *)req->bss->priv; 7906 wmm_used = bss->wmm_used && (local->hw.queues >= IEEE80211_NUM_ACS); 7907 7908 sband = local->hw.wiphy->bands[req->bss->channel->band]; 7909 7910 ieee80211_determine_our_sta_mode_auth(sdata, sband, req, wmm_used, 7911 &conn); 7912 7913 err = ieee80211_prep_connection(sdata, req->bss, req->link_id, 7914 req->ap_mld_addr, cont_auth, 7915 &conn, false); 7916 if (err) 7917 goto err_clear; 7918 7919 if (req->link_id >= 0) 7920 link = sdata_dereference(sdata->link[req->link_id], sdata); 7921 else 7922 link = &sdata->deflink; 7923 7924 if (WARN_ON(!link)) { 7925 err = -ENOLINK; 7926 goto err_clear; 7927 } 7928 7929 sdata_info(sdata, "authenticate with %pM (local address=%pM)\n", 7930 auth_data->ap_addr, link->conf->addr); 7931 7932 err = ieee80211_auth(sdata); 7933 if (err) { 7934 sta_info_destroy_addr(sdata, auth_data->ap_addr); 7935 goto err_clear; 7936 } 7937 7938 /* hold our own reference */ 7939 cfg80211_ref_bss(local->hw.wiphy, auth_data->bss); 7940 return 0; 7941 7942 err_clear: 7943 if (!ieee80211_vif_is_mld(&sdata->vif)) { 7944 eth_zero_addr(sdata->deflink.u.mgd.bssid); 7945 ieee80211_link_info_change_notify(sdata, &sdata->deflink, 7946 BSS_CHANGED_BSSID); 7947 ieee80211_link_release_channel(&sdata->deflink); 7948 } 7949 ifmgd->auth_data = NULL; 7950 kfree(auth_data); 7951 return err; 7952} 7953 7954static void 7955ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata, 7956 struct ieee80211_mgd_assoc_data *assoc_data, 7957 struct cfg80211_assoc_request *req, 7958 struct ieee80211_conn_settings *conn, 7959 unsigned int link_id) 7960{ 7961 struct ieee80211_local *local = sdata->local; 7962 const struct cfg80211_bss_ies *bss_ies; 7963 struct ieee80211_supported_band *sband; 7964 struct ieee80211_link_data *link; 7965 struct cfg80211_bss *cbss; 7966 struct ieee80211_bss *bss; 7967 7968 cbss = assoc_data->link[link_id].bss; 7969 if (WARN_ON(!cbss)) 7970 return; 7971 7972 bss = (void *)cbss->priv; 7973 7974 sband = local->hw.wiphy->bands[cbss->channel->band]; 7975 if (WARN_ON(!sband)) 7976 return; 7977 7978 link = sdata_dereference(sdata->link[link_id], sdata); 7979 if (WARN_ON(!link)) 7980 return; 7981 7982 /* for MLO connections assume advertising all rates is OK */ 7983 if (!req->ap_mld_addr) { 7984 assoc_data->supp_rates = bss->supp_rates; 7985 assoc_data->supp_rates_len = bss->supp_rates_len; 7986 } 7987 7988 /* copy and link elems for the STA profile */ 7989 if (req->links[link_id].elems_len) { 7990 memcpy(assoc_data->ie_pos, req->links[link_id].elems, 7991 req->links[link_id].elems_len); 7992 assoc_data->link[link_id].elems = assoc_data->ie_pos; 7993 assoc_data->link[link_id].elems_len = req->links[link_id].elems_len; 7994 assoc_data->ie_pos += req->links[link_id].elems_len; 7995 } 7996 7997 link->u.mgd.beacon_crc_valid = false; 7998 link->u.mgd.dtim_period = 0; 7999 link->u.mgd.have_beacon = false; 8000 8001 /* override HT configuration only if the AP and we support it */ 8002 if (conn->mode >= IEEE80211_CONN_MODE_HT) { 8003 struct ieee80211_sta_ht_cap sta_ht_cap; 8004 8005 memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap)); 8006 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap); 8007 } 8008 8009 rcu_read_lock(); 8010 bss_ies = rcu_dereference(cbss->beacon_ies); 8011 if (bss_ies) { 8012 u8 dtim_count = 0; 8013 8014 ieee80211_get_dtim(bss_ies, &dtim_count, 8015 &link->u.mgd.dtim_period); 8016 8017 sdata->deflink.u.mgd.have_beacon = true; 8018 8019 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) { 8020 link->conf->sync_tsf = bss_ies->tsf; 8021 link->conf->sync_device_ts = bss->device_ts_beacon; 8022 link->conf->sync_dtim_count = dtim_count; 8023 } 8024 } else { 8025 bss_ies = rcu_dereference(cbss->ies); 8026 } 8027 8028 if (bss_ies) { 8029 const struct element *elem; 8030 8031 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION, 8032 bss_ies->data, bss_ies->len); 8033 if (elem && elem->datalen >= 3) 8034 link->conf->profile_periodicity = elem->data[2]; 8035 else 8036 link->conf->profile_periodicity = 0; 8037 8038 elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, 8039 bss_ies->data, bss_ies->len); 8040 if (elem && elem->datalen >= 11 && 8041 (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT)) 8042 link->conf->ema_ap = true; 8043 else 8044 link->conf->ema_ap = false; 8045 } 8046 rcu_read_unlock(); 8047 8048 if (bss->corrupt_data) { 8049 char *corrupt_type = "data"; 8050 8051 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) { 8052 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) 8053 corrupt_type = "beacon and probe response"; 8054 else 8055 corrupt_type = "beacon"; 8056 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) { 8057 corrupt_type = "probe response"; 8058 } 8059 sdata_info(sdata, "associating to AP %pM with corrupt %s\n", 8060 cbss->bssid, corrupt_type); 8061 } 8062 8063 if (link->u.mgd.req_smps == IEEE80211_SMPS_AUTOMATIC) { 8064 if (sdata->u.mgd.powersave) 8065 link->smps_mode = IEEE80211_SMPS_DYNAMIC; 8066 else 8067 link->smps_mode = IEEE80211_SMPS_OFF; 8068 } else { 8069 link->smps_mode = link->u.mgd.req_smps; 8070 } 8071} 8072 8073static int 8074ieee80211_mgd_get_ap_ht_vht_capa(struct ieee80211_sub_if_data *sdata, 8075 struct ieee80211_mgd_assoc_data *assoc_data, 8076 int link_id) 8077{ 8078 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss; 8079 enum nl80211_band band = cbss->channel->band; 8080 struct ieee80211_supported_band *sband; 8081 const struct element *elem; 8082 int err; 8083 8084 /* neither HT nor VHT elements used on 6 GHz */ 8085 if (band == NL80211_BAND_6GHZ) 8086 return 0; 8087 8088 if (assoc_data->link[link_id].conn.mode < IEEE80211_CONN_MODE_HT) 8089 return 0; 8090 8091 rcu_read_lock(); 8092 elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_OPERATION); 8093 if (!elem || elem->datalen < sizeof(struct ieee80211_ht_operation)) { 8094 mlme_link_id_dbg(sdata, link_id, "no HT operation on BSS %pM\n", 8095 cbss->bssid); 8096 err = -EINVAL; 8097 goto out_rcu; 8098 } 8099 assoc_data->link[link_id].ap_ht_param = 8100 ((struct ieee80211_ht_operation *)(elem->data))->ht_param; 8101 rcu_read_unlock(); 8102 8103 if (assoc_data->link[link_id].conn.mode < IEEE80211_CONN_MODE_VHT) 8104 return 0; 8105 8106 /* some drivers want to support VHT on 2.4 GHz even */ 8107 sband = sdata->local->hw.wiphy->bands[band]; 8108 if (!sband->vht_cap.vht_supported) 8109 return 0; 8110 8111 rcu_read_lock(); 8112 elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY); 8113 /* but even then accept it not being present on the AP */ 8114 if (!elem && band == NL80211_BAND_2GHZ) { 8115 err = 0; 8116 goto out_rcu; 8117 } 8118 if (!elem || elem->datalen < sizeof(struct ieee80211_vht_cap)) { 8119 mlme_link_id_dbg(sdata, link_id, "no VHT capa on BSS %pM\n", 8120 cbss->bssid); 8121 err = -EINVAL; 8122 goto out_rcu; 8123 } 8124 memcpy(&assoc_data->link[link_id].ap_vht_cap, elem->data, 8125 sizeof(struct ieee80211_vht_cap)); 8126 rcu_read_unlock(); 8127 8128 return 0; 8129out_rcu: 8130 rcu_read_unlock(); 8131 return err; 8132} 8133 8134int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata, 8135 struct cfg80211_assoc_request *req) 8136{ 8137 unsigned int assoc_link_id = req->link_id < 0 ? 0 : req->link_id; 8138 struct ieee80211_local *local = sdata->local; 8139 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 8140 struct ieee80211_mgd_assoc_data *assoc_data; 8141 const struct element *ssid_elem; 8142 struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg; 8143 struct ieee80211_link_data *link; 8144 struct cfg80211_bss *cbss; 8145 bool override, uapsd_supported; 8146 bool match_auth; 8147 int i, err; 8148 size_t size = sizeof(*assoc_data) + req->ie_len; 8149 8150 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) 8151 size += req->links[i].elems_len; 8152 8153 /* FIXME: no support for 4-addr MLO yet */ 8154 if (sdata->u.mgd.use_4addr && req->link_id >= 0) 8155 return -EOPNOTSUPP; 8156 8157 assoc_data = kzalloc(size, GFP_KERNEL); 8158 if (!assoc_data) 8159 return -ENOMEM; 8160 8161 cbss = req->link_id < 0 ? req->bss : req->links[req->link_id].bss; 8162 8163 if (ieee80211_mgd_csa_in_process(sdata, cbss)) { 8164 sdata_info(sdata, "AP is in CSA process, reject assoc\n"); 8165 err = -EINVAL; 8166 goto err_free; 8167 } 8168 8169 rcu_read_lock(); 8170 ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID); 8171 if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) { 8172 rcu_read_unlock(); 8173 err = -EINVAL; 8174 goto err_free; 8175 } 8176 8177 memcpy(assoc_data->ssid, ssid_elem->data, ssid_elem->datalen); 8178 assoc_data->ssid_len = ssid_elem->datalen; 8179 rcu_read_unlock(); 8180 8181 if (req->ap_mld_addr) 8182 memcpy(assoc_data->ap_addr, req->ap_mld_addr, ETH_ALEN); 8183 else 8184 memcpy(assoc_data->ap_addr, cbss->bssid, ETH_ALEN); 8185 8186 if (ifmgd->associated) { 8187 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 8188 8189 sdata_info(sdata, 8190 "disconnect from AP %pM for new assoc to %pM\n", 8191 sdata->vif.cfg.ap_addr, assoc_data->ap_addr); 8192 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, 8193 WLAN_REASON_UNSPECIFIED, 8194 false, frame_buf); 8195 8196 ieee80211_report_disconnect(sdata, frame_buf, 8197 sizeof(frame_buf), true, 8198 WLAN_REASON_UNSPECIFIED, 8199 false); 8200 } 8201 8202 memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa)); 8203 memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask, 8204 sizeof(ifmgd->ht_capa_mask)); 8205 8206 memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa)); 8207 memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask, 8208 sizeof(ifmgd->vht_capa_mask)); 8209 8210 memcpy(&ifmgd->s1g_capa, &req->s1g_capa, sizeof(ifmgd->s1g_capa)); 8211 memcpy(&ifmgd->s1g_capa_mask, &req->s1g_capa_mask, 8212 sizeof(ifmgd->s1g_capa_mask)); 8213 8214 /* keep some setup (AP STA, channel, ...) if matching */ 8215 match_auth = ifmgd->auth_data && 8216 ether_addr_equal(ifmgd->auth_data->ap_addr, 8217 assoc_data->ap_addr) && 8218 ifmgd->auth_data->link_id == req->link_id; 8219 8220 if (req->ap_mld_addr) { 8221 uapsd_supported = true; 8222 8223 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) { 8224 struct ieee80211_supported_band *sband; 8225 struct cfg80211_bss *link_cbss = req->links[i].bss; 8226 struct ieee80211_bss *bss; 8227 8228 if (!link_cbss) 8229 continue; 8230 8231 bss = (void *)link_cbss->priv; 8232 8233 if (!bss->wmm_used) { 8234 err = -EINVAL; 8235 goto err_free; 8236 } 8237 8238 if (req->flags & (ASSOC_REQ_DISABLE_HT | 8239 ASSOC_REQ_DISABLE_VHT | 8240 ASSOC_REQ_DISABLE_HE | 8241 ASSOC_REQ_DISABLE_EHT)) { 8242 err = -EINVAL; 8243 goto err_free; 8244 } 8245 8246 if (link_cbss->channel->band == NL80211_BAND_S1GHZ) { 8247 err = -EINVAL; 8248 goto err_free; 8249 } 8250 8251 link = sdata_dereference(sdata->link[i], sdata); 8252 if (link) 8253 ether_addr_copy(assoc_data->link[i].addr, 8254 link->conf->addr); 8255 else 8256 eth_random_addr(assoc_data->link[i].addr); 8257 sband = local->hw.wiphy->bands[link_cbss->channel->band]; 8258 8259 if (match_auth && i == assoc_link_id && link) 8260 assoc_data->link[i].conn = link->u.mgd.conn; 8261 else 8262 assoc_data->link[i].conn = 8263 ieee80211_conn_settings_unlimited; 8264 ieee80211_determine_our_sta_mode_assoc(sdata, sband, 8265 req, true, i, 8266 &assoc_data->link[i].conn); 8267 assoc_data->link[i].bss = link_cbss; 8268 assoc_data->link[i].disabled = req->links[i].disabled; 8269 8270 if (!bss->uapsd_supported) 8271 uapsd_supported = false; 8272 8273 if (assoc_data->link[i].conn.mode < IEEE80211_CONN_MODE_EHT) { 8274 err = -EINVAL; 8275 req->links[i].error = err; 8276 goto err_free; 8277 } 8278 8279 err = ieee80211_mgd_get_ap_ht_vht_capa(sdata, 8280 assoc_data, i); 8281 if (err) { 8282 err = -EINVAL; 8283 req->links[i].error = err; 8284 goto err_free; 8285 } 8286 } 8287 8288 assoc_data->wmm = true; 8289 } else { 8290 struct ieee80211_supported_band *sband; 8291 struct ieee80211_bss *bss = (void *)cbss->priv; 8292 8293 memcpy(assoc_data->link[0].addr, sdata->vif.addr, ETH_ALEN); 8294 assoc_data->s1g = cbss->channel->band == NL80211_BAND_S1GHZ; 8295 8296 assoc_data->wmm = bss->wmm_used && 8297 (local->hw.queues >= IEEE80211_NUM_ACS); 8298 8299 if (cbss->channel->band == NL80211_BAND_6GHZ && 8300 req->flags & (ASSOC_REQ_DISABLE_HT | 8301 ASSOC_REQ_DISABLE_VHT | 8302 ASSOC_REQ_DISABLE_HE)) { 8303 err = -EINVAL; 8304 goto err_free; 8305 } 8306 8307 sband = local->hw.wiphy->bands[cbss->channel->band]; 8308 8309 assoc_data->link[0].bss = cbss; 8310 8311 if (match_auth) 8312 assoc_data->link[0].conn = sdata->deflink.u.mgd.conn; 8313 else 8314 assoc_data->link[0].conn = 8315 ieee80211_conn_settings_unlimited; 8316 ieee80211_determine_our_sta_mode_assoc(sdata, sband, req, 8317 assoc_data->wmm, 0, 8318 &assoc_data->link[0].conn); 8319 8320 uapsd_supported = bss->uapsd_supported; 8321 8322 err = ieee80211_mgd_get_ap_ht_vht_capa(sdata, assoc_data, 0); 8323 if (err) 8324 goto err_free; 8325 } 8326 8327 assoc_data->spp_amsdu = req->flags & ASSOC_REQ_SPP_AMSDU; 8328 8329 if (ifmgd->auth_data && !ifmgd->auth_data->done) { 8330 err = -EBUSY; 8331 goto err_free; 8332 } 8333 8334 if (ifmgd->assoc_data) { 8335 err = -EBUSY; 8336 goto err_free; 8337 } 8338 8339 /* Cleanup is delayed if auth_data matches */ 8340 if (ifmgd->auth_data && !match_auth) 8341 ieee80211_destroy_auth_data(sdata, false); 8342 8343 if (req->ie && req->ie_len) { 8344 memcpy(assoc_data->ie, req->ie, req->ie_len); 8345 assoc_data->ie_len = req->ie_len; 8346 assoc_data->ie_pos = assoc_data->ie + assoc_data->ie_len; 8347 } else { 8348 assoc_data->ie_pos = assoc_data->ie; 8349 } 8350 8351 if (req->fils_kek) { 8352 /* should already be checked in cfg80211 - so warn */ 8353 if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) { 8354 err = -EINVAL; 8355 goto err_free; 8356 } 8357 memcpy(assoc_data->fils_kek, req->fils_kek, 8358 req->fils_kek_len); 8359 assoc_data->fils_kek_len = req->fils_kek_len; 8360 } 8361 8362 if (req->fils_nonces) 8363 memcpy(assoc_data->fils_nonces, req->fils_nonces, 8364 2 * FILS_NONCE_LEN); 8365 8366 /* default timeout */ 8367 assoc_data->timeout = jiffies; 8368 assoc_data->timeout_started = true; 8369 8370 assoc_data->assoc_link_id = assoc_link_id; 8371 8372 if (req->ap_mld_addr) { 8373 /* if there was no authentication, set up the link */ 8374 err = ieee80211_vif_set_links(sdata, BIT(assoc_link_id), 0); 8375 if (err) 8376 goto err_clear; 8377 } 8378 8379 link = sdata_dereference(sdata->link[assoc_link_id], sdata); 8380 if (WARN_ON(!link)) { 8381 err = -EINVAL; 8382 goto err_clear; 8383 } 8384 8385 override = link->u.mgd.conn.mode != 8386 assoc_data->link[assoc_link_id].conn.mode || 8387 link->u.mgd.conn.bw_limit != 8388 assoc_data->link[assoc_link_id].conn.bw_limit; 8389 link->u.mgd.conn = assoc_data->link[assoc_link_id].conn; 8390 8391 ieee80211_setup_assoc_link(sdata, assoc_data, req, &link->u.mgd.conn, 8392 assoc_link_id); 8393 8394 if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) && 8395 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK), 8396 "U-APSD not supported with HW_PS_NULLFUNC_STACK\n")) 8397 sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD; 8398 8399 if (assoc_data->wmm && uapsd_supported && 8400 (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) { 8401 assoc_data->uapsd = true; 8402 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED; 8403 } else { 8404 assoc_data->uapsd = false; 8405 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED; 8406 } 8407 8408 if (req->prev_bssid) 8409 memcpy(assoc_data->prev_ap_addr, req->prev_bssid, ETH_ALEN); 8410 8411 if (req->use_mfp) { 8412 ifmgd->mfp = IEEE80211_MFP_REQUIRED; 8413 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED; 8414 } else { 8415 ifmgd->mfp = IEEE80211_MFP_DISABLED; 8416 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED; 8417 } 8418 8419 if (req->flags & ASSOC_REQ_USE_RRM) 8420 ifmgd->flags |= IEEE80211_STA_ENABLE_RRM; 8421 else 8422 ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM; 8423 8424 if (req->crypto.control_port) 8425 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT; 8426 else 8427 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT; 8428 8429 sdata->control_port_protocol = req->crypto.control_port_ethertype; 8430 sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt; 8431 sdata->control_port_over_nl80211 = 8432 req->crypto.control_port_over_nl80211; 8433 sdata->control_port_no_preauth = req->crypto.control_port_no_preauth; 8434 8435 /* kick off associate process */ 8436 ifmgd->assoc_data = assoc_data; 8437 8438 for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) { 8439 if (!assoc_data->link[i].bss) 8440 continue; 8441 if (i == assoc_data->assoc_link_id) 8442 continue; 8443 /* only calculate the mode, hence link == NULL */ 8444 err = ieee80211_prep_channel(sdata, NULL, i, 8445 assoc_data->link[i].bss, true, 8446 &assoc_data->link[i].conn); 8447 if (err) { 8448 req->links[i].error = err; 8449 goto err_clear; 8450 } 8451 } 8452 8453 memcpy(vif_cfg->ssid, assoc_data->ssid, assoc_data->ssid_len); 8454 vif_cfg->ssid_len = assoc_data->ssid_len; 8455 8456 /* needed for transmitting the assoc frames properly */ 8457 memcpy(sdata->vif.cfg.ap_addr, assoc_data->ap_addr, ETH_ALEN); 8458 8459 err = ieee80211_prep_connection(sdata, cbss, req->link_id, 8460 req->ap_mld_addr, true, 8461 &assoc_data->link[assoc_link_id].conn, 8462 override); 8463 if (err) 8464 goto err_clear; 8465 8466 if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC)) { 8467 const struct cfg80211_bss_ies *beacon_ies; 8468 8469 rcu_read_lock(); 8470 beacon_ies = rcu_dereference(req->bss->beacon_ies); 8471 if (!beacon_ies) { 8472 /* 8473 * Wait up to one beacon interval ... 8474 * should this be more if we miss one? 8475 */ 8476 sdata_info(sdata, "waiting for beacon from %pM\n", 8477 link->u.mgd.bssid); 8478 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval); 8479 assoc_data->timeout_started = true; 8480 assoc_data->need_beacon = true; 8481 } 8482 rcu_read_unlock(); 8483 } 8484 8485 run_again(sdata, assoc_data->timeout); 8486 8487 /* We are associating, clean up auth_data */ 8488 if (ifmgd->auth_data) 8489 ieee80211_destroy_auth_data(sdata, true); 8490 8491 return 0; 8492 err_clear: 8493 if (!ifmgd->auth_data) { 8494 eth_zero_addr(sdata->deflink.u.mgd.bssid); 8495 ieee80211_link_info_change_notify(sdata, &sdata->deflink, 8496 BSS_CHANGED_BSSID); 8497 } 8498 ifmgd->assoc_data = NULL; 8499 err_free: 8500 kfree(assoc_data); 8501 return err; 8502} 8503 8504int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, 8505 struct cfg80211_deauth_request *req) 8506{ 8507 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 8508 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 8509 bool tx = !req->local_state_change; 8510 struct ieee80211_prep_tx_info info = { 8511 .subtype = IEEE80211_STYPE_DEAUTH, 8512 }; 8513 8514 if (ifmgd->auth_data && 8515 ether_addr_equal(ifmgd->auth_data->ap_addr, req->bssid)) { 8516 sdata_info(sdata, 8517 "aborting authentication with %pM by local choice (Reason: %u=%s)\n", 8518 req->bssid, req->reason_code, 8519 ieee80211_get_reason_code_string(req->reason_code)); 8520 8521 info.link_id = ifmgd->auth_data->link_id; 8522 drv_mgd_prepare_tx(sdata->local, sdata, &info); 8523 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid, 8524 IEEE80211_STYPE_DEAUTH, 8525 req->reason_code, tx, 8526 frame_buf); 8527 ieee80211_destroy_auth_data(sdata, false); 8528 ieee80211_report_disconnect(sdata, frame_buf, 8529 sizeof(frame_buf), true, 8530 req->reason_code, false); 8531 drv_mgd_complete_tx(sdata->local, sdata, &info); 8532 return 0; 8533 } 8534 8535 if (ifmgd->assoc_data && 8536 ether_addr_equal(ifmgd->assoc_data->ap_addr, req->bssid)) { 8537 sdata_info(sdata, 8538 "aborting association with %pM by local choice (Reason: %u=%s)\n", 8539 req->bssid, req->reason_code, 8540 ieee80211_get_reason_code_string(req->reason_code)); 8541 8542 info.link_id = ifmgd->assoc_data->assoc_link_id; 8543 drv_mgd_prepare_tx(sdata->local, sdata, &info); 8544 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid, 8545 IEEE80211_STYPE_DEAUTH, 8546 req->reason_code, tx, 8547 frame_buf); 8548 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON); 8549 ieee80211_report_disconnect(sdata, frame_buf, 8550 sizeof(frame_buf), true, 8551 req->reason_code, false); 8552 drv_mgd_complete_tx(sdata->local, sdata, &info); 8553 return 0; 8554 } 8555 8556 if (ifmgd->associated && 8557 ether_addr_equal(sdata->vif.cfg.ap_addr, req->bssid)) { 8558 sdata_info(sdata, 8559 "deauthenticating from %pM by local choice (Reason: %u=%s)\n", 8560 req->bssid, req->reason_code, 8561 ieee80211_get_reason_code_string(req->reason_code)); 8562 8563 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, 8564 req->reason_code, tx, frame_buf); 8565 ieee80211_report_disconnect(sdata, frame_buf, 8566 sizeof(frame_buf), true, 8567 req->reason_code, false); 8568 drv_mgd_complete_tx(sdata->local, sdata, &info); 8569 return 0; 8570 } 8571 8572 return -ENOTCONN; 8573} 8574 8575int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata, 8576 struct cfg80211_disassoc_request *req) 8577{ 8578 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; 8579 8580 if (!sdata->u.mgd.associated || 8581 memcmp(sdata->vif.cfg.ap_addr, req->ap_addr, ETH_ALEN)) 8582 return -ENOTCONN; 8583 8584 sdata_info(sdata, 8585 "disassociating from %pM by local choice (Reason: %u=%s)\n", 8586 req->ap_addr, req->reason_code, 8587 ieee80211_get_reason_code_string(req->reason_code)); 8588 8589 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC, 8590 req->reason_code, !req->local_state_change, 8591 frame_buf); 8592 8593 ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true, 8594 req->reason_code, false); 8595 8596 return 0; 8597} 8598 8599void ieee80211_mgd_stop_link(struct ieee80211_link_data *link) 8600{ 8601 wiphy_work_cancel(link->sdata->local->hw.wiphy, 8602 &link->u.mgd.request_smps_work); 8603 wiphy_work_cancel(link->sdata->local->hw.wiphy, 8604 &link->u.mgd.recalc_smps); 8605 wiphy_delayed_work_cancel(link->sdata->local->hw.wiphy, 8606 &link->u.mgd.chswitch_work); 8607} 8608 8609void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata) 8610{ 8611 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 8612 8613 /* 8614 * Make sure some work items will not run after this, 8615 * they will not do anything but might not have been 8616 * cancelled when disconnecting. 8617 */ 8618 wiphy_work_cancel(sdata->local->hw.wiphy, 8619 &ifmgd->monitor_work); 8620 wiphy_work_cancel(sdata->local->hw.wiphy, 8621 &ifmgd->beacon_connection_loss_work); 8622 wiphy_work_cancel(sdata->local->hw.wiphy, 8623 &ifmgd->csa_connection_drop_work); 8624 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, 8625 &ifmgd->tdls_peer_del_work); 8626 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, 8627 &ifmgd->ml_reconf_work); 8628 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, &ifmgd->ttlm_work); 8629 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, 8630 &ifmgd->neg_ttlm_timeout_work); 8631 8632 if (ifmgd->assoc_data) 8633 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT); 8634 if (ifmgd->auth_data) 8635 ieee80211_destroy_auth_data(sdata, false); 8636 spin_lock_bh(&ifmgd->teardown_lock); 8637 if (ifmgd->teardown_skb) { 8638 kfree_skb(ifmgd->teardown_skb); 8639 ifmgd->teardown_skb = NULL; 8640 ifmgd->orig_teardown_skb = NULL; 8641 } 8642 kfree(ifmgd->assoc_req_ies); 8643 ifmgd->assoc_req_ies = NULL; 8644 ifmgd->assoc_req_ies_len = 0; 8645 spin_unlock_bh(&ifmgd->teardown_lock); 8646 del_timer_sync(&ifmgd->timer); 8647} 8648 8649void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif, 8650 enum nl80211_cqm_rssi_threshold_event rssi_event, 8651 s32 rssi_level, 8652 gfp_t gfp) 8653{ 8654 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 8655 8656 trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level); 8657 8658 cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp); 8659} 8660EXPORT_SYMBOL(ieee80211_cqm_rssi_notify); 8661 8662void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp) 8663{ 8664 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 8665 8666 trace_api_cqm_beacon_loss_notify(sdata->local, sdata); 8667 8668 cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp); 8669} 8670EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify); 8671 8672static void _ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data *sdata, 8673 int rssi_min_thold, 8674 int rssi_max_thold) 8675{ 8676 trace_api_enable_rssi_reports(sdata, rssi_min_thold, rssi_max_thold); 8677 8678 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION)) 8679 return; 8680 8681 /* 8682 * Scale up threshold values before storing it, as the RSSI averaging 8683 * algorithm uses a scaled up value as well. Change this scaling 8684 * factor if the RSSI averaging algorithm changes. 8685 */ 8686 sdata->u.mgd.rssi_min_thold = rssi_min_thold*16; 8687 sdata->u.mgd.rssi_max_thold = rssi_max_thold*16; 8688} 8689 8690void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif, 8691 int rssi_min_thold, 8692 int rssi_max_thold) 8693{ 8694 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 8695 8696 WARN_ON(rssi_min_thold == rssi_max_thold || 8697 rssi_min_thold > rssi_max_thold); 8698 8699 _ieee80211_enable_rssi_reports(sdata, rssi_min_thold, 8700 rssi_max_thold); 8701} 8702EXPORT_SYMBOL(ieee80211_enable_rssi_reports); 8703 8704void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif) 8705{ 8706 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 8707 8708 _ieee80211_enable_rssi_reports(sdata, 0, 0); 8709} 8710EXPORT_SYMBOL(ieee80211_disable_rssi_reports); 8711