mlme.c 125 KB
Newer Older
1 2
/*
 * BSS client mode implementation
3
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4 5 6 7 8 9 10 11 12 13
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

14
#include <linux/delay.h>
15 16 17 18
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
19
#include <linux/moduleparam.h>
20
#include <linux/rtnetlink.h>
21
#include <linux/pm_qos.h>
22
#include <linux/crc32.h>
23
#include <linux/slab.h>
24
#include <linux/export.h>
25
#include <net/mac80211.h>
26
#include <asm/unaligned.h>
Johannes Berg's avatar
Johannes Berg committed
27

28
#include "ieee80211_i.h"
29
#include "driver-ops.h"
Johannes Berg's avatar
Johannes Berg committed
30 31
#include "rate.h"
#include "led.h"
32

33 34 35 36 37 38 39
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
Johannes Berg's avatar
Johannes Berg committed
40

41 42 43 44 45 46 47 48 49
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
50 51

/*
52 53 54 55 56 57
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
58
 */
59 60 61 62
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
63

64 65 66 67
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
68
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
69 70 71 72 73
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
74 75 76 77 78
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
79

80 81 82 83 84 85 86
/*
 * Weight given to the latest Beacon frame when calculating average signal
 * strength for Beacon frames received in the current BSS. This must be
 * between 1 and 15.
 */
#define IEEE80211_SIGNAL_AVE_WEIGHT	3

87 88 89 90 91 92
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

Johannes Berg's avatar
Johannes Berg committed
93 94 95 96 97 98 99 100 101 102
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
103 104
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
Johannes Berg's avatar
Johannes Berg committed
105
{
106
	sdata_assert_lock(sdata);
Johannes Berg's avatar
Johannes Berg committed
107

108 109 110
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
Johannes Berg's avatar
Johannes Berg committed
111 112
}

113
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
114
{
115
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
116 117
		return;

118 119 120
	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
		return;

121
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
122
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
123 124
}

125 126
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
127 128
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

129 130 131
	if (unlikely(!sdata->u.mgd.associated))
		return;

132 133 134 135 136
	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
		return;

	mod_timer(&sdata->u.mgd.conn_mon_timer,
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
137 138

	ifmgd->probe_send_count = 0;
139 140
}

141
static int ecw2cw(int ecw)
Johannes Berg's avatar
Johannes Berg committed
142
{
143
	return (1 << ecw) - 1;
Johannes Berg's avatar
Johannes Berg committed
144 145
}

146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192
static u32 chandef_downgrade(struct cfg80211_chan_def *c)
{
	u32 ret;
	int tmp;

	switch (c->width) {
	case NL80211_CHAN_WIDTH_20:
		c->width = NL80211_CHAN_WIDTH_20_NOHT;
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		break;
	case NL80211_CHAN_WIDTH_40:
		c->width = NL80211_CHAN_WIDTH_20;
		c->center_freq1 = c->chan->center_freq;
		ret = IEEE80211_STA_DISABLE_40MHZ |
		      IEEE80211_STA_DISABLE_VHT;
		break;
	case NL80211_CHAN_WIDTH_80:
		tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
		/* n_P40 */
		tmp /= 2;
		/* freq_P40 */
		c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
		c->width = NL80211_CHAN_WIDTH_40;
		ret = IEEE80211_STA_DISABLE_VHT;
		break;
	case NL80211_CHAN_WIDTH_80P80:
		c->center_freq2 = 0;
		c->width = NL80211_CHAN_WIDTH_80;
		ret = IEEE80211_STA_DISABLE_80P80MHZ |
		      IEEE80211_STA_DISABLE_160MHZ;
		break;
	case NL80211_CHAN_WIDTH_160:
		/* n_P20 */
		tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
		/* n_P80 */
		tmp /= 4;
		c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
		c->width = NL80211_CHAN_WIDTH_80;
		ret = IEEE80211_STA_DISABLE_80P80MHZ |
		      IEEE80211_STA_DISABLE_160MHZ;
		break;
	default:
	case NL80211_CHAN_WIDTH_20_NOHT:
		WARN_ON_ONCE(1);
		c->width = NL80211_CHAN_WIDTH_20_NOHT;
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		break;
193 194 195 196 197 198
	case NL80211_CHAN_WIDTH_5:
	case NL80211_CHAN_WIDTH_10:
		WARN_ON_ONCE(1);
		/* keep c->width */
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		break;
199 200 201 202 203 204 205 206 207 208 209 210 211
	}

	WARN_ON_ONCE(!cfg80211_chandef_valid(c));

	return ret;
}

static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
212
			     struct cfg80211_chan_def *chandef, bool verbose)
213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239
{
	struct cfg80211_chan_def vht_chandef;
	u32 ht_cfreq, ret;

	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
	chandef->center_freq2 = 0;

	if (!ht_oper || !sband->ht_cap.ht_supported) {
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
	if (channel->center_freq != ht_cfreq) {
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
240 241 242 243 244
		if (verbose)
			sdata_info(sdata,
				   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
				   channel->center_freq, ht_cfreq,
				   ht_oper->primary_chan, channel->band);
245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	/* check 40 MHz support, if we have it */
	if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
		switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
		case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 += 10;
			break;
		case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 -= 10;
			break;
		}
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
264 265
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	vht_chandef.chan = channel;
	vht_chandef.center_freq1 =
		ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
					       channel->band);
	vht_chandef.center_freq2 = 0;

	switch (vht_oper->chan_width) {
	case IEEE80211_VHT_CHANWIDTH_USE_HT:
		vht_chandef.width = chandef->width;
		break;
	case IEEE80211_VHT_CHANWIDTH_80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80;
		break;
	case IEEE80211_VHT_CHANWIDTH_160MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_160;
		break;
	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
292 293 294 295
		vht_chandef.center_freq2 =
			ieee80211_channel_to_frequency(
				vht_oper->center_freq_seg2_idx,
				channel->band);
296 297
		break;
	default:
298 299 300 301
		if (verbose)
			sdata_info(sdata,
				   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
				   vht_oper->chan_width);
302 303 304 305 306
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
307 308 309
		if (verbose)
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
310 311 312 313 314 315 316 317 318 319
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
320 321 322
		if (verbose)
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
323 324 325 326 327 328 329 330 331
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
332 333 334 335
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

336 337 338 339 340
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
					IEEE80211_CHAN_DISABLED)) {
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
			      IEEE80211_STA_DISABLE_VHT;
341
			break;
342 343 344 345 346
		}

		ret |= chandef_downgrade(chandef);
	}

347
	if (chandef->width != vht_chandef.width && verbose)
348 349 350 351 352 353 354
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

355 356 357 358 359
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
			       const u8 *bssid, u32 *changed)
360 361
{
	struct ieee80211_local *local = sdata->local;
362
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
363
	struct ieee80211_supported_band *sband;
Johannes Berg's avatar
Johannes Berg committed
364
	struct ieee80211_channel *chan;
365
	struct cfg80211_chan_def chandef;
366
	u16 ht_opmode;
367 368 369
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
370

371 372
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
373 374
		return 0;

375 376 377 378 379 380 381
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

382
	chan = sdata->vif.bss_conf.chandef.chan;
Johannes Berg's avatar
Johannes Berg committed
383
	sband = local->hw.wiphy->bands[chan->band];
384

385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430
	/* calculate new channel (type) based on HT/VHT operation IEs */
	flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
					     vht_oper, &chandef, false);

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
		flags |= chandef_downgrade(&chandef);
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
		flags |= chandef_downgrade(&chandef);
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
		flags |= chandef_downgrade(&chandef);

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
		   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
		   chandef.center_freq1, chandef.center_freq2);

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
431
	case NL80211_CHAN_WIDTH_40:
432
		new_sta_bw = IEEE80211_STA_RX_BW_40;
433
		break;
434 435 436 437 438 439
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
440
		break;
441 442
	default:
		return -EINVAL;
443
	}
444

445 446
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
447

448 449 450 451 452
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
453

454 455 456 457 458 459 460
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
461

462 463 464 465
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
466
	}
467

468
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
469 470

	/* if bss configuration changed store the new one */
471 472
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
473
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
474 475
	}

476
	return 0;
477 478
}

479 480
/* frame sending functions */

Johannes Berg's avatar
Johannes Berg committed
481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502
static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
				      struct ieee80211_supported_band *sband,
				      u32 *rates)
{
	int i, j, count;
	*rates = 0;
	count = 0;
	for (i = 0; i < supp_rates_len; i++) {
		int rate = (supp_rates[i] & 0x7F) * 5;

		for (j = 0; j < sband->n_bitrates; j++)
			if (sband->bitrates[j].bitrate == rate) {
				*rates |= BIT(j);
				count++;
				break;
			}
	}

	return count;
}

static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
503
				struct sk_buff *skb, u8 ap_ht_param,
Johannes Berg's avatar
Johannes Berg committed
504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

521
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
Johannes Berg's avatar
Johannes Berg committed
522 523 524 525 526 527 528 529 530 531 532 533 534 535
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

536 537 538 539 540 541 542 543 544 545
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

Johannes Berg's avatar
Johannes Berg committed
546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

571 572
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
573 574
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
575 576 577 578 579 580 581 582
{
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
583
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
584 585 586 587

	/* determine capability flags */
	cap = vht_cap.cap;

588 589 590 591 592 593 594 595 596 597
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
		cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
	}

598 599 600 601 602 603 604 605
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;

606
	/* reserve and fill IE */
607
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
608 609 610
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

Johannes Berg's avatar
Johannes Berg committed
611 612 613 614 615 616 617 618 619 620 621 622
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
	u8 *pos, qos_info;
	size_t offset = 0, noffset;
	int i, count, rates_len, supp_rates_len;
	u16 capab;
	struct ieee80211_supported_band *sband;
Johannes Berg's avatar
Johannes Berg committed
623 624
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
Johannes Berg's avatar
Johannes Berg committed
625 626
	u32 rates = 0;

627
	sdata_assert_lock(sdata);
Johannes Berg's avatar
Johannes Berg committed
628

Johannes Berg's avatar
Johannes Berg committed
629 630 631 632 633 634
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
635
	chan = chanctx_conf->def.chan;
Johannes Berg's avatar
Johannes Berg committed
636 637
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
Johannes Berg's avatar
Johannes Berg committed
638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
		rates_len = ieee80211_compatible_rates(assoc_data->supp_rates,
						       assoc_data->supp_rates_len,
						       sband, &rates);
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
		rates = ~0;
		rates_len = sband->n_bitrates;
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
666
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
Johannes Berg's avatar
Johannes Berg committed
667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758
			assoc_data->ie_len + /* extra IEs */
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

	if (sband->band == IEEE80211_BAND_2GHZ) {
		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
			capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
			capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
	    (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(mgmt, 0, 24);
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
			int rate = sband->bitrates[i].bitrate;
			*pos++ = (u8) (rate / 5);
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
				int rate = sband->bitrates[i].bitrate;
				*pos++ = (u8) (rate / 5);
			}
		}
	}

	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
		/* 1. power capabilities */
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
Johannes Berg's avatar
Johannes Berg committed
759
		*pos++ = chan->max_power; /* max tx power */
Johannes Berg's avatar
Johannes Berg committed
760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794

		/* 2. supported channels */
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

	/* if present, add any custom IEs that go before HT */
	if (assoc_data->ie_len && assoc_data->ie) {
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_ht, ARRAY_SIZE(before_ht),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

795 796 797 798
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

799
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
800
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
801
				    sband, chan, sdata->smps_mode);
Johannes Berg's avatar
Johannes Berg committed
802

803
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
804 805
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
806

Johannes Berg's avatar
Johannes Berg committed
807 808 809 810 811 812 813 814 815 816
	/* if present, add any custom non-vendor IEs that go after HT */
	if (assoc_data->ie_len && assoc_data->ie) {
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

817 818
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
819 820
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
Johannes Berg's avatar
Johannes Berg committed
821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

		pos = skb_put(skb, 9);
		*pos++ = WLAN_EID_VENDOR_SPECIFIC;
		*pos++ = 7; /* len */
		*pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
		*pos++ = 0x50;
		*pos++ = 0xf2;
		*pos++ = 2; /* WME */
		*pos++ = 0; /* WME info */
		*pos++ = 1; /* WME ver */
		*pos++ = qos_info;
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
	if (assoc_data->ie_len && assoc_data->ie) {
		noffset = assoc_data->ie_len;
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
	}

Johannes Berg's avatar
Johannes Berg committed
845 846
	drv_mgd_prepare_tx(local, sdata);

Johannes Berg's avatar
Johannes Berg committed
847
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
848 849 850
	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
Johannes Berg's avatar
Johannes Berg committed
851 852 853
	ieee80211_tx_skb(sdata, skb);
}

854 855 856 857 858 859
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

860 861
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
862 863
		return;

864 865
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
866

867 868
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
869 870
}

871 872 873 874 875
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
			     int powersave)
{
	struct sk_buff *skb;
876
	struct ieee80211_hdr_3addr *nullfunc;
877
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
878

879 880
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
	if (!skb)
881 882
		return;

883
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
884
	if (powersave)
885
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
886

887 888
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
889 890 891 892

	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

893 894 895 896
	if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
			    IEEE80211_STA_CONNECTION_POLL))
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

897
	ieee80211_tx_skb(sdata, skb);
898 899
}

900 901 902 903 904 905 906 907 908 909 910
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
911
	if (!skb)
912
		return;
913

914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929
	skb_reserve(skb, local->hw.extra_tx_headroom);

	nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
	memset(nullfunc, 0, 30);
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

930 931 932 933 934
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
935
	struct ieee80211_local *local = sdata->local;
936 937
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

938
	if (!ieee80211_sdata_running(sdata))
939 940
		return;

941
	sdata_lock(sdata);
942 943
	if (!ifmgd->associated)
		goto out;
944

945
	local->_oper_chandef = local->csa_chandef;
946 947

	if (!local->ops->channel_switch) {
948
		/* call "hw_config" only if doing sw channel switch */
949
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
950 951
	} else {
		/* update the device channel directly */
952
		local->hw.conf.chandef = local->_oper_chandef;
953
	}
954

955
	/* XXX: shouldn't really modify cfg80211-owned data! */
956
	ifmgd->associated->channel = local->_oper_chandef.chan;
957

958
	/* XXX: wait for a beacon first? */
959
	ieee80211_wake_queues_by_reason(&local->hw,
960
					IEEE80211_MAX_QUEUE_MAP,
961
					IEEE80211_QUEUE_STOP_REASON_CSA);
962 963
 out:
	ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
964
	sdata_unlock(sdata);
965 966
}

967 968
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
Johannes Berg's avatar
Johannes Berg committed
969 970
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
971 972 973

	trace_api_chswitch_done(sdata, success);
	if (!success) {
974 975 976 977 978 979
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
980 981 982 983
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

984 985 986 987
static void ieee80211_chswitch_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
988

989
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
990 991
}

992
static void
Johannes Berg's avatar
Johannes Berg committed
993
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
994 995
				 u64 timestamp, struct ieee802_11_elems *elems,
				 bool beacon)
996
{
997
	struct ieee80211_local *local = sdata->local;
998
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
999 1000
	struct cfg80211_bss *cbss = ifmgd->associated;
	struct ieee80211_bss *bss;
Johannes Berg's avatar
Johannes Berg committed
1001
	struct ieee80211_chanctx *chanctx;
1002 1003 1004 1005 1006
	enum ieee80211_band new_band;
	int new_freq;
	u8 new_chan_no;
	u8 count;
	u8 mode;
1007
	struct ieee80211_channel *new_chan;
1008
	struct cfg80211_chan_def new_chandef = {};
1009 1010 1011
	struct cfg80211_chan_def new_vht_chandef = {};
	const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
	const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
1012
	const struct ieee80211_ht_operation *ht_oper;
1013
	int secondary_channel_offset = -1;
1014

1015
	sdata_assert_lock(sdata);
1016

1017
	if (!cbss)
1018 1019
		return;

1020
	if (local->scanning)
1021 1022
		return;

1023
	/* disregard subsequent announcements if we are already processing */
1024 1025 1026
	if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
		return;

1027 1028
	sec_chan_offs = elems->sec_chan_offs;
	wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
1029
	ht_oper = elems->ht_operation;
1030 1031 1032 1033 1034

	if (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
			    IEEE80211_STA_DISABLE_40MHZ)) {
		sec_chan_offs = NULL;
		wide_bw_chansw_ie = NULL;
1035 1036
		/* only used for bandwidth here */
		ht_oper = NULL;
1037 1038
	}

1039 1040
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		wide_bw_chansw_ie = NULL;
1041

1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061
	if (elems->ext_chansw_ie) {
		if (!ieee80211_operating_class_to_band(
				elems->ext_chansw_ie->new_operating_class,
				&new_band)) {
			sdata_info(sdata,
				   "cannot understand ECSA IE operating class %d, disconnecting\n",
				   elems->ext_chansw_ie->new_operating_class);
			ieee80211_queue_work(&local->hw,
					     &ifmgd->csa_connection_drop_work);
		}
		new_chan_no = elems->ext_chansw_ie->new_ch_num;
		count = elems->ext_chansw_ie->count;
		mode = elems->ext_chansw_ie->mode;
	} else if (elems->ch_switch_ie) {
		new_band = cbss->channel->band;
		new_chan_no = elems->ch_switch_ie->new_ch_num;
		count = elems->ch_switch_ie->count;
		mode = elems->ch_switch_ie->mode;
	} else {
		/* nothing here we understand */
1062
		return;
1063
	}
1064 1065 1066

	bss = (void *)cbss->priv;

1067
	new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
1068 1069
	new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
	if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
1070 1071 1072
		sdata_info(sdata,
			   "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
			   ifmgd->associated->bssid, new_freq);
1073
		ieee80211_queue_work(&local->hw,
1074
				     &ifmgd->csa_connection_drop_work);
1075
		return;
1076
	}
1077

1078
	if (!beacon && sec_chan_offs) {
1079
		secondary_channel_offset = sec_chan_offs->sec_chan_offs;
1080 1081 1082
	} else if (beacon && ht_oper) {
		secondary_channel_offset =
			ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
1083
	} else if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
1084 1085 1086 1087 1088 1089 1090 1091
		/*
		 * If it's not a beacon, HT is enabled and the IE not present,
		 * it's 20 MHz, 802.11-2012 8.5.2.6:
		 *	This element [the Secondary Channel Offset Element] is
		 *	present when switching to a 40 MHz channel. It may be
		 *	present when switching to a 20 MHz channel (in which
		 *	case the secondary channel offset is set to SCN).
		 */
1092 1093 1094
		secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
	}

1095 1096 1097 1098
	switch (secondary_channel_offset) {
	default:
		/* secondary_channel_offset was present but is invalid */
	case IEEE80211_HT_PARAM_CHA_SEC_NONE:
1099
		cfg80211_chandef_create(&new_chandef, new_chan,
1100 1101 1102
					NL80211_CHAN_HT20);
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
1103
		cfg80211_chandef_create(&new_chandef, new_chan,
1104 1105 1106
					NL80211_CHAN_HT40PLUS);
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
1107
		cfg80211_chandef_create(&new_chandef, new_chan,
1108 1109 1110
					NL80211_CHAN_HT40MINUS);
		break;
	case -1:
1111
		cfg80211_chandef_create(&new_chandef, new_chan,
1112 1113 1114 1115
					NL80211_CHAN_NO_HT);
		break;
	}

1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168
	if (wide_bw_chansw_ie) {
		new_vht_chandef.chan = new_chan;
		new_vht_chandef.center_freq1 =
			ieee80211_channel_to_frequency(
				wide_bw_chansw_ie->new_center_freq_seg0,
				new_band);

		switch (wide_bw_chansw_ie->new_channel_width) {
		default:
			/* hmmm, ignore VHT and use HT if present */
		case IEEE80211_VHT_CHANWIDTH_USE_HT:
			new_vht_chandef.chan = NULL;
			break;
		case IEEE80211_VHT_CHANWIDTH_80MHZ:
			new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
			break;
		case IEEE80211_VHT_CHANWIDTH_160MHZ:
			new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
			break;
		case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
			/* field is otherwise reserved */
			new_vht_chandef.center_freq2 =
				ieee80211_channel_to_frequency(
					wide_bw_chansw_ie->new_center_freq_seg1,
					new_band);
			new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
			break;
		}
		if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
		    new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
			chandef_downgrade(&new_vht_chandef);
		if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
		    new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
			chandef_downgrade(&new_vht_chandef);
		if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
		    new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
			chandef_downgrade(&new_vht_chandef);
	}

	/* if VHT data is there validate & use it */
	if (new_vht_chandef.chan) {
		if (!cfg80211_chandef_compatible(&new_vht_chandef,
						 &new_chandef)) {
			sdata_info(sdata,
				   "AP %pM CSA has inconsistent channel data, disconnecting\n",
				   ifmgd->associated->bssid);
			ieee80211_queue_work(&local->hw,
					     &ifmgd->csa_connection_drop_work);
			return;
		}
		new_chandef = new_vht_chandef;
	}

1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180
	if (!cfg80211_chandef_usable(local->hw.wiphy, &new_chandef,
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
			   ifmgd->associated->bssid, new_freq,
			   new_chandef.width, new_chandef.center_freq1,
			   new_chandef.center_freq2);
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1181 1182
	ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;

1183
	if (local->use_chanctx) {
Johannes Berg's avatar
Johannes Berg committed
1184 1185
		sdata_info(sdata,
			   "not handling channel switch with channel contexts\n");
1186
		ieee80211_queue_work(&local->hw,
Johannes Berg's avatar
Johannes Berg committed
1187
				     &ifmgd->csa_connection_drop_work);
1188
		return;
Johannes Berg's avatar
Johannes Berg committed
1189 1190
	}

1191
	mutex_lock(&local->chanctx_mtx);
Johannes Berg's avatar
Johannes Berg committed
1192
	if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
1193
		mutex_unlock(&local->chanctx_mtx);
Johannes Berg's avatar
Johannes Berg committed
1194 1195 1196 1197 1198 1199 1200
		return;
	}
	chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
			       struct ieee80211_chanctx, conf);
	if (chanctx->refcount > 1) {
		sdata_info(sdata,
			   "channel switch with multiple interfaces on the same channel, disconnecting\n");
1201
		ieee80211_queue_work(&local->hw,
Johannes Berg's avatar
Johannes Berg committed
1202
				     &ifmgd->csa_connection_drop_work);
1203
		mutex_unlock(&local->chanctx_mtx);
Johannes Berg's avatar
Johannes Berg committed
1204 1205
		return;
	}
1206
	mutex_unlock(&local->chanctx_mtx);
Johannes Berg's avatar
Johannes Berg committed
1207

1208
	local->csa_chandef = new_chandef;
Johannes Berg's avatar
Johannes Berg committed
1209

1210 1211
	if (mode)
		ieee80211_stop_queues_by_reason(&local->hw,
1212
				IEEE80211_MAX_QUEUE_MAP,
1213 1214
				IEEE80211_QUEUE_STOP_REASON_CSA);

1215
	if (local->ops->channel_switch) {
1216
		/* use driver's channel switch callback */
1217 1218
		struct ieee80211_channel_switch ch_switch = {
			.timestamp = timestamp,
1219
			.block_tx = mode,
1220
			.chandef = new_chandef,
1221
			.count = count,
1222 1223
		};

1224
		drv_channel_switch(local, &ch_switch);
1225 1226 1227 1228
		return;
	}

	/* channel switch handled in software */
1229 1230
	if (count <= 1)
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1231
	else
1232
		mod_timer(&ifmgd->chswitch_timer,
1233
			  TU_TO_EXP_TIME(count * cbss->beacon_interval));
1234 1235
}

1236 1237 1238 1239
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       const u8 *country_ie, u8 country_ie_len,
				       const u8 *pwr_constr_elem)
1240
{
1241 1242 1243 1244
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
	int i, chan_pwr, chan_increment, new_ap_level;
	bool have_chan_pwr = false;
1245

1246 1247
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1248
		return 0;
1249

1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
	case IEEE80211_BAND_2GHZ:
	case IEEE80211_BAND_60GHZ:
		chan_increment = 1;
		break;
	case IEEE80211_BAND_5GHZ:
		chan_increment = 4;
		break;
1264
	}
1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
				chan_pwr = triplet->chans.max_power;
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

	if (!have_chan_pwr)
1289
		return 0;
1290 1291 1292

	new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);

1293 1294
	if (sdata->ap_power_level == new_ap_level)
		return 0;
1295 1296 1297 1298 1299

	sdata_info(sdata,
		   "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
		   new_ap_level, chan_pwr, *pwr_constr_elem,
		   sdata->u.mgd.bssid);
1300 1301 1302 1303
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1304 1305
}

1306 1307 1308 1309 1310 1311
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

Johannes Berg's avatar
Johannes Berg committed
1312 1313 1314 1315
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1316
	if (local->scanning)
Johannes Berg's avatar
Johannes Berg committed
1317 1318
		return;

1319 1320 1321 1322 1323 1324 1325
	if (conf->dynamic_ps_timeout > 0 &&
	    !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
		if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
			ieee80211_send_nullfunc(local, sdata, 1);
1326

1327 1328 1329 1330 1331 1332
		if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
		    (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1350 1351 1352 1353
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
1354
	bool authorized = false;
1355 1356 1357 1358

	if (!mgd->powersave)
		return false;

1359 1360 1361
	if (mgd->broken_ap)
		return false;

1362 1363 1364 1365 1366 1367 1368
	if (!mgd->associated)
		return false;

	if (mgd->flags & (IEEE80211_STA_BEACON_POLL |
			  IEEE80211_STA_CONNECTION_POLL))
		return false;

1369
	if (!mgd->have_beacon)
1370 1371
		return false;

1372 1373 1374
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
1375
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1376 1377
	rcu_read_unlock();

1378
	return authorized;
1379 1380
}

1381
/* need to hold RTNL or interface lock */
1382
void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1383 1384 1385
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1386
	int timeout;
1387 1388 1389 1390 1391 1392 1393

	if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1394
		if (!ieee80211_sdata_running(sdata))
1395
			continue;
1396 1397 1398 1399 1400 1401 1402 1403
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1404 1405 1406 1407 1408 1409
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1410
	if (count == 1 && ieee80211_powersave_allowed(found)) {
1411 1412 1413
		s32 beaconint_us;

		if (latency < 0)
Mark Gross's avatar
Mark Gross committed
1414
			latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1415 1416 1417 1418

		beaconint_us = ieee80211_tu_to_usec(
					found->vif.bss_conf.beacon_int);

1419
		timeout = local->dynamic_ps_forced_timeout;
1420 1421