net/mac80211/mlme.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 #include <linux/delay.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/if_arp.h>
  18 #include <linux/etherdevice.h>
  19 #include <linux/moduleparam.h>
  20 #include <linux/rtnetlink.h>
  21 #include <linux/pm_qos.h>
  22 #include <linux/crc32.h>
  23 #include <linux/slab.h>
  24 #include <net/mac80211.h>
  25 #include <asm/unaligned.h>
  26
  27 #include "ieee80211_i.h"
  28 #include "driver-ops.h"
  29 #include "rate.h"
  30 #include "led.h"
  31
  32 static int max_nullfunc_tries = 2;
  33 module_param(max_nullfunc_tries, int, 0644);
  34 MODULE_PARM_DESC(max_nullfunc_tries,
  35                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
  36
  37 static int max_probe_tries = 5;
  38 module_param(max_probe_tries, int, 0644);
  39 MODULE_PARM_DESC(max_probe_tries,
  40                  "Maximum probe tries before disconnecting (reason 4).");
  41
  42 /*
  43  * Beacon loss timeout is calculated as N frames times the
  44  * advertised beacon interval.  This may need to be somewhat
  45  * higher than what hardware might detect to account for
  46  * delays in the host processing frames. But since we also
  47  * probe on beacon miss before declaring the connection lost
  48  * default to what we want.
  49  */
  50 #define IEEE80211_BEACON_LOSS_COUNT     7
  51
  52 /*
  53  * Time the connection can be idle before we probe
  54  * it to see if we can still talk to the AP.
  55  */
  56 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
  57 /*
  58  * Time we wait for a probe response after sending
  59  * a probe request because of beacon loss or for
  60  * checking the connection still works.
  61  */
  62 static int probe_wait_ms = 500;
  63 module_param(probe_wait_ms, int, 0644);
  64 MODULE_PARM_DESC(probe_wait_ms,
  65                  "Maximum time(ms) to wait for probe response"
  66                  " before disconnecting (reason 4).");
  67
  68 /*
  69  * Weight given to the latest Beacon frame when calculating average signal
  70  * strength for Beacon frames received in the current BSS. This must be
  71  * between 1 and 15.
  72  */
  73 #define IEEE80211_SIGNAL_AVE_WEIGHT     3
  74
  75 /*
  76  * How many Beacon frames need to have been used in average signal strength
  77  * before starting to indicate signal change events.
  78  */
  79 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
  80
  81 #define TMR_RUNNING_TIMER       0
  82 #define TMR_RUNNING_CHANSW      1
  83
  84 /*
  85  * All cfg80211 functions have to be called outside a locked
  86  * section so that they can acquire a lock themselves... This
  87  * is much simpler than queuing up things in cfg80211, but we
  88  * do need some indirection for that here.
  89  */
  90 enum rx_mgmt_action {
  91         /* no action required */
  92         RX_MGMT_NONE,
  93
  94         /* caller must call cfg80211_send_deauth() */
  95         RX_MGMT_CFG80211_DEAUTH,
  96
  97         /* caller must call cfg80211_send_disassoc() */
  98         RX_MGMT_CFG80211_DISASSOC,
  99 };
 100
 101 /* utils */
 102 static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
 103 {
 104         lockdep_assert_held(&ifmgd->mtx);
 105 }
 106
 107 /*
 108  * We can have multiple work items (and connection probing)
 109  * scheduling this timer, but we need to take care to only
 110  * reschedule it when it should fire _earlier_ than it was
 111  * asked for before, or if it's not pending right now. This
 112  * function ensures that. Note that it then is required to
 113  * run this function for all timeouts after the first one
 114  * has happened -- the work that runs from this timer will
 115  * do that.
 116  */
 117 static void run_again(struct ieee80211_if_managed *ifmgd,
 118                              unsigned long timeout)
 119 {
 120         ASSERT_MGD_MTX(ifmgd);
 121
 122         if (!timer_pending(&ifmgd->timer) ||
 123             time_before(timeout, ifmgd->timer.expires))
 124                 mod_timer(&ifmgd->timer, timeout);
 125 }
 126
 127 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 128 {
 129         if (sdata->local->hw.flags & IEEE80211_HW_BEACON_FILTER)
 130                 return;
 131
 132         mod_timer(&sdata->u.mgd.bcn_mon_timer,
 133                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 134 }
 135
 136 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 137 {
 138         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 139
 140         if (unlikely(!sdata->u.mgd.associated))
 141                 return;
 142
 143         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
 144                 return;
 145
 146         mod_timer(&sdata->u.mgd.conn_mon_timer,
 147                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 148
 149         ifmgd->probe_send_count = 0;
 150 }
 151
 152 static int ecw2cw(int ecw)
 153 {
 154         return (1 << ecw) - 1;
 155 }
 156
 157 /*
 158  * ieee80211_enable_ht should be called only after the operating band
 159  * has been determined as ht configuration depends on the hw's
 160  * HT abilities for a specific band.
 161  */
 162 static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 163                                struct ieee80211_ht_info *hti,
 164                                const u8 *bssid, u16 ap_ht_cap_flags,
 165                                bool beacon_htcap_ie)
 166 {
 167         struct ieee80211_local *local = sdata->local;
 168         struct ieee80211_supported_band *sband;
 169         struct sta_info *sta;
 170         u32 changed = 0;
 171         int hti_cfreq;
 172         u16 ht_opmode;
 173         bool enable_ht = true;
 174         enum nl80211_channel_type prev_chantype;
 175         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 176
 177         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 178
 179         prev_chantype = sdata->vif.bss_conf.channel_type;
 180
 181         /* HT is not supported */
 182         if (!sband->ht_cap.ht_supported)
 183                 enable_ht = false;
 184
 185         if (enable_ht) {
 186                 hti_cfreq = ieee80211_channel_to_frequency(hti->control_chan,
 187                                                            sband->band);
 188                 /* check that channel matches the right operating channel */
 189                 if (local->hw.conf.channel->center_freq != hti_cfreq) {
 190                         /* Some APs mess this up, evidently.
 191                          * Netgear WNDR3700 sometimes reports 4 higher than
 192                          * the actual channel, for instance.
 193                          */
 194                         printk(KERN_DEBUG
 195                                "%s: Wrong control channel in association"
 196                                " response: configured center-freq: %d"
 197                                " hti-cfreq: %d  hti->control_chan: %d"
 198                                " band: %d.  Disabling HT.\n",
 199                                sdata->name,
 200                                local->hw.conf.channel->center_freq,
 201                                hti_cfreq, hti->control_chan,
 202                                sband->band);
 203                         enable_ht = false;
 204                 }
 205         }
 206
 207         if (enable_ht) {
 208                 channel_type = NL80211_CHAN_HT20;
 209
 210                 if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
 211                     (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
 212                     (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
 213                         switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 214                         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 215                                 if (!(local->hw.conf.channel->flags &
 216                                     IEEE80211_CHAN_NO_HT40PLUS))
 217                                         channel_type = NL80211_CHAN_HT40PLUS;
 218                                 break;
 219                         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 220                                 if (!(local->hw.conf.channel->flags &
 221                                     IEEE80211_CHAN_NO_HT40MINUS))
 222                                         channel_type = NL80211_CHAN_HT40MINUS;
 223                                 break;
 224                         }
 225                 }
 226         }
 227
 228         if (local->tmp_channel)
 229                 local->tmp_channel_type = channel_type;
 230
 231         if (!ieee80211_set_channel_type(local, sdata, channel_type)) {
 232                 /* can only fail due to HT40+/- mismatch */
 233                 channel_type = NL80211_CHAN_HT20;
 234                 WARN_ON(!ieee80211_set_channel_type(local, sdata, channel_type));
 235         }
 236
 237         if (beacon_htcap_ie && (prev_chantype != channel_type)) {
 238                 /*
 239                  * Whenever the AP announces the HT mode change that can be
 240                  * 40MHz intolerant or etc., it would be safer to stop tx
 241                  * queues before doing hw config to avoid buffer overflow.
 242                  */
 243                 ieee80211_stop_queues_by_reason(&sdata->local->hw,
 244                                 IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
 245
 246                 /* flush out all packets */
 247                 synchronize_net();
 248
 249                 drv_flush(local, false);
 250         }
 251
 252         /* channel_type change automatically detected */
 253         ieee80211_hw_config(local, 0);
 254
 255         if (prev_chantype != channel_type) {
 256                 rcu_read_lock();
 257                 sta = sta_info_get(sdata, bssid);
 258                 if (sta)
 259                         rate_control_rate_update(local, sband, sta,
 260                                                  IEEE80211_RC_HT_CHANGED,
 261                                                  channel_type);
 262                 rcu_read_unlock();
 263
 264                 if (beacon_htcap_ie)
 265                         ieee80211_wake_queues_by_reason(&sdata->local->hw,
 266                                 IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
 267         }
 268
 269         ht_opmode = le16_to_cpu(hti->operation_mode);
 270
 271         /* if bss configuration changed store the new one */
 272         if (sdata->ht_opmode_valid != enable_ht ||
 273             sdata->vif.bss_conf.ht_operation_mode != ht_opmode ||
 274             prev_chantype != channel_type) {
 275                 changed |= BSS_CHANGED_HT;
 276                 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
 277                 sdata->ht_opmode_valid = enable_ht;
 278         }
 279
 280         return changed;
 281 }
 282
 283 /* frame sending functions */
 284
 285 static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 286                                            const u8 *bssid, u16 stype, u16 reason,
 287                                            void *cookie, bool send_frame)
 288 {
 289         struct ieee80211_local *local = sdata->local;
 290         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 291         struct sk_buff *skb;
 292         struct ieee80211_mgmt *mgmt;
 293
 294         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 295         if (!skb)
 296                 return;
 297
 298         skb_reserve(skb, local->hw.extra_tx_headroom);
 299
 300         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 301         memset(mgmt, 0, 24);
 302         memcpy(mgmt->da, bssid, ETH_ALEN);
 303         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
 304         memcpy(mgmt->bssid, bssid, ETH_ALEN);
 305         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
 306         skb_put(skb, 2);
 307         /* u.deauth.reason_code == u.disassoc.reason_code */
 308         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 309
 310         if (stype == IEEE80211_STYPE_DEAUTH)
 311                 if (cookie)
 312                         __cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
 313                 else
 314                         cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
 315         else
 316                 if (cookie)
 317                         __cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
 318                 else
 319                         cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
 320         if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
 321                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 322
 323         if (send_frame)
 324                 ieee80211_tx_skb(sdata, skb);
 325         else
 326                 kfree_skb(skb);
 327 }
 328
 329 void ieee80211_send_pspoll(struct ieee80211_local *local,
 330                            struct ieee80211_sub_if_data *sdata)
 331 {
 332         struct ieee80211_pspoll *pspoll;
 333         struct sk_buff *skb;
 334
 335         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
 336         if (!skb)
 337                 return;
 338
 339         pspoll = (struct ieee80211_pspoll *) skb->data;
 340         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 341
 342         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 343         ieee80211_tx_skb(sdata, skb);
 344 }
 345
 346 void ieee80211_send_nullfunc(struct ieee80211_local *local,
 347                              struct ieee80211_sub_if_data *sdata,
 348                              int powersave)
 349 {
 350         struct sk_buff *skb;
 351         struct ieee80211_hdr_3addr *nullfunc;
 352         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 353
 354         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
 355         if (!skb)
 356                 return;
 357
 358         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
 359         if (powersave)
 360                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 361
 362         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 363         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
 364                             IEEE80211_STA_CONNECTION_POLL))
 365                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
 366
 367         ieee80211_tx_skb(sdata, skb);
 368 }
 369
 370 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
 371                                           struct ieee80211_sub_if_data *sdata)
 372 {
 373         struct sk_buff *skb;
 374         struct ieee80211_hdr *nullfunc;
 375         __le16 fc;
 376
 377         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
 378                 return;
 379
 380         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
 381         if (!skb)
 382                 return;
 383
 384         skb_reserve(skb, local->hw.extra_tx_headroom);
 385
 386         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
 387         memset(nullfunc, 0, 30);
 388         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
 389                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
 390         nullfunc->frame_control = fc;
 391         memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
 392         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
 393         memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
 394         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
 395
 396         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 397         ieee80211_tx_skb(sdata, skb);
 398 }
 399
 400 /* spectrum management related things */
 401 static void ieee80211_chswitch_work(struct work_struct *work)
 402 {
 403         struct ieee80211_sub_if_data *sdata =
 404                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
 405         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 406
 407         if (!ieee80211_sdata_running(sdata))
 408                 return;
 409
 410         mutex_lock(&ifmgd->mtx);
 411         if (!ifmgd->associated)
 412                 goto out;
 413
 414         sdata->local->oper_channel = sdata->local->csa_channel;
 415         if (!sdata->local->ops->channel_switch) {
 416                 /* call "hw_config" only if doing sw channel switch */
 417                 ieee80211_hw_config(sdata->local,
 418                         IEEE80211_CONF_CHANGE_CHANNEL);
 419         } else {
 420                 /* update the device channel directly */
 421                 sdata->local->hw.conf.channel = sdata->local->oper_channel;
 422         }
 423
 424         /* XXX: shouldn't really modify cfg80211-owned data! */
 425         ifmgd->associated->channel = sdata->local->oper_channel;
 426
 427         ieee80211_wake_queues_by_reason(&sdata->local->hw,
 428                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 429  out:
 430         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
 431         mutex_unlock(&ifmgd->mtx);
 432 }
 433
 434 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
 435 {
 436         struct ieee80211_sub_if_data *sdata;
 437         struct ieee80211_if_managed *ifmgd;
 438
 439         sdata = vif_to_sdata(vif);
 440         ifmgd = &sdata->u.mgd;
 441
 442         trace_api_chswitch_done(sdata, success);
 443         if (!success) {
 444                 /*
 445                  * If the channel switch was not successful, stay
 446                  * around on the old channel. We currently lack
 447                  * good handling of this situation, possibly we
 448                  * should just drop the association.
 449                  */
 450                 sdata->local->csa_channel = sdata->local->oper_channel;
 451         }
 452
 453         ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 454 }
 455 EXPORT_SYMBOL(ieee80211_chswitch_done);
 456
 457 static void ieee80211_chswitch_timer(unsigned long data)
 458 {
 459         struct ieee80211_sub_if_data *sdata =
 460                 (struct ieee80211_sub_if_data *) data;
 461         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 462
 463         if (sdata->local->quiescing) {
 464                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
 465                 return;
 466         }
 467
 468         ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 469 }
 470
 471 void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 472                                       struct ieee80211_channel_sw_ie *sw_elem,
 473                                       struct ieee80211_bss *bss,
 474                                       u64 timestamp)
 475 {
 476         struct cfg80211_bss *cbss =
 477                 container_of((void *)bss, struct cfg80211_bss, priv);
 478         struct ieee80211_channel *new_ch;
 479         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 480         int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num,
 481                                                       cbss->channel->band);
 482
 483         ASSERT_MGD_MTX(ifmgd);
 484
 485         if (!ifmgd->associated)
 486                 return;
 487
 488         if (sdata->local->scanning)
 489                 return;
 490
 491         /* Disregard subsequent beacons if we are already running a timer
 492            processing a CSA */
 493
 494         if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
 495                 return;
 496
 497         new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
 498         if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED)
 499                 return;
 500
 501         sdata->local->csa_channel = new_ch;
 502
 503         if (sdata->local->ops->channel_switch) {
 504                 /* use driver's channel switch callback */
 505                 struct ieee80211_channel_switch ch_switch;
 506                 memset(&ch_switch, 0, sizeof(ch_switch));
 507                 ch_switch.timestamp = timestamp;
 508                 if (sw_elem->mode) {
 509                         ch_switch.block_tx = true;
 510                         ieee80211_stop_queues_by_reason(&sdata->local->hw,
 511                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 512                 }
 513                 ch_switch.channel = new_ch;
 514                 ch_switch.count = sw_elem->count;
 515                 ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
 516                 drv_channel_switch(sdata->local, &ch_switch);
 517                 return;
 518         }
 519
 520         /* channel switch handled in software */
 521         if (sw_elem->count <= 1) {
 522                 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 523         } else {
 524                 if (sw_elem->mode)
 525                         ieee80211_stop_queues_by_reason(&sdata->local->hw,
 526                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 527                 ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
 528                 mod_timer(&ifmgd->chswitch_timer,
 529                           jiffies +
 530                           msecs_to_jiffies(sw_elem->count *
 531                                            cbss->beacon_interval));
 532         }
 533 }
 534
 535 static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
 536                                         u16 capab_info, u8 *pwr_constr_elem,
 537                                         u8 pwr_constr_elem_len)
 538 {
 539         struct ieee80211_conf *conf = &sdata->local->hw.conf;
 540
 541         if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
 542                 return;
 543
 544         /* Power constraint IE length should be 1 octet */
 545         if (pwr_constr_elem_len != 1)
 546                 return;
 547
 548         if ((*pwr_constr_elem <= conf->channel->max_power) &&
 549             (*pwr_constr_elem != sdata->local->power_constr_level)) {
 550                 sdata->local->power_constr_level = *pwr_constr_elem;
 551                 ieee80211_hw_config(sdata->local, 0);
 552         }
 553 }
 554
 555 void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
 556 {
 557         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 558         struct ieee80211_local *local = sdata->local;
 559         struct ieee80211_conf *conf = &local->hw.conf;
 560
 561         WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
 562                 !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
 563                 (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
 564
 565         local->disable_dynamic_ps = false;
 566         conf->dynamic_ps_timeout = local->dynamic_ps_user_timeout;
 567 }
 568 EXPORT_SYMBOL(ieee80211_enable_dyn_ps);
 569
 570 void ieee80211_disable_dyn_ps(struct ieee80211_vif *vif)
 571 {
 572         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 573         struct ieee80211_local *local = sdata->local;
 574         struct ieee80211_conf *conf = &local->hw.conf;
 575
 576         WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
 577                 !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
 578                 (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
 579
 580         local->disable_dynamic_ps = true;
 581         conf->dynamic_ps_timeout = 0;
 582         del_timer_sync(&local->dynamic_ps_timer);
 583         ieee80211_queue_work(&local->hw,
 584                              &local->dynamic_ps_enable_work);
 585 }
 586 EXPORT_SYMBOL(ieee80211_disable_dyn_ps);
 587
 588 /* powersave */
 589 static void ieee80211_enable_ps(struct ieee80211_local *local,
 590                                 struct ieee80211_sub_if_data *sdata)
 591 {
 592         struct ieee80211_conf *conf = &local->hw.conf;
 593
 594         /*
 595          * If we are scanning right now then the parameters will
 596          * take effect when scan finishes.
 597          */
 598         if (local->scanning)
 599                 return;
 600
 601         if (conf->dynamic_ps_timeout > 0 &&
 602             !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
 603                 mod_timer(&local->dynamic_ps_timer, jiffies +
 604                           msecs_to_jiffies(conf->dynamic_ps_timeout));
 605         } else {
 606                 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
 607                         ieee80211_send_nullfunc(local, sdata, 1);
 608
 609                 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
 610                     (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
 611                         return;
 612
 613                 conf->flags |= IEEE80211_CONF_PS;
 614                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 615         }
 616 }
 617
 618 static void ieee80211_change_ps(struct ieee80211_local *local)
 619 {
 620         struct ieee80211_conf *conf = &local->hw.conf;
 621
 622         if (local->ps_sdata) {
 623                 ieee80211_enable_ps(local, local->ps_sdata);
 624         } else if (conf->flags & IEEE80211_CONF_PS) {
 625                 conf->flags &= ~IEEE80211_CONF_PS;
 626                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 627                 del_timer_sync(&local->dynamic_ps_timer);
 628                 cancel_work_sync(&local->dynamic_ps_enable_work);
 629         }
 630 }
 631
 632 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
 633 {
 634         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
 635         struct sta_info *sta = NULL;
 636         bool authorized = false;
 637
 638         if (!mgd->powersave)
 639                 return false;
 640
 641         if (!mgd->associated)
 642                 return false;
 643
 644         if (!mgd->associated->beacon_ies)
 645                 return false;
 646
 647         if (mgd->flags & (IEEE80211_STA_BEACON_POLL |
 648                           IEEE80211_STA_CONNECTION_POLL))
 649                 return false;
 650
 651         rcu_read_lock();
 652         sta = sta_info_get(sdata, mgd->bssid);
 653         if (sta)
 654                 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
 655         rcu_read_unlock();
 656
 657         return authorized;
 658 }
 659
 660 /* need to hold RTNL or interface lock */
 661 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
 662 {
 663         struct ieee80211_sub_if_data *sdata, *found = NULL;
 664         int count = 0;
 665         int timeout;
 666
 667         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
 668                 local->ps_sdata = NULL;
 669                 return;
 670         }
 671
 672         if (!list_empty(&local->work_list)) {
 673                 local->ps_sdata = NULL;
 674                 goto change;
 675         }
 676
 677         list_for_each_entry(sdata, &local->interfaces, list) {
 678                 if (!ieee80211_sdata_running(sdata))
 679                         continue;
 680                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
 681                         /* If an AP vif is found, then disable PS
 682                          * by setting the count to zero thereby setting
 683                          * ps_sdata to NULL.
 684                          */
 685                         count = 0;
 686                         break;
 687                 }
 688                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
 689                         continue;
 690                 found = sdata;
 691                 count++;
 692         }
 693
 694         if (count == 1 && ieee80211_powersave_allowed(found)) {
 695                 struct ieee80211_conf *conf = &local->hw.conf;
 696                 s32 beaconint_us;
 697
 698                 if (latency < 0)
 699                         latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
 700
 701                 beaconint_us = ieee80211_tu_to_usec(
 702                                         found->vif.bss_conf.beacon_int);
 703
 704                 timeout = local->dynamic_ps_forced_timeout;
 705                 if (timeout < 0) {
 706                         /*
 707                          * Go to full PSM if the user configures a very low
 708                          * latency requirement.
 709                          * The 2000 second value is there for compatibility
 710                          * until the PM_QOS_NETWORK_LATENCY is configured
 711                          * with real values.
 712                          */
 713                         if (latency > (1900 * USEC_PER_MSEC) &&
 714                             latency != (2000 * USEC_PER_SEC))
 715                                 timeout = 0;
 716                         else
 717                                 timeout = 100;
 718                 }
 719                 local->dynamic_ps_user_timeout = timeout;
 720                 if (!local->disable_dynamic_ps)
 721                         conf->dynamic_ps_timeout =
 722                                 local->dynamic_ps_user_timeout;
 723
 724                 if (beaconint_us > latency) {
 725                         local->ps_sdata = NULL;
 726                 } else {
 727                         struct ieee80211_bss *bss;
 728                         int maxslp = 1;
 729                         u8 dtimper;
 730
 731                         bss = (void *)found->u.mgd.associated->priv;
 732                         dtimper = bss->dtim_period;
 733
 734                         /* If the TIM IE is invalid, pretend the value is 1 */
 735                         if (!dtimper)
 736                                 dtimper = 1;
 737                         else if (dtimper > 1)
 738                                 maxslp = min_t(int, dtimper,
 739                                                     latency / beaconint_us);
 740
 741                         local->hw.conf.max_sleep_period = maxslp;
 742                         local->hw.conf.ps_dtim_period = dtimper;
 743                         local->ps_sdata = found;
 744                 }
 745         } else {
 746                 local->ps_sdata = NULL;
 747         }
 748
 749  change:
 750         ieee80211_change_ps(local);
 751 }
 752
 753 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
 754 {
 755         struct ieee80211_local *local =
 756                 container_of(work, struct ieee80211_local,
 757                              dynamic_ps_disable_work);
 758
 759         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
 760                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
 761                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 762         }
 763
 764         ieee80211_wake_queues_by_reason(&local->hw,
 765                                         IEEE80211_QUEUE_STOP_REASON_PS);
 766 }
 767
 768 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
 769 {
 770         struct ieee80211_local *local =
 771                 container_of(work, struct ieee80211_local,
 772                              dynamic_ps_enable_work);
 773         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
 774         struct ieee80211_if_managed *ifmgd;
 775         unsigned long flags;
 776         int q;
 777
 778         /* can only happen when PS was just disabled anyway */
 779         if (!sdata)
 780                 return;
 781
 782         ifmgd = &sdata->u.mgd;
 783
 784         if (local->hw.conf.flags & IEEE80211_CONF_PS)
 785                 return;
 786
 787         if (!local->disable_dynamic_ps &&
 788             local->hw.conf.dynamic_ps_timeout > 0) {
 789                 /* don't enter PS if TX frames are pending */
 790                 if (drv_tx_frames_pending(local)) {
 791                         mod_timer(&local->dynamic_ps_timer, jiffies +
 792                                   msecs_to_jiffies(
 793                                   local->hw.conf.dynamic_ps_timeout));
 794                         return;
 795                 }
 796
 797                 /*
 798                  * transmission can be stopped by others which leads to
 799                  * dynamic_ps_timer expiry. Postpone the ps timer if it
 800                  * is not the actual idle state.
 801                  */
 802                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 803                 for (q = 0; q < local->hw.queues; q++) {
 804                         if (local->queue_stop_reasons[q]) {
 805                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
 806                                                        flags);
 807                                 mod_timer(&local->dynamic_ps_timer, jiffies +
 808                                           msecs_to_jiffies(
 809                                           local->hw.conf.dynamic_ps_timeout));
 810                                 return;
 811                         }
 812                 }
 813                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 814         }
 815
 816         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
 817             (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED))) {
 818                 netif_tx_stop_all_queues(sdata->dev);
 819
 820                 if (drv_tx_frames_pending(local))
 821                         mod_timer(&local->dynamic_ps_timer, jiffies +
 822                                   msecs_to_jiffies(
 823                                   local->hw.conf.dynamic_ps_timeout));
 824                 else {
 825                         ieee80211_send_nullfunc(local, sdata, 1);
 826                         /* Flush to get the tx status of nullfunc frame */
 827                         drv_flush(local, false);
 828                 }
 829         }
 830
 831         if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
 832               (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
 833             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
 834                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
 835                 local->hw.conf.flags |= IEEE80211_CONF_PS;
 836                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 837         }
 838
 839         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
 840                 netif_tx_wake_all_queues(sdata->dev);
 841 }
 842
 843 void ieee80211_dynamic_ps_timer(unsigned long data)
 844 {
 845         struct ieee80211_local *local = (void *) data;
 846
 847         if (local->quiescing || local->suspended)
 848                 return;
 849
 850         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
 851 }
 852
 853 /* MLME */
 854 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
 855                                      struct ieee80211_sub_if_data *sdata,
 856                                      u8 *wmm_param, size_t wmm_param_len)
 857 {
 858         struct ieee80211_tx_queue_params params;
 859         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 860         size_t left;
 861         int count;
 862         u8 *pos, uapsd_queues = 0;
 863
 864         if (!local->ops->conf_tx)
 865                 return;
 866
 867         if (local->hw.queues < 4)
 868                 return;
 869
 870         if (!wmm_param)
 871                 return;
 872
 873         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 874                 return;
 875
 876         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
 877                 uapsd_queues = local->uapsd_queues;
 878
 879         count = wmm_param[6] & 0x0f;
 880         if (count == ifmgd->wmm_last_param_set)
 881                 return;
 882         ifmgd->wmm_last_param_set = count;
 883
 884         pos = wmm_param + 8;
 885         left = wmm_param_len - 8;
 886
 887         memset(&params, 0, sizeof(params));
 888
 889         local->wmm_acm = 0;
 890         for (; left >= 4; left -= 4, pos += 4) {
 891                 int aci = (pos[0] >> 5) & 0x03;
 892                 int acm = (pos[0] >> 4) & 0x01;
 893                 bool uapsd = false;
 894                 int queue;
 895
 896                 switch (aci) {
 897                 case 1: /* AC_BK */
 898                         queue = 3;
 899                         if (acm)
 900                                 local->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
 901                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
 902                                 uapsd = true;
 903                         break;
 904                 case 2: /* AC_VI */
 905                         queue = 1;
 906                         if (acm)
 907                                 local->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
 908                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
 909                                 uapsd = true;
 910                         break;
 911                 case 3: /* AC_VO */
 912                         queue = 0;
 913                         if (acm)
 914                                 local->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
 915                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
 916                                 uapsd = true;
 917                         break;
 918                 case 0: /* AC_BE */
 919                 default:
 920                         queue = 2;
 921                         if (acm)
 922                                 local->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
 923                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
 924                                 uapsd = true;
 925                         break;
 926                 }
 927
 928                 params.aifs = pos[0] & 0x0f;
 929                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 930                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 931                 params.txop = get_unaligned_le16(pos + 2);
 932                 params.uapsd = uapsd;
 933
 934 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 935                 wiphy_debug(local->hw.wiphy,
 936                             "WMM queue=%d aci=%d acm=%d aifs=%d "
 937                             "cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
 938                             queue, aci, acm,
 939                             params.aifs, params.cw_min, params.cw_max,
 940                             params.txop, params.uapsd);
 941 #endif
 942                 sdata->tx_conf[queue] = params;
 943                 if (drv_conf_tx(local, sdata, queue, &params))
 944                         wiphy_debug(local->hw.wiphy,
 945                                     "failed to set TX queue parameters for queue %d\n",
 946                                     queue);
 947         }
 948
 949         /* enable WMM or activate new settings */
 950         sdata->vif.bss_conf.qos = true;
 951         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
 952 }
 953
 954 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 955                                            u16 capab, bool erp_valid, u8 erp)
 956 {
 957         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 958         u32 changed = 0;
 959         bool use_protection;
 960         bool use_short_preamble;
 961         bool use_short_slot;
 962
 963         if (erp_valid) {
 964                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
 965                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
 966         } else {
 967                 use_protection = false;
 968                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
 969         }
 970
 971         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
 972         if (sdata->local->hw.conf.channel->band == IEEE80211_BAND_5GHZ)
 973                 use_short_slot = true;
 974
 975         if (use_protection != bss_conf->use_cts_prot) {
 976                 bss_conf->use_cts_prot = use_protection;
 977                 changed |= BSS_CHANGED_ERP_CTS_PROT;
 978         }
 979
 980         if (use_short_preamble != bss_conf->use_short_preamble) {
 981                 bss_conf->use_short_preamble = use_short_preamble;
 982                 changed |= BSS_CHANGED_ERP_PREAMBLE;
 983         }
 984
 985         if (use_short_slot != bss_conf->use_short_slot) {
 986                 bss_conf->use_short_slot = use_short_slot;
 987                 changed |= BSS_CHANGED_ERP_SLOT;
 988         }
 989
 990         return changed;
 991 }
 992
 993 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 994                                      struct cfg80211_bss *cbss,
 995                                      u32 bss_info_changed)
 996 {
 997         struct ieee80211_bss *bss = (void *)cbss->priv;
 998         struct ieee80211_local *local = sdata->local;
 999         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1000
1001         bss_info_changed |= BSS_CHANGED_ASSOC;
1002         /* set timing information */
1003         bss_conf->beacon_int = cbss->beacon_interval;
1004         bss_conf->timestamp = cbss->tsf;
1005
1006         bss_info_changed |= BSS_CHANGED_BEACON_INT;
1007         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1008                 cbss->capability, bss->has_erp_value, bss->erp_value);
1009
1010         sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1011                 IEEE80211_BEACON_LOSS_COUNT * bss_conf->beacon_int));
1012
1013         sdata->u.mgd.associated = cbss;
1014         memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1015
1016         sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
1017
1018         /* just to be sure */
1019         sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
1020                                 IEEE80211_STA_BEACON_POLL);
1021
1022         ieee80211_led_assoc(local, 1);
1023
1024         if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
1025                 bss_conf->dtim_period = bss->dtim_period;
1026         else
1027                 bss_conf->dtim_period = 0;
1028
1029         bss_conf->assoc = 1;
1030         /*
1031          * For now just always ask the driver to update the basic rateset
1032          * when we have associated, we aren't checking whether it actually
1033          * changed or not.
1034          */
1035         bss_info_changed |= BSS_CHANGED_BASIC_RATES;
1036
1037         /* And the BSSID changed - we're associated now */
1038         bss_info_changed |= BSS_CHANGED_BSSID;
1039
1040         /* Tell the driver to monitor connection quality (if supported) */
1041         if ((local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI) &&
1042             bss_conf->cqm_rssi_thold)
1043                 bss_info_changed |= BSS_CHANGED_CQM;
1044
1045         /* Enable ARP filtering */
1046         if (bss_conf->arp_filter_enabled != sdata->arp_filter_state) {
1047                 bss_conf->arp_filter_enabled = sdata->arp_filter_state;
1048                 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
1049         }
1050
1051         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1052
1053         mutex_lock(&local->iflist_mtx);
1054         ieee80211_recalc_ps(local, -1);
1055         ieee80211_recalc_smps(local);
1056         mutex_unlock(&local->iflist_mtx);
1057
1058         netif_tx_start_all_queues(sdata->dev);
1059         netif_carrier_on(sdata->dev);
1060 }
1061
1062 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1063                                    bool remove_sta, bool tx)
1064 {
1065         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1066         struct ieee80211_local *local = sdata->local;
1067         struct sta_info *sta;
1068         u32 changed = 0, config_changed = 0;
1069         u8 bssid[ETH_ALEN];
1070
1071         ASSERT_MGD_MTX(ifmgd);
1072
1073         if (WARN_ON(!ifmgd->associated))
1074                 return;
1075
1076         memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
1077
1078         ifmgd->associated = NULL;
1079         memset(ifmgd->bssid, 0, ETH_ALEN);
1080
1081         /*
1082          * we need to commit the associated = NULL change because the
1083          * scan code uses that to determine whether this iface should
1084          * go to/wake up from powersave or not -- and could otherwise
1085          * wake the queues erroneously.
1086          */
1087         smp_mb();
1088
1089         /*
1090          * Thus, we can only afterwards stop the queues -- to account
1091          * for the case where another CPU is finishing a scan at this
1092          * time -- we don't want the scan code to enable queues.
1093          */
1094
1095         netif_tx_stop_all_queues(sdata->dev);
1096         netif_carrier_off(sdata->dev);
1097
1098         mutex_lock(&local->sta_mtx);
1099         sta = sta_info_get(sdata, bssid);
1100         if (sta) {
1101                 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
1102                 ieee80211_sta_tear_down_BA_sessions(sta, tx);
1103         }
1104         mutex_unlock(&local->sta_mtx);
1105
1106         changed |= ieee80211_reset_erp_info(sdata);
1107
1108         ieee80211_led_assoc(local, 0);
1109         changed |= BSS_CHANGED_ASSOC;
1110         sdata->vif.bss_conf.assoc = false;
1111
1112         ieee80211_set_wmm_default(sdata);
1113
1114         /* channel(_type) changes are handled by ieee80211_hw_config */
1115         WARN_ON(!ieee80211_set_channel_type(local, sdata, NL80211_CHAN_NO_HT));
1116
1117         /* on the next assoc, re-program HT parameters */
1118         sdata->ht_opmode_valid = false;
1119
1120         local->power_constr_level = 0;
1121
1122         del_timer_sync(&local->dynamic_ps_timer);
1123         cancel_work_sync(&local->dynamic_ps_enable_work);
1124
1125         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1126                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1127                 config_changed |= IEEE80211_CONF_CHANGE_PS;
1128         }
1129         local->ps_sdata = NULL;
1130
1131         ieee80211_hw_config(local, config_changed);
1132
1133         /* Disable ARP filtering */
1134         if (sdata->vif.bss_conf.arp_filter_enabled) {
1135                 sdata->vif.bss_conf.arp_filter_enabled = false;
1136                 changed |= BSS_CHANGED_ARP_FILTER;
1137         }
1138
1139         /* The BSSID (not really interesting) and HT changed */
1140         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
1141         ieee80211_bss_info_change_notify(sdata, changed);
1142
1143         /* remove AP and TDLS peers */
1144         if (remove_sta)
1145                 sta_info_flush(local, sdata);
1146
1147         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
1148         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
1149         del_timer_sync(&sdata->u.mgd.timer);
1150         del_timer_sync(&sdata->u.mgd.chswitch_timer);
1151 }
1152
1153 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
1154                              struct ieee80211_hdr *hdr)
1155 {
1156         /*
1157          * We can postpone the mgd.timer whenever receiving unicast frames
1158          * from AP because we know that the connection is working both ways
1159          * at that time. But multicast frames (and hence also beacons) must
1160          * be ignored here, because we need to trigger the timer during
1161          * data idle periods for sending the periodic probe request to the
1162          * AP we're connected to.
1163          */
1164         if (is_multicast_ether_addr(hdr->addr1))
1165                 return;
1166
1167         ieee80211_sta_reset_conn_monitor(sdata);
1168 }
1169
1170 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
1171 {
1172         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1173
1174         if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
1175                               IEEE80211_STA_CONNECTION_POLL)))
1176             return;
1177
1178         ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
1179                           IEEE80211_STA_BEACON_POLL);
1180         mutex_lock(&sdata->local->iflist_mtx);
1181         ieee80211_recalc_ps(sdata->local, -1);
1182         mutex_unlock(&sdata->local->iflist_mtx);
1183
1184         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
1185                 return;
1186
1187         /*
1188          * We've received a probe response, but are not sure whether
1189          * we have or will be receiving any beacons or data, so let's
1190          * schedule the timers again, just in case.
1191          */
1192         ieee80211_sta_reset_beacon_monitor(sdata);
1193
1194         mod_timer(&ifmgd->conn_mon_timer,
1195                   round_jiffies_up(jiffies +
1196                                    IEEE80211_CONNECTION_IDLE_TIME));
1197 }
1198
1199 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
1200                              struct ieee80211_hdr *hdr, bool ack)
1201 {
1202         if (!ieee80211_is_data(hdr->frame_control))
1203             return;
1204
1205         if (ack)
1206                 ieee80211_sta_reset_conn_monitor(sdata);
1207
1208         if (ieee80211_is_nullfunc(hdr->frame_control) &&
1209             sdata->u.mgd.probe_send_count > 0) {
1210                 if (ack)
1211                         sdata->u.mgd.probe_send_count = 0;
1212                 else
1213                         sdata->u.mgd.nullfunc_failed = true;
1214                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1215         }
1216 }
1217
1218 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
1219 {
1220         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1221         const u8 *ssid;
1222         u8 *dst = ifmgd->associated->bssid;
1223         u8 unicast_limit = max(1, max_probe_tries - 3);
1224
1225         /*
1226          * Try sending broadcast probe requests for the last three
1227          * probe requests after the first ones failed since some
1228          * buggy APs only support broadcast probe requests.
1229          */
1230         if (ifmgd->probe_send_count >= unicast_limit)
1231                 dst = NULL;
1232
1233         /*
1234          * When the hardware reports an accurate Tx ACK status, it's
1235          * better to send a nullfunc frame instead of a probe request,
1236          * as it will kick us off the AP quickly if we aren't associated
1237          * anymore. The timeout will be reset if the frame is ACKed by
1238          * the AP.
1239          */
1240         if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
1241                 ifmgd->nullfunc_failed = false;
1242                 ieee80211_send_nullfunc(sdata->local, sdata, 0);
1243         } else {
1244                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
1245                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0,
1246                                          (u32) -1, true, false);
1247         }
1248
1249         ifmgd->probe_send_count++;
1250         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
1251         run_again(ifmgd, ifmgd->probe_timeout);
1252 }
1253
1254 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
1255                                    bool beacon)
1256 {
1257         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1258         bool already = false;
1259
1260         if (!ieee80211_sdata_running(sdata))
1261                 return;
1262
1263         if (sdata->local->scanning)
1264                 return;
1265
1266         if (sdata->local->tmp_channel)
1267                 return;
1268
1269         mutex_lock(&ifmgd->mtx);
1270
1271         if (!ifmgd->associated)
1272                 goto out;
1273
1274 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1275         if (beacon && net_ratelimit())
1276                 printk(KERN_DEBUG "%s: detected beacon loss from AP "
1277                        "- sending probe request\n", sdata->name);
1278 #endif
1279
1280         /*
1281          * The driver/our work has already reported this event or the
1282          * connection monitoring has kicked in and we have already sent
1283          * a probe request. Or maybe the AP died and the driver keeps
1284          * reporting until we disassociate...
1285          *
1286          * In either case we have to ignore the current call to this
1287          * function (except for setting the correct probe reason bit)
1288          * because otherwise we would reset the timer every time and
1289          * never check whether we received a probe response!
1290          */
1291         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
1292                             IEEE80211_STA_CONNECTION_POLL))
1293                 already = true;
1294
1295         if (beacon)
1296                 ifmgd->flags |= IEEE80211_STA_BEACON_POLL;
1297         else
1298                 ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
1299
1300         if (already)
1301                 goto out;
1302
1303         mutex_lock(&sdata->local->iflist_mtx);
1304         ieee80211_recalc_ps(sdata->local, -1);
1305         mutex_unlock(&sdata->local->iflist_mtx);
1306
1307         ifmgd->probe_send_count = 0;
1308         ieee80211_mgd_probe_ap_send(sdata);
1309  out:
1310         mutex_unlock(&ifmgd->mtx);
1311 }
1312
1313 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
1314                                           struct ieee80211_vif *vif)
1315 {
1316         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1317         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1318         struct sk_buff *skb;
1319         const u8 *ssid;
1320
1321         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1322                 return NULL;
1323
1324         ASSERT_MGD_MTX(ifmgd);
1325
1326         if (!ifmgd->associated)
1327                 return NULL;
1328
1329         ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
1330         skb = ieee80211_build_probe_req(sdata, ifmgd->associated->bssid,
1331                                         (u32) -1, ssid + 2, ssid[1],
1332                                         NULL, 0, true);
1333
1334         return skb;
1335 }
1336 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
1337
1338 static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
1339 {
1340         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1341         struct ieee80211_local *local = sdata->local;
1342         u8 bssid[ETH_ALEN];
1343
1344         mutex_lock(&ifmgd->mtx);
1345         if (!ifmgd->associated) {
1346                 mutex_unlock(&ifmgd->mtx);
1347                 return;
1348         }
1349
1350         memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
1351
1352         printk(KERN_DEBUG "%s: Connection to AP %pM lost.\n",
1353                sdata->name, bssid);
1354
1355         ieee80211_set_disassoc(sdata, true, true);
1356         mutex_unlock(&ifmgd->mtx);
1357
1358         mutex_lock(&local->mtx);
1359         ieee80211_recalc_idle(local);
1360         mutex_unlock(&local->mtx);
1361         /*
1362          * must be outside lock due to cfg80211,
1363          * but that's not a problem.
1364          */
1365         ieee80211_send_deauth_disassoc(sdata, bssid,
1366                                        IEEE80211_STYPE_DEAUTH,
1367                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
1368                                        NULL, true);
1369 }
1370
1371 void ieee80211_beacon_connection_loss_work(struct work_struct *work)
1372 {
1373         struct ieee80211_sub_if_data *sdata =
1374                 container_of(work, struct ieee80211_sub_if_data,
1375                              u.mgd.beacon_connection_loss_work);
1376
1377         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
1378                 __ieee80211_connection_loss(sdata);
1379         else
1380                 ieee80211_mgd_probe_ap(sdata, true);
1381 }
1382
1383 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
1384 {
1385         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1386         struct ieee80211_hw *hw = &sdata->local->hw;
1387
1388         trace_api_beacon_loss(sdata);
1389
1390         WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
1391         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
1392 }
1393 EXPORT_SYMBOL(ieee80211_beacon_loss);
1394
1395 void ieee80211_connection_loss(struct ieee80211_vif *vif)
1396 {
1397         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1398         struct ieee80211_hw *hw = &sdata->local->hw;
1399
1400         trace_api_connection_loss(sdata);
1401
1402         WARN_ON(!(hw->flags & IEEE80211_HW_CONNECTION_MONITOR));
1403         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
1404 }
1405 EXPORT_SYMBOL(ieee80211_connection_loss);
1406
1407
1408 static enum rx_mgmt_action __must_check
1409 ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
1410                          struct ieee80211_mgmt *mgmt, size_t len)
1411 {
1412         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1413         const u8 *bssid = NULL;
1414         u16 reason_code;
1415
1416         if (len < 24 + 2)
1417                 return RX_MGMT_NONE;
1418
1419         ASSERT_MGD_MTX(ifmgd);
1420
1421         bssid = ifmgd->associated->bssid;
1422
1423         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1424
1425         printk(KERN_DEBUG "%s: deauthenticated from %pM (Reason: %u)\n",
1426                         sdata->name, bssid, reason_code);
1427
1428         ieee80211_set_disassoc(sdata, true, false);
1429         mutex_lock(&sdata->local->mtx);
1430         ieee80211_recalc_idle(sdata->local);
1431         mutex_unlock(&sdata->local->mtx);
1432
1433         return RX_MGMT_CFG80211_DEAUTH;
1434 }
1435
1436
1437 static enum rx_mgmt_action __must_check
1438 ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
1439                            struct ieee80211_mgmt *mgmt, size_t len)
1440 {
1441         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1442         u16 reason_code;
1443
1444         if (len < 24 + 2)
1445                 return RX_MGMT_NONE;
1446
1447         ASSERT_MGD_MTX(ifmgd);
1448
1449         if (WARN_ON(!ifmgd->associated))
1450                 return RX_MGMT_NONE;
1451
1452         if (WARN_ON(memcmp(ifmgd->associated->bssid, mgmt->sa, ETH_ALEN)))
1453                 return RX_MGMT_NONE;
1454
1455         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1456
1457         printk(KERN_DEBUG "%s: disassociated from %pM (Reason: %u)\n",
1458                         sdata->name, mgmt->sa, reason_code);
1459
1460         ieee80211_set_disassoc(sdata, true, false);
1461         mutex_lock(&sdata->local->mtx);
1462         ieee80211_recalc_idle(sdata->local);
1463         mutex_unlock(&sdata->local->mtx);
1464         return RX_MGMT_CFG80211_DISASSOC;
1465 }
1466
1467
1468 static bool ieee80211_assoc_success(struct ieee80211_work *wk,
1469                                     struct ieee80211_mgmt *mgmt, size_t len)
1470 {
1471         struct ieee80211_sub_if_data *sdata = wk->sdata;
1472         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1473         struct ieee80211_local *local = sdata->local;
1474         struct ieee80211_supported_band *sband;
1475         struct sta_info *sta;
1476         struct cfg80211_bss *cbss = wk->assoc.bss;
1477         u8 *pos;
1478         u32 rates, basic_rates;
1479         u16 capab_info, aid;
1480         struct ieee802_11_elems elems;
1481         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1482         u32 changed = 0;
1483         int i, j, err;
1484         bool have_higher_than_11mbit = false;
1485         u16 ap_ht_cap_flags;
1486
1487         /* AssocResp and ReassocResp have identical structure */
1488
1489         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1490         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1491
1492         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1493                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1494                        "set\n", sdata->name, aid);
1495         aid &= ~(BIT(15) | BIT(14));
1496
1497         pos = mgmt->u.assoc_resp.variable;
1498         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1499
1500         if (!elems.supp_rates) {
1501                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1502                        sdata->name);
1503                 return false;
1504         }
1505
1506         ifmgd->aid = aid;
1507
1508         mutex_lock(&sdata->local->sta_mtx);
1509         /*
1510          * station info was already allocated and inserted before
1511          * the association and should be available to us
1512          */
1513         sta = sta_info_get_rx(sdata, cbss->bssid);
1514         if (WARN_ON(!sta)) {
1515                 mutex_unlock(&sdata->local->sta_mtx);
1516                 return false;
1517         }
1518
1519         set_sta_flag(sta, WLAN_STA_AUTH);
1520         set_sta_flag(sta, WLAN_STA_ASSOC);
1521         set_sta_flag(sta, WLAN_STA_ASSOC_AP);
1522         if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
1523                 set_sta_flag(sta, WLAN_STA_AUTHORIZED);
1524
1525         rates = 0;
1526         basic_rates = 0;
1527         sband = local->hw.wiphy->bands[wk->chan->band];
1528
1529         for (i = 0; i < elems.supp_rates_len; i++) {
1530                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1531                 bool is_basic = !!(elems.supp_rates[i] & 0x80);
1532
1533                 if (rate > 110)
1534                         have_higher_than_11mbit = true;
1535
1536                 for (j = 0; j < sband->n_bitrates; j++) {
1537                         if (sband->bitrates[j].bitrate == rate) {
1538                                 rates |= BIT(j);
1539                                 if (is_basic)
1540                                         basic_rates |= BIT(j);
1541                                 break;
1542                         }
1543                 }
1544         }
1545
1546         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1547                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1548                 bool is_basic = !!(elems.ext_supp_rates[i] & 0x80);
1549
1550                 if (rate > 110)
1551                         have_higher_than_11mbit = true;
1552
1553                 for (j = 0; j < sband->n_bitrates; j++) {
1554                         if (sband->bitrates[j].bitrate == rate) {
1555                                 rates |= BIT(j);
1556                                 if (is_basic)
1557                                         basic_rates |= BIT(j);
1558                                 break;
1559                         }
1560                 }
1561         }
1562
1563         sta->sta.supp_rates[wk->chan->band] = rates;
1564         sdata->vif.bss_conf.basic_rates = basic_rates;
1565
1566         /* cf. IEEE 802.11 9.2.12 */
1567         if (wk->chan->band == IEEE80211_BAND_2GHZ &&
1568             have_higher_than_11mbit)
1569                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
1570         else
1571                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
1572
1573         if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
1574                 ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
1575                                 elems.ht_cap_elem, &sta->sta.ht_cap);
1576
1577         ap_ht_cap_flags = sta->sta.ht_cap.cap;
1578
1579         rate_control_rate_init(sta);
1580
1581         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
1582                 set_sta_flag(sta, WLAN_STA_MFP);
1583
1584         if (elems.wmm_param)
1585                 set_sta_flag(sta, WLAN_STA_WME);
1586
1587         /* sta_info_reinsert will also unlock the mutex lock */
1588         err = sta_info_reinsert(sta);
1589         sta = NULL;
1590         if (err) {
1591                 printk(KERN_DEBUG "%s: failed to insert STA entry for"
1592                        " the AP (error %d)\n", sdata->name, err);
1593                 return false;
1594         }
1595
1596         /*
1597          * Always handle WMM once after association regardless
1598          * of the first value the AP uses. Setting -1 here has
1599          * that effect because the AP values is an unsigned
1600          * 4-bit value.
1601          */
1602         ifmgd->wmm_last_param_set = -1;
1603
1604         if (elems.wmm_param)
1605                 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
1606                                          elems.wmm_param_len);
1607         else
1608                 ieee80211_set_wmm_default(sdata);
1609
1610         local->oper_channel = wk->chan;
1611
1612         if (elems.ht_info_elem && elems.wmm_param &&
1613             (sdata->local->hw.queues >= 4) &&
1614             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
1615                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
1616                                                cbss->bssid, ap_ht_cap_flags,
1617                                                false);
1618
1619         /* set AID and assoc capability,
1620          * ieee80211_set_associated() will tell the driver */
1621         bss_conf->aid = aid;
1622         bss_conf->assoc_capability = capab_info;
1623         ieee80211_set_associated(sdata, cbss, changed);
1624
1625         /*
1626          * If we're using 4-addr mode, let the AP know that we're
1627          * doing so, so that it can create the STA VLAN on its side
1628          */
1629         if (ifmgd->use_4addr)
1630                 ieee80211_send_4addr_nullfunc(local, sdata);
1631
1632         /*
1633          * Start timer to probe the connection to the AP now.
1634          * Also start the timer that will detect beacon loss.
1635          */
1636         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
1637         ieee80211_sta_reset_beacon_monitor(sdata);
1638
1639         return true;
1640 }
1641
1642
1643 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
1644                                   struct ieee80211_mgmt *mgmt,
1645                                   size_t len,
1646                                   struct ieee80211_rx_status *rx_status,
1647                                   struct ieee802_11_elems *elems,
1648                                   bool beacon)
1649 {
1650         struct ieee80211_local *local = sdata->local;
1651         int freq;
1652         struct ieee80211_bss *bss;
1653         struct ieee80211_channel *channel;
1654         bool need_ps = false;
1655
1656         if (sdata->u.mgd.associated) {
1657                 bss = (void *)sdata->u.mgd.associated->priv;
1658                 /* not previously set so we may need to recalc */
1659                 need_ps = !bss->dtim_period;
1660         }
1661
1662         if (elems->ds_params && elems->ds_params_len == 1)
1663                 freq = ieee80211_channel_to_frequency(elems->ds_params[0],
1664                                                       rx_status->band);
1665         else
1666                 freq = rx_status->freq;
1667
1668         channel = ieee80211_get_channel(local->hw.wiphy, freq);
1669
1670         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
1671                 return;
1672
1673         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
1674                                         channel, beacon);
1675         if (bss)
1676                 ieee80211_rx_bss_put(local, bss);
1677
1678         if (!sdata->u.mgd.associated)
1679                 return;
1680
1681         if (need_ps) {
1682                 mutex_lock(&local->iflist_mtx);
1683                 ieee80211_recalc_ps(local, -1);
1684                 mutex_unlock(&local->iflist_mtx);
1685         }
1686
1687         if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
1688             (memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid,
1689                                                         ETH_ALEN) == 0)) {
1690                 struct ieee80211_channel_sw_ie *sw_elem =
1691                         (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
1692                 ieee80211_sta_process_chanswitch(sdata, sw_elem,
1693                                                  bss, rx_status->mactime);
1694         }
1695 }
1696
1697
1698 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
1699                                          struct sk_buff *skb)
1700 {
1701         struct ieee80211_mgmt *mgmt = (void *)skb->data;
1702         struct ieee80211_if_managed *ifmgd;
1703         struct ieee80211_rx_status *rx_status = (void *) skb->cb;
1704         size_t baselen, len = skb->len;
1705         struct ieee802_11_elems elems;
1706
1707         ifmgd = &sdata->u.mgd;
1708
1709         ASSERT_MGD_MTX(ifmgd);
1710
1711         if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
1712                 return; /* ignore ProbeResp to foreign address */
1713
1714         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
1715         if (baselen > len)
1716                 return;
1717
1718         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
1719                                 &elems);
1720
1721         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
1722
1723         if (ifmgd->associated &&
1724             memcmp(mgmt->bssid, ifmgd->associated->bssid, ETH_ALEN) == 0)
1725                 ieee80211_reset_ap_probe(sdata);
1726 }
1727
1728 /*
1729  * This is the canonical list of information elements we care about,
1730  * the filter code also gives us all changes to the Microsoft OUI
1731  * (00:50:F2) vendor IE which is used for WMM which we need to track.
1732  *
1733  * We implement beacon filtering in software since that means we can
1734  * avoid processing the frame here and in cfg80211, and userspace
1735  * will not be able to tell whether the hardware supports it or not.
1736  *
1737  * XXX: This list needs to be dynamic -- userspace needs to be able to
1738  *      add items it requires. It also needs to be able to tell us to
1739  *      look out for other vendor IEs.
1740  */
1741 static const u64 care_about_ies =
1742         (1ULL << WLAN_EID_COUNTRY) |
1743         (1ULL << WLAN_EID_ERP_INFO) |
1744         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
1745         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
1746         (1ULL << WLAN_EID_HT_CAPABILITY) |
1747         (1ULL << WLAN_EID_HT_INFORMATION);
1748
1749 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
1750                                      struct ieee80211_mgmt *mgmt,
1751                                      size_t len,
1752                                      struct ieee80211_rx_status *rx_status)
1753 {
1754         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1755         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1756         size_t baselen;
1757         struct ieee802_11_elems elems;
1758         struct ieee80211_local *local = sdata->local;
1759         u32 changed = 0;
1760         bool erp_valid, directed_tim = false;
1761         u8 erp_value = 0;
1762         u32 ncrc;
1763         u8 *bssid;
1764
1765         ASSERT_MGD_MTX(ifmgd);
1766
1767         /* Process beacon from the current BSS */
1768         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1769         if (baselen > len)
1770                 return;
1771
1772         if (rx_status->freq != local->hw.conf.channel->center_freq)
1773                 return;
1774
1775         /*
1776          * We might have received a number of frames, among them a
1777          * disassoc frame and a beacon...
1778          */
1779         if (!ifmgd->associated)
1780                 return;
1781
1782         bssid = ifmgd->associated->bssid;
1783
1784         /*
1785          * And in theory even frames from a different AP we were just
1786          * associated to a split-second ago!
1787          */
1788         if (memcmp(bssid, mgmt->bssid, ETH_ALEN) != 0)
1789                 return;
1790
1791         /* Track average RSSI from the Beacon frames of the current AP */
1792         ifmgd->last_beacon_signal = rx_status->signal;
1793         if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
1794                 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
1795                 ifmgd->ave_beacon_signal = rx_status->signal * 16;
1796                 ifmgd->last_cqm_event_signal = 0;
1797                 ifmgd->count_beacon_signal = 1;
1798                 ifmgd->last_ave_beacon_signal = 0;
1799         } else {
1800                 ifmgd->ave_beacon_signal =
1801                         (IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
1802                          (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
1803                          ifmgd->ave_beacon_signal) / 16;
1804                 ifmgd->count_beacon_signal++;
1805         }
1806
1807         if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
1808             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
1809                 int sig = ifmgd->ave_beacon_signal;
1810                 int last_sig = ifmgd->last_ave_beacon_signal;
1811
1812                 /*
1813                  * if signal crosses either of the boundaries, invoke callback
1814                  * with appropriate parameters
1815                  */
1816                 if (sig > ifmgd->rssi_max_thold &&
1817                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
1818                         ifmgd->last_ave_beacon_signal = sig;
1819                         drv_rssi_callback(local, RSSI_EVENT_HIGH);
1820                 } else if (sig < ifmgd->rssi_min_thold &&
1821                            (last_sig >= ifmgd->rssi_max_thold ||
1822                            last_sig == 0)) {
1823                         ifmgd->last_ave_beacon_signal = sig;
1824                         drv_rssi_callback(local, RSSI_EVENT_LOW);
1825                 }
1826         }
1827
1828         if (bss_conf->cqm_rssi_thold &&
1829             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
1830             !(local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI)) {
1831                 int sig = ifmgd->ave_beacon_signal / 16;
1832                 int last_event = ifmgd->last_cqm_event_signal;
1833                 int thold = bss_conf->cqm_rssi_thold;
1834                 int hyst = bss_conf->cqm_rssi_hyst;
1835                 if (sig < thold &&
1836                     (last_event == 0 || sig < last_event - hyst)) {
1837                         ifmgd->last_cqm_event_signal = sig;
1838                         ieee80211_cqm_rssi_notify(
1839                                 &sdata->vif,
1840                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
1841                                 GFP_KERNEL);
1842                 } else if (sig > thold &&
1843                            (last_event == 0 || sig > last_event + hyst)) {
1844                         ifmgd->last_cqm_event_signal = sig;
1845                         ieee80211_cqm_rssi_notify(
1846                                 &sdata->vif,
1847                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
1848                                 GFP_KERNEL);
1849                 }
1850         }
1851
1852         if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
1853 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1854                 if (net_ratelimit()) {
1855                         printk(KERN_DEBUG "%s: cancelling probereq poll due "
1856                                "to a received beacon\n", sdata->name);
1857                 }
1858 #endif
1859                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
1860                 mutex_lock(&local->iflist_mtx);
1861                 ieee80211_recalc_ps(local, -1);
1862                 mutex_unlock(&local->iflist_mtx);
1863         }
1864
1865         /*
1866          * Push the beacon loss detection into the future since
1867          * we are processing a beacon from the AP just now.
1868          */
1869         ieee80211_sta_reset_beacon_monitor(sdata);
1870
1871         ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
1872         ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
1873                                           len - baselen, &elems,
1874                                           care_about_ies, ncrc);
1875
1876         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1877                 directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
1878                                                    ifmgd->aid);
1879
1880         if (ncrc != ifmgd->beacon_crc || !ifmgd->beacon_crc_valid) {
1881                 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
1882                                       true);
1883
1884                 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
1885                                          elems.wmm_param_len);
1886         }
1887
1888         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
1889                 if (directed_tim) {
1890                         if (local->hw.conf.dynamic_ps_timeout > 0) {
1891                                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1892                                 ieee80211_hw_config(local,
1893                                                     IEEE80211_CONF_CHANGE_PS);
1894                                 ieee80211_send_nullfunc(local, sdata, 0);
1895                         } else {
1896                                 local->pspolling = true;
1897
1898                                 /*
1899                                  * Here is assumed that the driver will be
1900                                  * able to send ps-poll frame and receive a
1901                                  * response even though power save mode is
1902                                  * enabled, but some drivers might require
1903                                  * to disable power save here. This needs
1904                                  * to be investigated.
1905                                  */
1906                                 ieee80211_send_pspoll(local, sdata);
1907                         }
1908                 }
1909         }
1910
1911         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
1912                 return;
1913         ifmgd->beacon_crc = ncrc;
1914         ifmgd->beacon_crc_valid = true;
1915
1916         if (elems.erp_info && elems.erp_info_len >= 1) {
1917                 erp_valid = true;
1918                 erp_value = elems.erp_info[0];
1919         } else {
1920                 erp_valid = false;
1921         }
1922         changed |= ieee80211_handle_bss_capability(sdata,
1923                         le16_to_cpu(mgmt->u.beacon.capab_info),
1924                         erp_valid, erp_value);
1925
1926
1927         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
1928             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N)) {
1929                 struct sta_info *sta;
1930                 struct ieee80211_supported_band *sband;
1931                 u16 ap_ht_cap_flags;
1932
1933                 rcu_read_lock();
1934
1935                 sta = sta_info_get(sdata, bssid);
1936                 if (WARN_ON(!sta)) {
1937                         rcu_read_unlock();
1938                         return;
1939                 }
1940
1941                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1942
1943                 ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
1944                                 elems.ht_cap_elem, &sta->sta.ht_cap);
1945
1946                 ap_ht_cap_flags = sta->sta.ht_cap.cap;
1947
1948                 rcu_read_unlock();
1949
1950                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
1951                                                bssid, ap_ht_cap_flags, true);
1952         }
1953
1954         /* Note: country IE parsing is done for us by cfg80211 */
1955         if (elems.country_elem) {
1956                 /* TODO: IBSS also needs this */
1957                 if (elems.pwr_constr_elem)
1958                         ieee80211_handle_pwr_constr(sdata,
1959                                 le16_to_cpu(mgmt->u.probe_resp.capab_info),
1960                                 elems.pwr_constr_elem,
1961                                 elems.pwr_constr_elem_len);
1962         }
1963
1964         ieee80211_bss_info_change_notify(sdata, changed);
1965 }
1966
1967 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
1968                                   struct sk_buff *skb)
1969 {
1970         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1971         struct ieee80211_rx_status *rx_status;
1972         struct ieee80211_mgmt *mgmt;
1973         enum rx_mgmt_action rma = RX_MGMT_NONE;
1974         u16 fc;
1975
1976         rx_status = (struct ieee80211_rx_status *) skb->cb;
1977         mgmt = (struct ieee80211_mgmt *) skb->data;
1978         fc = le16_to_cpu(mgmt->frame_control);
1979
1980         mutex_lock(&ifmgd->mtx);
1981
1982         if (ifmgd->associated &&
1983             memcmp(ifmgd->associated->bssid, mgmt->bssid, ETH_ALEN) == 0) {
1984                 switch (fc & IEEE80211_FCTL_STYPE) {
1985                 case IEEE80211_STYPE_BEACON:
1986                         ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
1987                                                  rx_status);
1988                         break;
1989                 case IEEE80211_STYPE_PROBE_RESP:
1990                         ieee80211_rx_mgmt_probe_resp(sdata, skb);
1991                         break;
1992                 case IEEE80211_STYPE_DEAUTH:
1993                         rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
1994                         break;
1995                 case IEEE80211_STYPE_DISASSOC:
1996                         rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
1997                         break;
1998                 case IEEE80211_STYPE_ACTION:
1999                         switch (mgmt->u.action.category) {
2000                         case WLAN_CATEGORY_SPECTRUM_MGMT:
2001                                 ieee80211_sta_process_chanswitch(sdata,
2002                                                 &mgmt->u.action.u.chan_switch.sw_elem,
2003                                                 (void *)ifmgd->associated->priv,
2004                                                 rx_status->mactime);
2005                                 break;
2006                         }
2007                 }
2008                 mutex_unlock(&ifmgd->mtx);
2009
2010                 switch (rma) {
2011                 case RX_MGMT_NONE:
2012                         /* no action */
2013                         break;
2014                 case RX_MGMT_CFG80211_DEAUTH:
2015                         cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
2016                         break;
2017                 case RX_MGMT_CFG80211_DISASSOC:
2018                         cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
2019                         break;
2020                 default:
2021                         WARN(1, "unexpected: %d", rma);
2022                 }
2023                 return;
2024         }
2025
2026         mutex_unlock(&ifmgd->mtx);
2027
2028         if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&
2029             (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) {
2030                 struct ieee80211_local *local = sdata->local;
2031                 struct ieee80211_work *wk;
2032
2033                 mutex_lock(&local->mtx);
2034                 list_for_each_entry(wk, &local->work_list, list) {
2035                         if (wk->sdata != sdata)
2036                                 continue;
2037
2038                         if (wk->type != IEEE80211_WORK_ASSOC &&
2039                             wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
2040                                 continue;
2041
2042                         if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN))
2043                                 continue;
2044                         if (memcmp(mgmt->sa, wk->filter_ta, ETH_ALEN))
2045                                 continue;
2046
2047                         /*
2048                          * Printing the message only here means we can't
2049                          * spuriously print it, but it also means that it
2050                          * won't be printed when the frame comes in before
2051                          * we even tried to associate or in similar cases.
2052                          *
2053                          * Ultimately, I suspect cfg80211 should print the
2054                          * messages instead.
2055                          */
2056                         printk(KERN_DEBUG
2057                                "%s: deauthenticated from %pM (Reason: %u)\n",
2058                                sdata->name, mgmt->bssid,
2059                                le16_to_cpu(mgmt->u.deauth.reason_code));
2060
2061                         list_del_rcu(&wk->list);
2062                         free_work(wk);
2063                         break;
2064                 }
2065                 mutex_unlock(&local->mtx);
2066
2067                 cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
2068         }
2069 }
2070
2071 static void ieee80211_sta_timer(unsigned long data)
2072 {
2073         struct ieee80211_sub_if_data *sdata =
2074                 (struct ieee80211_sub_if_data *) data;
2075         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2076         struct ieee80211_local *local = sdata->local;
2077
2078         if (local->quiescing) {
2079                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
2080                 return;
2081         }
2082
2083         ieee80211_queue_work(&local->hw, &sdata->work);
2084 }
2085
2086 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
2087                                           u8 *bssid, u8 reason)
2088 {
2089         struct ieee80211_local *local = sdata->local;
2090         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2091
2092         ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
2093                           IEEE80211_STA_BEACON_POLL);
2094
2095         ieee80211_set_disassoc(sdata, true, true);
2096         mutex_unlock(&ifmgd->mtx);
2097         mutex_lock(&local->mtx);
2098         ieee80211_recalc_idle(local);
2099         mutex_unlock(&local->mtx);
2100         /*
2101          * must be outside lock due to cfg80211,
2102          * but that's not a problem.
2103          */
2104         ieee80211_send_deauth_disassoc(sdata, bssid,
2105                         IEEE80211_STYPE_DEAUTH, reason,
2106                         NULL, true);
2107         mutex_lock(&ifmgd->mtx);
2108 }
2109
2110 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
2111 {
2112         struct ieee80211_local *local = sdata->local;
2113         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2114
2115         /* then process the rest of the work */
2116         mutex_lock(&ifmgd->mtx);
2117
2118         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
2119                             IEEE80211_STA_CONNECTION_POLL) &&
2120             ifmgd->associated) {
2121                 u8 bssid[ETH_ALEN];
2122                 int max_tries;
2123
2124                 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
2125
2126                 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2127                         max_tries = max_nullfunc_tries;
2128                 else
2129                         max_tries = max_probe_tries;
2130
2131                 /* ACK received for nullfunc probing frame */
2132                 if (!ifmgd->probe_send_count)
2133                         ieee80211_reset_ap_probe(sdata);
2134                 else if (ifmgd->nullfunc_failed) {
2135                         if (ifmgd->probe_send_count < max_tries) {
2136 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2137                                 wiphy_debug(local->hw.wiphy,
2138                                             "%s: No ack for nullfunc frame to"
2139                                             " AP %pM, try %d/%i\n",
2140                                             sdata->name, bssid,
2141                                             ifmgd->probe_send_count, max_tries);
2142 #endif
2143                                 ieee80211_mgd_probe_ap_send(sdata);
2144                         } else {
2145 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2146                                 wiphy_debug(local->hw.wiphy,
2147                                             "%s: No ack for nullfunc frame to"
2148                                             " AP %pM, disconnecting.\n",
2149                                             sdata->name, bssid);
2150 #endif
2151                                 ieee80211_sta_connection_lost(sdata, bssid,
2152                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
2153                         }
2154                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
2155                         run_again(ifmgd, ifmgd->probe_timeout);
2156                 else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
2157 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2158                         wiphy_debug(local->hw.wiphy,
2159                                     "%s: Failed to send nullfunc to AP %pM"
2160                                     " after %dms, disconnecting.\n",
2161                                     sdata->name,
2162                                     bssid, probe_wait_ms);
2163 #endif
2164                         ieee80211_sta_connection_lost(sdata, bssid,
2165                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
2166                 } else if (ifmgd->probe_send_count < max_tries) {
2167 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2168                         wiphy_debug(local->hw.wiphy,
2169                                     "%s: No probe response from AP %pM"
2170                                     " after %dms, try %d/%i\n",
2171                                     sdata->name,
2172                                     bssid, probe_wait_ms,
2173                                     ifmgd->probe_send_count, max_tries);
2174 #endif
2175                         ieee80211_mgd_probe_ap_send(sdata);
2176                 } else {
2177                         /*
2178                          * We actually lost the connection ... or did we?
2179                          * Let's make sure!
2180                          */
2181                         wiphy_debug(local->hw.wiphy,
2182                                     "%s: No probe response from AP %pM"
2183                                     " after %dms, disconnecting.\n",
2184                                     sdata->name,
2185                                     bssid, probe_wait_ms);
2186
2187                         ieee80211_sta_connection_lost(sdata, bssid,
2188                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
2189                 }
2190         }
2191
2192         mutex_unlock(&ifmgd->mtx);
2193 }
2194
2195 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
2196 {
2197         struct ieee80211_sub_if_data *sdata =
2198                 (struct ieee80211_sub_if_data *) data;
2199         struct ieee80211_local *local = sdata->local;
2200
2201         if (local->quiescing)
2202                 return;
2203
2204         ieee80211_queue_work(&sdata->local->hw,
2205                              &sdata->u.mgd.beacon_connection_loss_work);
2206 }
2207
2208 static void ieee80211_sta_conn_mon_timer(unsigned long data)
2209 {
2210         struct ieee80211_sub_if_data *sdata =
2211                 (struct ieee80211_sub_if_data *) data;
2212         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2213         struct ieee80211_local *local = sdata->local;
2214
2215         if (local->quiescing)
2216                 return;
2217
2218         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
2219 }
2220
2221 static void ieee80211_sta_monitor_work(struct work_struct *work)
2222 {
2223         struct ieee80211_sub_if_data *sdata =
2224                 container_of(work, struct ieee80211_sub_if_data,
2225                              u.mgd.monitor_work);
2226
2227         ieee80211_mgd_probe_ap(sdata, false);
2228 }
2229
2230 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
2231 {
2232         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2233                 sdata->u.mgd.flags &= ~(IEEE80211_STA_BEACON_POLL |
2234                                         IEEE80211_STA_CONNECTION_POLL);
2235
2236                 /* let's probe the connection once */
2237                 ieee80211_queue_work(&sdata->local->hw,
2238                            &sdata->u.mgd.monitor_work);
2239                 /* and do all the other regular work too */
2240                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2241         }
2242 }
2243
2244 #ifdef CONFIG_PM
2245 void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
2246 {
2247         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2248
2249         /*
2250          * we need to use atomic bitops for the running bits
2251          * only because both timers might fire at the same
2252          * time -- the code here is properly synchronised.
2253          */
2254
2255         cancel_work_sync(&ifmgd->request_smps_work);
2256
2257         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
2258         if (del_timer_sync(&ifmgd->timer))
2259                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
2260
2261         cancel_work_sync(&ifmgd->chswitch_work);
2262         if (del_timer_sync(&ifmgd->chswitch_timer))
2263                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
2264
2265         cancel_work_sync(&ifmgd->monitor_work);
2266         /* these will just be re-established on connection */
2267         del_timer_sync(&ifmgd->conn_mon_timer);
2268         del_timer_sync(&ifmgd->bcn_mon_timer);
2269 }
2270
2271 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
2272 {
2273         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2274
2275         if (!ifmgd->associated)
2276                 return;
2277
2278         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
2279                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
2280                 mutex_lock(&ifmgd->mtx);
2281                 if (ifmgd->associated) {
2282 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2283                         wiphy_debug(sdata->local->hw.wiphy,
2284                                     "%s: driver requested disconnect after resume.\n",
2285                                     sdata->name);
2286 #endif
2287                         ieee80211_sta_connection_lost(sdata,
2288                                 ifmgd->associated->bssid,
2289                                 WLAN_REASON_UNSPECIFIED);
2290                         mutex_unlock(&ifmgd->mtx);
2291                         return;
2292                 }
2293                 mutex_unlock(&ifmgd->mtx);
2294         }
2295
2296         if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
2297                 add_timer(&ifmgd->timer);
2298         if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
2299                 add_timer(&ifmgd->chswitch_timer);
2300         ieee80211_sta_reset_beacon_monitor(sdata);
2301         ieee80211_restart_sta_timer(sdata);
2302         ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.monitor_work);
2303 }
2304 #endif
2305
2306 /* interface setup */
2307 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
2308 {
2309         struct ieee80211_if_managed *ifmgd;
2310
2311         ifmgd = &sdata->u.mgd;
2312         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
2313         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
2314         INIT_WORK(&ifmgd->beacon_connection_loss_work,
2315                   ieee80211_beacon_connection_loss_work);
2316         INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_work);
2317         setup_timer(&ifmgd->timer, ieee80211_sta_timer,
2318                     (unsigned long) sdata);
2319         setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
2320                     (unsigned long) sdata);
2321         setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
2322                     (unsigned long) sdata);
2323         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
2324                     (unsigned long) sdata);
2325
2326         ifmgd->flags = 0;
2327
2328         mutex_init(&ifmgd->mtx);
2329
2330         if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
2331                 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
2332         else
2333                 ifmgd->req_smps = IEEE80211_SMPS_OFF;
2334 }
2335
2336 /* scan finished notification */
2337 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
2338 {
2339         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
2340
2341         /* Restart STA timers */
2342         rcu_read_lock();
2343         list_for_each_entry_rcu(sdata, &local->interfaces, list)
2344                 ieee80211_restart_sta_timer(sdata);
2345         rcu_read_unlock();
2346 }
2347
2348 int ieee80211_max_network_latency(struct notifier_block *nb,
2349                                   unsigned long data, void *dummy)
2350 {
2351         s32 latency_usec = (s32) data;
2352         struct ieee80211_local *local =
2353                 container_of(nb, struct ieee80211_local,
2354                              network_latency_notifier);
2355
2356         mutex_lock(&local->iflist_mtx);
2357         ieee80211_recalc_ps(local, latency_usec);
2358         mutex_unlock(&local->iflist_mtx);
2359
2360         return 0;
2361 }
2362
2363 /* config hooks */
2364 static enum work_done_result
2365 ieee80211_probe_auth_done(struct ieee80211_work *wk,
2366                           struct sk_buff *skb)
2367 {
2368         struct ieee80211_local *local = wk->sdata->local;
2369
2370         if (!skb) {
2371                 cfg80211_send_auth_timeout(wk->sdata->dev, wk->filter_ta);
2372                 goto destroy;
2373         }
2374
2375         if (wk->type == IEEE80211_WORK_AUTH) {
2376                 cfg80211_send_rx_auth(wk->sdata->dev, skb->data, skb->len);
2377                 goto destroy;
2378         }
2379
2380         mutex_lock(&wk->sdata->u.mgd.mtx);
2381         ieee80211_rx_mgmt_probe_resp(wk->sdata, skb);
2382         mutex_unlock(&wk->sdata->u.mgd.mtx);
2383
2384         wk->type = IEEE80211_WORK_AUTH;
2385         wk->probe_auth.tries = 0;
2386         return WORK_DONE_REQUEUE;
2387  destroy:
2388         if (wk->probe_auth.synced)
2389                 drv_finish_tx_sync(local, wk->sdata, wk->filter_ta,
2390                                    IEEE80211_TX_SYNC_AUTH);
2391
2392         return WORK_DONE_DESTROY;
2393 }
2394
2395 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
2396                        struct cfg80211_auth_request *req)
2397 {
2398         const u8 *ssid;
2399         struct ieee80211_work *wk;
2400         u16 auth_alg;
2401
2402         if (req->local_state_change)
2403                 return 0; /* no need to update mac80211 state */
2404
2405         switch (req->auth_type) {
2406         case NL80211_AUTHTYPE_OPEN_SYSTEM:
2407                 auth_alg = WLAN_AUTH_OPEN;
2408                 break;
2409         case NL80211_AUTHTYPE_SHARED_KEY:
2410                 if (IS_ERR(sdata->local->wep_tx_tfm))
2411                         return -EOPNOTSUPP;
2412                 auth_alg = WLAN_AUTH_SHARED_KEY;
2413                 break;
2414         case NL80211_AUTHTYPE_FT:
2415                 auth_alg = WLAN_AUTH_FT;
2416                 break;
2417         case NL80211_AUTHTYPE_NETWORK_EAP:
2418                 auth_alg = WLAN_AUTH_LEAP;
2419                 break;
2420         default:
2421                 return -EOPNOTSUPP;
2422         }
2423
2424         wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
2425         if (!wk)
2426                 return -ENOMEM;
2427
2428         memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
2429
2430         if (req->ie && req->ie_len) {
2431                 memcpy(wk->ie, req->ie, req->ie_len);
2432                 wk->ie_len = req->ie_len;
2433         }
2434
2435         if (req->key && req->key_len) {
2436                 wk->probe_auth.key_len = req->key_len;
2437                 wk->probe_auth.key_idx = req->key_idx;
2438                 memcpy(wk->probe_auth.key, req->key, req->key_len);
2439         }
2440
2441         ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
2442         memcpy(wk->probe_auth.ssid, ssid + 2, ssid[1]);
2443         wk->probe_auth.ssid_len = ssid[1];
2444
2445         wk->probe_auth.algorithm = auth_alg;
2446         wk->probe_auth.privacy = req->bss->capability & WLAN_CAPABILITY_PRIVACY;
2447
2448         /* if we already have a probe, don't probe again */
2449         if (req->bss->proberesp_ies)
2450                 wk->type = IEEE80211_WORK_AUTH;
2451         else
2452                 wk->type = IEEE80211_WORK_DIRECT_PROBE;
2453         wk->chan = req->bss->channel;
2454         wk->chan_type = NL80211_CHAN_NO_HT;
2455         wk->sdata = sdata;
2456         wk->done = ieee80211_probe_auth_done;
2457
2458         ieee80211_add_work(wk);
2459         return 0;
2460 }
2461
2462 /* create and insert a dummy station entry */
2463 static int ieee80211_pre_assoc(struct ieee80211_sub_if_data *sdata,
2464                                 u8 *bssid) {
2465         struct sta_info *sta;
2466         int err;
2467
2468         sta = sta_info_alloc(sdata, bssid, GFP_KERNEL);
2469         if (!sta)
2470                 return -ENOMEM;
2471
2472         sta->dummy = true;
2473
2474         err = sta_info_insert(sta);
2475         sta = NULL;
2476         if (err) {
2477                 printk(KERN_DEBUG "%s: failed to insert Dummy STA entry for"
2478                        " the AP (error %d)\n", sdata->name, err);
2479                 return err;
2480         }
2481
2482         return 0;
2483 }
2484
2485 static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
2486                                                   struct sk_buff *skb)
2487 {
2488         struct ieee80211_local *local = wk->sdata->local;
2489         struct ieee80211_mgmt *mgmt;
2490         struct ieee80211_rx_status *rx_status;
2491         struct ieee802_11_elems elems;
2492         struct cfg80211_bss *cbss = wk->assoc.bss;
2493         u16 status;
2494
2495         if (!skb) {
2496                 sta_info_destroy_addr(wk->sdata, cbss->bssid);
2497                 cfg80211_send_assoc_timeout(wk->sdata->dev, wk->filter_ta);
2498                 goto destroy;
2499         }
2500
2501         if (wk->type == IEEE80211_WORK_ASSOC_BEACON_WAIT) {
2502                 mutex_lock(&wk->sdata->u.mgd.mtx);
2503                 rx_status = (void *) skb->cb;
2504                 ieee802_11_parse_elems(skb->data + 24 + 12, skb->len - 24 - 12, &elems);
2505                 ieee80211_rx_bss_info(wk->sdata, (void *)skb->data, skb->len, rx_status,
2506                                       &elems, true);
2507                 mutex_unlock(&wk->sdata->u.mgd.mtx);
2508
2509                 wk->type = IEEE80211_WORK_ASSOC;
2510                 /* not really done yet */
2511                 return WORK_DONE_REQUEUE;
2512         }
2513
2514         mgmt = (void *)skb->data;
2515         status = le16_to_cpu(mgmt->u.assoc_resp.status_code);
2516
2517         if (status == WLAN_STATUS_SUCCESS) {
2518                 if (wk->assoc.synced)
2519                         drv_finish_tx_sync(local, wk->sdata, wk->filter_ta,
2520                                            IEEE80211_TX_SYNC_ASSOC);
2521
2522                 mutex_lock(&wk->sdata->u.mgd.mtx);
2523                 if (!ieee80211_assoc_success(wk, mgmt, skb->len)) {
2524                         mutex_unlock(&wk->sdata->u.mgd.mtx);
2525                         /* oops -- internal error -- send timeout for now */
2526                         sta_info_destroy_addr(wk->sdata, cbss->bssid);
2527                         cfg80211_send_assoc_timeout(wk->sdata->dev,
2528                                                     wk->filter_ta);
2529                         return WORK_DONE_DESTROY;
2530                 }
2531
2532                 mutex_unlock(&wk->sdata->u.mgd.mtx);
2533         } else {
2534                 /* assoc failed - destroy the dummy station entry */
2535                 sta_info_destroy_addr(wk->sdata, cbss->bssid);
2536         }
2537
2538         cfg80211_send_rx_assoc(wk->sdata->dev, skb->data, skb->len);
2539  destroy:
2540         if (wk->assoc.synced)
2541                 drv_finish_tx_sync(local, wk->sdata, wk->filter_ta,
2542                                    IEEE80211_TX_SYNC_ASSOC);
2543
2544         return WORK_DONE_DESTROY;
2545 }
2546
2547 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
2548                         struct cfg80211_assoc_request *req)
2549 {
2550         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2551         struct ieee80211_bss *bss = (void *)req->bss->priv;
2552         struct ieee80211_work *wk;
2553         const u8 *ssid;
2554         int i, err;
2555
2556         mutex_lock(&ifmgd->mtx);
2557         if (ifmgd->associated) {
2558                 if (!req->prev_bssid ||
2559                     memcmp(req->prev_bssid, ifmgd->associated->bssid,
2560                            ETH_ALEN)) {
2561                         /*
2562                          * We are already associated and the request was not a
2563                          * reassociation request from the current BSS, so
2564                          * reject it.
2565                          */
2566                         mutex_unlock(&ifmgd->mtx);
2567                         return -EALREADY;
2568                 }
2569
2570                 /* Trying to reassociate - clear previous association state */
2571                 ieee80211_set_disassoc(sdata, true, false);
2572         }
2573         mutex_unlock(&ifmgd->mtx);
2574
2575         wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
2576         if (!wk)
2577                 return -ENOMEM;
2578
2579         /*
2580          * create a dummy station info entry in order
2581          * to start accepting incoming EAPOL packets from the station
2582          */
2583         err = ieee80211_pre_assoc(sdata, req->bss->bssid);
2584         if (err) {
2585                 kfree(wk);
2586                 return err;
2587         }
2588
2589         ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
2590         ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
2591
2592         ifmgd->beacon_crc_valid = false;
2593
2594         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++)
2595                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
2596                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
2597                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104)
2598                         ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
2599
2600
2601         if (req->ie && req->ie_len) {
2602                 memcpy(wk->ie, req->ie, req->ie_len);
2603                 wk->ie_len = req->ie_len;
2604         } else
2605                 wk->ie_len = 0;
2606
2607         wk->assoc.bss = req->bss;
2608
2609         memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
2610
2611         /* new association always uses requested smps mode */
2612         if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
2613                 if (ifmgd->powersave)
2614                         ifmgd->ap_smps = IEEE80211_SMPS_DYNAMIC;
2615                 else
2616                         ifmgd->ap_smps = IEEE80211_SMPS_OFF;
2617         } else
2618                 ifmgd->ap_smps = ifmgd->req_smps;
2619
2620         wk->assoc.smps = ifmgd->ap_smps;
2621         /*
2622          * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
2623          * We still associate in non-HT mode (11a/b/g) if any one of these
2624          * ciphers is configured as pairwise.
2625          * We can set this to true for non-11n hardware, that'll be checked
2626          * separately along with the peer capabilities.
2627          */
2628         wk->assoc.use_11n = !(ifmgd->flags & IEEE80211_STA_DISABLE_11N);
2629         wk->assoc.capability = req->bss->capability;
2630         wk->assoc.wmm_used = bss->wmm_used;
2631         wk->assoc.supp_rates = bss->supp_rates;
2632         wk->assoc.supp_rates_len = bss->supp_rates_len;
2633         wk->assoc.ht_information_ie =
2634                 ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_INFORMATION);
2635
2636         if (bss->wmm_used && bss->uapsd_supported &&
2637             (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
2638                 wk->assoc.uapsd_used = true;
2639                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
2640         } else {
2641                 wk->assoc.uapsd_used = false;
2642                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
2643         }
2644
2645         ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
2646         memcpy(wk->assoc.ssid, ssid + 2, ssid[1]);
2647         wk->assoc.ssid_len = ssid[1];
2648
2649         if (req->prev_bssid)
2650                 memcpy(wk->assoc.prev_bssid, req->prev_bssid, ETH_ALEN);
2651
2652         wk->chan = req->bss->channel;
2653         wk->chan_type = NL80211_CHAN_NO_HT;
2654         wk->sdata = sdata;
2655         wk->done = ieee80211_assoc_done;
2656         if (!bss->dtim_period &&
2657             sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
2658                 wk->type = IEEE80211_WORK_ASSOC_BEACON_WAIT;
2659         else
2660                 wk->type = IEEE80211_WORK_ASSOC;
2661
2662         if (req->use_mfp) {
2663                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
2664                 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
2665         } else {
2666                 ifmgd->mfp = IEEE80211_MFP_DISABLED;
2667                 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
2668         }
2669
2670         if (req->crypto.control_port)
2671                 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
2672         else
2673                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
2674
2675         sdata->control_port_protocol = req->crypto.control_port_ethertype;
2676         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
2677
2678         ieee80211_add_work(wk);
2679         return 0;
2680 }
2681
2682 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
2683                          struct cfg80211_deauth_request *req,
2684                          void *cookie)
2685 {
2686         struct ieee80211_local *local = sdata->local;
2687         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2688         struct ieee80211_work *wk;
2689         u8 bssid[ETH_ALEN];
2690         bool assoc_bss = false;
2691
2692         mutex_lock(&ifmgd->mtx);
2693
2694         memcpy(bssid, req->bss->bssid, ETH_ALEN);
2695         if (ifmgd->associated == req->bss) {
2696                 ieee80211_set_disassoc(sdata, false, true);
2697                 mutex_unlock(&ifmgd->mtx);
2698                 assoc_bss = true;
2699         } else {
2700                 bool not_auth_yet = false;
2701
2702                 mutex_unlock(&ifmgd->mtx);
2703
2704                 mutex_lock(&local->mtx);
2705                 list_for_each_entry(wk, &local->work_list, list) {
2706                         if (wk->sdata != sdata)
2707                                 continue;
2708
2709                         if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
2710                             wk->type != IEEE80211_WORK_AUTH &&
2711                             wk->type != IEEE80211_WORK_ASSOC &&
2712                             wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
2713                                 continue;
2714
2715                         if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
2716                                 continue;
2717
2718                         not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
2719                         list_del_rcu(&wk->list);
2720                         free_work(wk);
2721                         break;
2722                 }
2723                 mutex_unlock(&local->mtx);
2724
2725                 /*
2726                  * If somebody requests authentication and we haven't
2727                  * sent out an auth frame yet there's no need to send
2728                  * out a deauth frame either. If the state was PROBE,
2729                  * then this is the case. If it's AUTH we have sent a
2730                  * frame, and if it's IDLE we have completed the auth
2731                  * process already.
2732                  */
2733                 if (not_auth_yet) {
2734                         __cfg80211_auth_canceled(sdata->dev, bssid);
2735                         return 0;
2736                 }
2737         }
2738
2739         printk(KERN_DEBUG "%s: deauthenticating from %pM by local choice (reason=%d)\n",
2740                sdata->name, bssid, req->reason_code);
2741
2742         ieee80211_send_deauth_disassoc(sdata, bssid, IEEE80211_STYPE_DEAUTH,
2743                                        req->reason_code, cookie,
2744                                        !req->local_state_change);
2745         if (assoc_bss)
2746                 sta_info_flush(sdata->local, sdata);
2747
2748         mutex_lock(&sdata->local->mtx);
2749         ieee80211_recalc_idle(sdata->local);
2750         mutex_unlock(&sdata->local->mtx);
2751
2752         return 0;
2753 }
2754
2755 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
2756                            struct cfg80211_disassoc_request *req,
2757                            void *cookie)
2758 {
2759         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2760         u8 bssid[ETH_ALEN];
2761
2762         mutex_lock(&ifmgd->mtx);
2763
2764         /*
2765          * cfg80211 should catch this ... but it's racy since
2766          * we can receive a disassoc frame, process it, hand it
2767          * to cfg80211 while that's in a locked section already
2768          * trying to tell us that the user wants to disconnect.
2769          */
2770         if (ifmgd->associated != req->bss) {
2771                 mutex_unlock(&ifmgd->mtx);
2772                 return -ENOLINK;
2773         }
2774
2775         printk(KERN_DEBUG "%s: disassociating from %pM by local choice (reason=%d)\n",
2776                sdata->name, req->bss->bssid, req->reason_code);
2777
2778         memcpy(bssid, req->bss->bssid, ETH_ALEN);
2779         ieee80211_set_disassoc(sdata, false, true);
2780
2781         mutex_unlock(&ifmgd->mtx);
2782
2783         ieee80211_send_deauth_disassoc(sdata, req->bss->bssid,
2784                         IEEE80211_STYPE_DISASSOC, req->reason_code,
2785                         cookie, !req->local_state_change);
2786         sta_info_flush(sdata->local, sdata);
2787
2788         mutex_lock(&sdata->local->mtx);
2789         ieee80211_recalc_idle(sdata->local);
2790         mutex_unlock(&sdata->local->mtx);
2791
2792         return 0;
2793 }
2794
2795 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
2796                                enum nl80211_cqm_rssi_threshold_event rssi_event,
2797                                gfp_t gfp)
2798 {
2799         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2800
2801         trace_api_cqm_rssi_notify(sdata, rssi_event);
2802
2803         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
2804 }
2805 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
2806
2807 unsigned char ieee80211_get_operstate(struct ieee80211_vif *vif)
2808 {
2809         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2810         return sdata->dev->operstate;
2811 }
2812 EXPORT_SYMBOL(ieee80211_get_operstate);