1 /*
2 * hostapd / IEEE 802.11n HT
3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2007-2008, Intel Corporation
5 *
6 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
8 */
9
10 #include "utils/includes.h"
11
12 #include "utils/common.h"
13 #include "utils/eloop.h"
14 #include "common/ieee802_11_defs.h"
15 #include "hostapd.h"
16 #include "ap_config.h"
17 #include "sta_info.h"
18 #include "beacon.h"
19 #include "ieee802_11.h"
20 #include "hw_features.h"
21 #include "ap_drv_ops.h"
22
23
hostapd_eid_ht_capabilities(struct hostapd_data * hapd,u8 * eid)24 u8 * hostapd_eid_ht_capabilities(struct hostapd_data *hapd, u8 *eid)
25 {
26 struct ieee80211_ht_capabilities *cap;
27 u8 *pos = eid;
28
29 if (!hapd->iconf->ieee80211n || !hapd->iface->current_mode ||
30 hapd->conf->disable_11n || is_6ghz_op_class(hapd->iconf->op_class))
31 return eid;
32
33 *pos++ = WLAN_EID_HT_CAP;
34 *pos++ = sizeof(*cap);
35
36 cap = (struct ieee80211_ht_capabilities *) pos;
37 os_memset(cap, 0, sizeof(*cap));
38 cap->ht_capabilities_info = host_to_le16(hapd->iconf->ht_capab);
39 cap->a_mpdu_params = hapd->iface->current_mode->a_mpdu_params;
40 os_memcpy(cap->supported_mcs_set, hapd->iface->current_mode->mcs_set,
41 16);
42
43 /* TODO: ht_extended_capabilities (now fully disabled) */
44 /* TODO: tx_bf_capability_info (now fully disabled) */
45 /* TODO: asel_capabilities (now fully disabled) */
46
47 pos += sizeof(*cap);
48
49 if (hapd->iconf->obss_interval) {
50 struct ieee80211_obss_scan_parameters *scan_params;
51
52 *pos++ = WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS;
53 *pos++ = sizeof(*scan_params);
54
55 scan_params = (struct ieee80211_obss_scan_parameters *) pos;
56 os_memset(scan_params, 0, sizeof(*scan_params));
57 scan_params->width_trigger_scan_interval =
58 host_to_le16(hapd->iconf->obss_interval);
59
60 /* Fill in default values for remaining parameters
61 * (IEEE Std 802.11-2012, 8.4.2.61 and MIB defval) */
62 scan_params->scan_passive_dwell =
63 host_to_le16(20);
64 scan_params->scan_active_dwell =
65 host_to_le16(10);
66 scan_params->scan_passive_total_per_channel =
67 host_to_le16(200);
68 scan_params->scan_active_total_per_channel =
69 host_to_le16(20);
70 scan_params->channel_transition_delay_factor =
71 host_to_le16(5);
72 scan_params->scan_activity_threshold =
73 host_to_le16(25);
74
75 pos += sizeof(*scan_params);
76 }
77
78 return pos;
79 }
80
81
hostapd_eid_ht_operation(struct hostapd_data * hapd,u8 * eid)82 u8 * hostapd_eid_ht_operation(struct hostapd_data *hapd, u8 *eid)
83 {
84 struct ieee80211_ht_operation *oper;
85 u8 *pos = eid;
86
87 if (!hapd->iconf->ieee80211n || hapd->conf->disable_11n ||
88 is_6ghz_op_class(hapd->iconf->op_class))
89 return eid;
90
91 *pos++ = WLAN_EID_HT_OPERATION;
92 *pos++ = sizeof(*oper);
93
94 oper = (struct ieee80211_ht_operation *) pos;
95 os_memset(oper, 0, sizeof(*oper));
96
97 oper->primary_chan = hapd->iconf->channel;
98 oper->operation_mode = host_to_le16(hapd->iface->ht_op_mode);
99 if (hapd->iconf->secondary_channel == 1)
100 oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE |
101 HT_INFO_HT_PARAM_STA_CHNL_WIDTH;
102 if (hapd->iconf->secondary_channel == -1)
103 oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW |
104 HT_INFO_HT_PARAM_STA_CHNL_WIDTH;
105
106 pos += sizeof(*oper);
107
108 return pos;
109 }
110
111
112 /*
113 op_mode
114 Set to 0 (HT pure) under the following conditions
115 - all STAs in the BSS are 20/40 MHz HT in 20/40 MHz BSS or
116 - all STAs in the BSS are 20 MHz HT in 20 MHz BSS
117 Set to 1 (HT non-member protection) if there may be non-HT STAs
118 in both the primary and the secondary channel
119 Set to 2 if only HT STAs are associated in BSS,
120 however and at least one 20 MHz HT STA is associated
121 Set to 3 (HT mixed mode) when one or more non-HT STAs are associated
122 */
hostapd_ht_operation_update(struct hostapd_iface * iface)123 int hostapd_ht_operation_update(struct hostapd_iface *iface)
124 {
125 u16 cur_op_mode, new_op_mode;
126 int op_mode_changes = 0;
127
128 if (!iface->conf->ieee80211n || iface->conf->ht_op_mode_fixed)
129 return 0;
130
131 wpa_printf(MSG_DEBUG, "%s current operation mode=0x%X",
132 __func__, iface->ht_op_mode);
133
134 if (!(iface->ht_op_mode & HT_OPER_OP_MODE_NON_GF_HT_STAS_PRESENT)
135 && iface->num_sta_ht_no_gf) {
136 iface->ht_op_mode |= HT_OPER_OP_MODE_NON_GF_HT_STAS_PRESENT;
137 op_mode_changes++;
138 } else if ((iface->ht_op_mode &
139 HT_OPER_OP_MODE_NON_GF_HT_STAS_PRESENT) &&
140 iface->num_sta_ht_no_gf == 0) {
141 iface->ht_op_mode &= ~HT_OPER_OP_MODE_NON_GF_HT_STAS_PRESENT;
142 op_mode_changes++;
143 }
144
145 if (!(iface->ht_op_mode & HT_OPER_OP_MODE_OBSS_NON_HT_STAS_PRESENT) &&
146 (iface->num_sta_no_ht || iface->olbc_ht)) {
147 iface->ht_op_mode |= HT_OPER_OP_MODE_OBSS_NON_HT_STAS_PRESENT;
148 op_mode_changes++;
149 } else if ((iface->ht_op_mode &
150 HT_OPER_OP_MODE_OBSS_NON_HT_STAS_PRESENT) &&
151 (iface->num_sta_no_ht == 0 && !iface->olbc_ht)) {
152 iface->ht_op_mode &= ~HT_OPER_OP_MODE_OBSS_NON_HT_STAS_PRESENT;
153 op_mode_changes++;
154 }
155
156 if (iface->num_sta_no_ht)
157 new_op_mode = HT_PROT_NON_HT_MIXED;
158 else if (iface->conf->secondary_channel && iface->num_sta_ht_20mhz)
159 new_op_mode = HT_PROT_20MHZ_PROTECTION;
160 else if (iface->olbc_ht)
161 new_op_mode = HT_PROT_NONMEMBER_PROTECTION;
162 else
163 new_op_mode = HT_PROT_NO_PROTECTION;
164
165 cur_op_mode = iface->ht_op_mode & HT_OPER_OP_MODE_HT_PROT_MASK;
166 if (cur_op_mode != new_op_mode) {
167 iface->ht_op_mode &= ~HT_OPER_OP_MODE_HT_PROT_MASK;
168 iface->ht_op_mode |= new_op_mode;
169 op_mode_changes++;
170 }
171
172 wpa_printf(MSG_DEBUG, "%s new operation mode=0x%X changes=%d",
173 __func__, iface->ht_op_mode, op_mode_changes);
174
175 return op_mode_changes;
176 }
177
178
is_40_allowed(struct hostapd_iface * iface,int channel)179 static int is_40_allowed(struct hostapd_iface *iface, int channel)
180 {
181 int pri_freq, sec_freq;
182 int affected_start, affected_end;
183 int pri = 2407 + 5 * channel;
184
185 if (iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G)
186 return 1;
187
188 pri_freq = hostapd_hw_get_freq(iface->bss[0], iface->conf->channel);
189
190 if (iface->conf->secondary_channel > 0)
191 sec_freq = pri_freq + 20;
192 else
193 sec_freq = pri_freq - 20;
194
195 affected_start = (pri_freq + sec_freq) / 2 - 25;
196 affected_end = (pri_freq + sec_freq) / 2 + 25;
197 if ((pri < affected_start || pri > affected_end))
198 return 1; /* not within affected channel range */
199
200 wpa_printf(MSG_ERROR, "40 MHz affected channel range: [%d,%d] MHz",
201 affected_start, affected_end);
202 wpa_printf(MSG_ERROR, "Neighboring BSS: freq=%d", pri);
203 return 0;
204 }
205
206
hostapd_2040_coex_action(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,size_t len)207 void hostapd_2040_coex_action(struct hostapd_data *hapd,
208 const struct ieee80211_mgmt *mgmt, size_t len)
209 {
210 struct hostapd_iface *iface = hapd->iface;
211 struct ieee80211_2040_bss_coex_ie *bc_ie;
212 struct ieee80211_2040_intol_chan_report *ic_report;
213 int is_ht40_allowed = 1;
214 int i;
215 const u8 *start = (const u8 *) mgmt;
216 const u8 *data = start + IEEE80211_HDRLEN + 2;
217 struct sta_info *sta;
218
219 wpa_printf(MSG_DEBUG,
220 "HT: Received 20/40 BSS Coexistence Management frame from "
221 MACSTR, MAC2STR(mgmt->sa));
222
223 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
224 HOSTAPD_LEVEL_DEBUG, "hostapd_public_action - action=%d",
225 mgmt->u.action.u.public_action.action);
226
227 if (!(iface->conf->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) {
228 wpa_printf(MSG_DEBUG,
229 "Ignore 20/40 BSS Coexistence Management frame since 40 MHz capability is not enabled");
230 return;
231 }
232
233 if (len < IEEE80211_HDRLEN + 2 + sizeof(*bc_ie)) {
234 wpa_printf(MSG_DEBUG,
235 "Ignore too short 20/40 BSS Coexistence Management frame");
236 return;
237 }
238
239 /* 20/40 BSS Coexistence element */
240 bc_ie = (struct ieee80211_2040_bss_coex_ie *) data;
241 if (bc_ie->element_id != WLAN_EID_20_40_BSS_COEXISTENCE ||
242 bc_ie->length < 1) {
243 wpa_printf(MSG_DEBUG, "Unexpected IE (%u,%u) in coex report",
244 bc_ie->element_id, bc_ie->length);
245 return;
246 }
247 if (len < IEEE80211_HDRLEN + 2 + 2 + bc_ie->length) {
248 wpa_printf(MSG_DEBUG,
249 "Truncated 20/40 BSS Coexistence element");
250 return;
251 }
252 data += 2 + bc_ie->length;
253
254 wpa_printf(MSG_DEBUG,
255 "20/40 BSS Coexistence Information field: 0x%x (%s%s%s%s%s%s)",
256 bc_ie->coex_param,
257 (bc_ie->coex_param & BIT(0)) ? "[InfoReq]" : "",
258 (bc_ie->coex_param & BIT(1)) ? "[40MHzIntolerant]" : "",
259 (bc_ie->coex_param & BIT(2)) ? "[20MHzBSSWidthReq]" : "",
260 (bc_ie->coex_param & BIT(3)) ? "[OBSSScanExemptionReq]" : "",
261 (bc_ie->coex_param & BIT(4)) ?
262 "[OBSSScanExemptionGrant]" : "",
263 (bc_ie->coex_param & (BIT(5) | BIT(6) | BIT(7))) ?
264 "[Reserved]" : "");
265
266 if (bc_ie->coex_param & WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ) {
267 /* Intra-BSS communication prohibiting 20/40 MHz BSS operation
268 */
269 sta = ap_get_sta(hapd, mgmt->sa);
270 if (!sta || !(sta->flags & WLAN_STA_ASSOC)) {
271 wpa_printf(MSG_DEBUG,
272 "Ignore intra-BSS 20/40 BSS Coexistence Management frame from not-associated STA");
273 return;
274 }
275
276 hostapd_logger(hapd, mgmt->sa,
277 HOSTAPD_MODULE_IEEE80211,
278 HOSTAPD_LEVEL_DEBUG,
279 "20 MHz BSS width request bit is set in BSS coexistence information field");
280 is_ht40_allowed = 0;
281 }
282
283 if (bc_ie->coex_param & WLAN_20_40_BSS_COEX_40MHZ_INTOL) {
284 /* Inter-BSS communication prohibiting 20/40 MHz BSS operation
285 */
286 hostapd_logger(hapd, mgmt->sa,
287 HOSTAPD_MODULE_IEEE80211,
288 HOSTAPD_LEVEL_DEBUG,
289 "40 MHz intolerant bit is set in BSS coexistence information field");
290 is_ht40_allowed = 0;
291 }
292
293 /* 20/40 BSS Intolerant Channel Report element (zero or more times) */
294 while (start + len - data >= 3 &&
295 data[0] == WLAN_EID_20_40_BSS_INTOLERANT && data[1] >= 1) {
296 u8 ielen = data[1];
297
298 if (ielen > start + len - data - 2) {
299 wpa_printf(MSG_DEBUG,
300 "Truncated 20/40 BSS Intolerant Channel Report element");
301 return;
302 }
303 ic_report = (struct ieee80211_2040_intol_chan_report *) data;
304 wpa_printf(MSG_DEBUG,
305 "20/40 BSS Intolerant Channel Report: Operating Class %u",
306 ic_report->op_class);
307
308 /* Go through the channel report to find any BSS there in the
309 * affected channel range */
310 for (i = 0; i < ielen - 1; i++) {
311 u8 chan = ic_report->variable[i];
312
313 if (chan == iface->conf->channel)
314 continue; /* matching own primary channel */
315 if (is_40_allowed(iface, chan))
316 continue; /* not within affected channels */
317 hostapd_logger(hapd, mgmt->sa,
318 HOSTAPD_MODULE_IEEE80211,
319 HOSTAPD_LEVEL_DEBUG,
320 "20_40_INTOLERANT channel %d reported",
321 chan);
322 is_ht40_allowed = 0;
323 }
324
325 data += 2 + ielen;
326 }
327 wpa_printf(MSG_DEBUG, "is_ht40_allowed=%d num_sta_ht40_intolerant=%d",
328 is_ht40_allowed, iface->num_sta_ht40_intolerant);
329
330 if (!is_ht40_allowed &&
331 (iface->drv_flags & WPA_DRIVER_FLAGS_HT_2040_COEX)) {
332 if (iface->conf->secondary_channel) {
333 hostapd_logger(hapd, mgmt->sa,
334 HOSTAPD_MODULE_IEEE80211,
335 HOSTAPD_LEVEL_INFO,
336 "Switching to 20 MHz operation");
337 iface->conf->secondary_channel = 0;
338 ieee802_11_set_beacons(iface);
339 }
340 if (!iface->num_sta_ht40_intolerant &&
341 iface->conf->obss_interval) {
342 unsigned int delay_time;
343 delay_time = OVERLAPPING_BSS_TRANS_DELAY_FACTOR *
344 iface->conf->obss_interval;
345 eloop_cancel_timeout(ap_ht2040_timeout, hapd->iface,
346 NULL);
347 eloop_register_timeout(delay_time, 0, ap_ht2040_timeout,
348 hapd->iface, NULL);
349 wpa_printf(MSG_DEBUG,
350 "Reschedule HT 20/40 timeout to occur in %u seconds",
351 delay_time);
352 }
353 }
354 }
355
356
copy_sta_ht_capab(struct hostapd_data * hapd,struct sta_info * sta,const u8 * ht_capab)357 u16 copy_sta_ht_capab(struct hostapd_data *hapd, struct sta_info *sta,
358 const u8 *ht_capab)
359 {
360 /*
361 * Disable HT caps for STAs associated to no-HT BSSes, or for stations
362 * that did not specify a valid WMM IE in the (Re)Association Request
363 * frame.
364 */
365 if (!ht_capab || !(sta->flags & WLAN_STA_WMM) ||
366 !hapd->iconf->ieee80211n || hapd->conf->disable_11n) {
367 sta->flags &= ~WLAN_STA_HT;
368 os_free(sta->ht_capabilities);
369 sta->ht_capabilities = NULL;
370 return WLAN_STATUS_SUCCESS;
371 }
372
373 if (sta->ht_capabilities == NULL) {
374 sta->ht_capabilities =
375 os_zalloc(sizeof(struct ieee80211_ht_capabilities));
376 if (sta->ht_capabilities == NULL)
377 return WLAN_STATUS_UNSPECIFIED_FAILURE;
378 }
379
380 sta->flags |= WLAN_STA_HT;
381 os_memcpy(sta->ht_capabilities, ht_capab,
382 sizeof(struct ieee80211_ht_capabilities));
383
384 return WLAN_STATUS_SUCCESS;
385 }
386
387
ht40_intolerant_add(struct hostapd_iface * iface,struct sta_info * sta)388 void ht40_intolerant_add(struct hostapd_iface *iface, struct sta_info *sta)
389 {
390 if (iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G)
391 return;
392
393 wpa_printf(MSG_INFO, "HT: Forty MHz Intolerant is set by STA " MACSTR
394 " in Association Request", MAC2STR(sta->addr));
395
396 if (sta->ht40_intolerant_set)
397 return;
398
399 sta->ht40_intolerant_set = 1;
400 iface->num_sta_ht40_intolerant++;
401 eloop_cancel_timeout(ap_ht2040_timeout, iface, NULL);
402
403 if (iface->conf->secondary_channel &&
404 (iface->drv_flags & WPA_DRIVER_FLAGS_HT_2040_COEX)) {
405 iface->conf->secondary_channel = 0;
406 ieee802_11_set_beacons(iface);
407 }
408 }
409
410
ht40_intolerant_remove(struct hostapd_iface * iface,struct sta_info * sta)411 void ht40_intolerant_remove(struct hostapd_iface *iface, struct sta_info *sta)
412 {
413 if (!sta->ht40_intolerant_set)
414 return;
415
416 sta->ht40_intolerant_set = 0;
417 iface->num_sta_ht40_intolerant--;
418
419 if (iface->num_sta_ht40_intolerant == 0 &&
420 (iface->conf->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET) &&
421 (iface->drv_flags & WPA_DRIVER_FLAGS_HT_2040_COEX)) {
422 unsigned int delay_time = OVERLAPPING_BSS_TRANS_DELAY_FACTOR *
423 iface->conf->obss_interval;
424 wpa_printf(MSG_DEBUG,
425 "HT: Start 20->40 MHz transition timer (%d seconds)",
426 delay_time);
427 eloop_cancel_timeout(ap_ht2040_timeout, iface, NULL);
428 eloop_register_timeout(delay_time, 0, ap_ht2040_timeout,
429 iface, NULL);
430 }
431 }
432
433
update_sta_ht(struct hostapd_data * hapd,struct sta_info * sta)434 static void update_sta_ht(struct hostapd_data *hapd, struct sta_info *sta)
435 {
436 u16 ht_capab;
437
438 ht_capab = le_to_host16(sta->ht_capabilities->ht_capabilities_info);
439 wpa_printf(MSG_DEBUG, "HT: STA " MACSTR " HT Capabilities Info: "
440 "0x%04x", MAC2STR(sta->addr), ht_capab);
441 if ((ht_capab & HT_CAP_INFO_GREEN_FIELD) == 0) {
442 if (!sta->no_ht_gf_set) {
443 sta->no_ht_gf_set = 1;
444 hapd->iface->num_sta_ht_no_gf++;
445 }
446 wpa_printf(MSG_DEBUG, "%s STA " MACSTR " - no greenfield, num "
447 "of non-gf stations %d",
448 __func__, MAC2STR(sta->addr),
449 hapd->iface->num_sta_ht_no_gf);
450 }
451 if ((ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET) == 0) {
452 if (!sta->ht_20mhz_set) {
453 sta->ht_20mhz_set = 1;
454 hapd->iface->num_sta_ht_20mhz++;
455 }
456 wpa_printf(MSG_DEBUG, "%s STA " MACSTR " - 20 MHz HT, num of "
457 "20MHz HT STAs %d",
458 __func__, MAC2STR(sta->addr),
459 hapd->iface->num_sta_ht_20mhz);
460 }
461
462 if (ht_capab & HT_CAP_INFO_40MHZ_INTOLERANT)
463 ht40_intolerant_add(hapd->iface, sta);
464 }
465
466
update_sta_no_ht(struct hostapd_data * hapd,struct sta_info * sta)467 static void update_sta_no_ht(struct hostapd_data *hapd, struct sta_info *sta)
468 {
469 if (!sta->no_ht_set) {
470 sta->no_ht_set = 1;
471 hapd->iface->num_sta_no_ht++;
472 }
473 if (hapd->iconf->ieee80211n) {
474 wpa_printf(MSG_DEBUG, "%s STA " MACSTR " - no HT, num of "
475 "non-HT stations %d",
476 __func__, MAC2STR(sta->addr),
477 hapd->iface->num_sta_no_ht);
478 }
479 }
480
481
update_ht_state(struct hostapd_data * hapd,struct sta_info * sta)482 void update_ht_state(struct hostapd_data *hapd, struct sta_info *sta)
483 {
484 if ((sta->flags & WLAN_STA_HT) && sta->ht_capabilities)
485 update_sta_ht(hapd, sta);
486 else
487 update_sta_no_ht(hapd, sta);
488
489 if (hostapd_ht_operation_update(hapd->iface) > 0)
490 ieee802_11_set_beacons(hapd->iface);
491 }
492
493
hostapd_get_ht_capab(struct hostapd_data * hapd,struct ieee80211_ht_capabilities * ht_cap,struct ieee80211_ht_capabilities * neg_ht_cap)494 void hostapd_get_ht_capab(struct hostapd_data *hapd,
495 struct ieee80211_ht_capabilities *ht_cap,
496 struct ieee80211_ht_capabilities *neg_ht_cap)
497 {
498 u16 cap;
499
500 if (ht_cap == NULL)
501 return;
502 os_memcpy(neg_ht_cap, ht_cap, sizeof(*neg_ht_cap));
503 cap = le_to_host16(neg_ht_cap->ht_capabilities_info);
504
505 /*
506 * Mask out HT features we don't support, but don't overwrite
507 * non-symmetric features like STBC and SMPS. Just because
508 * we're not in dynamic SMPS mode the STA might still be.
509 */
510 cap &= (hapd->iconf->ht_capab | HT_CAP_INFO_RX_STBC_MASK |
511 HT_CAP_INFO_TX_STBC | HT_CAP_INFO_SMPS_MASK);
512
513 /*
514 * STBC needs to be handled specially
515 * if we don't support RX STBC, mask out TX STBC in the STA's HT caps
516 * if we don't support TX STBC, mask out RX STBC in the STA's HT caps
517 */
518 if (!(hapd->iconf->ht_capab & HT_CAP_INFO_RX_STBC_MASK))
519 cap &= ~HT_CAP_INFO_TX_STBC;
520 if (!(hapd->iconf->ht_capab & HT_CAP_INFO_TX_STBC))
521 cap &= ~HT_CAP_INFO_RX_STBC_MASK;
522
523 neg_ht_cap->ht_capabilities_info = host_to_le16(cap);
524 }
525
526
ap_ht2040_timeout(void * eloop_data,void * user_data)527 void ap_ht2040_timeout(void *eloop_data, void *user_data)
528 {
529 struct hostapd_iface *iface = eloop_data;
530
531 wpa_printf(MSG_INFO, "Switching to 40 MHz operation");
532
533 iface->conf->secondary_channel = iface->secondary_ch;
534 ieee802_11_set_beacons(iface);
535 }
536