wpa_supplicant/mbo.c

   1 /*
   2  * wpa_supplicant - MBO
   3  *
   4  * Copyright(c) 2015 Intel Deutschland GmbH
   5  * Contact Information:
   6  * Intel Linux Wireless <ilw@linux.intel.com>
   7  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "utils/includes.h"
  14
  15 #include "utils/common.h"
  16 #include "common/ieee802_11_defs.h"
  17 #include "config.h"
  18 #include "wpa_supplicant_i.h"
  19 #include "driver_i.h"
  20 #include "bss.h"
  21 #include "scan.h"
  22
  23 /* type + length + oui + oui type */
  24 #define MBO_IE_HEADER 6
  25
  26
  27 static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
  28 {
  29         if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
  30                 return -1;
  31
  32         /* Only checking the validity of the channel and oper_class */
  33         if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
  34                 return -1;
  35
  36         return 0;
  37 }
  38
  39
  40 const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
  41 {
  42         const u8 *mbo, *end;
  43
  44         if (!bss)
  45                 return NULL;
  46
  47         mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
  48         if (!mbo)
  49                 return NULL;
  50
  51         end = mbo + 2 + mbo[1];
  52         mbo += MBO_IE_HEADER;
  53
  54         return get_ie(mbo, end - mbo, attr);
  55 }
  56
  57
  58 static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
  59                                              struct wpabuf *mbo,
  60                                              u8 start, u8 end)
  61 {
  62         u8 i;
  63
  64         wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
  65
  66         for (i = start; i < end; i++)
  67                 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
  68
  69         wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
  70         wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
  71 }
  72
  73
  74 static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
  75                                         struct wpabuf *mbo, u8 start, u8 end)
  76 {
  77         size_t size = end - start + 3;
  78
  79         if (size + 2 > wpabuf_tailroom(mbo))
  80                 return;
  81
  82         wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
  83         wpabuf_put_u8(mbo, size); /* Length */
  84
  85         wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
  86 }
  87
  88
  89 static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
  90 {
  91         wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
  92         wpabuf_put_u8(mbo, len); /* Length */
  93         wpabuf_put_be24(mbo, OUI_WFA);
  94         wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
  95 }
  96
  97
  98 static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
  99                                               struct wpabuf *mbo, u8 start,
 100                                               u8 end)
 101 {
 102         size_t size = end - start + 7;
 103
 104         if (size + 2 > wpabuf_tailroom(mbo))
 105                 return;
 106
 107         wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
 108         wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
 109 }
 110
 111
 112 static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
 113                                          struct wpabuf *mbo, int subelement)
 114 {
 115         u8 i, start = 0;
 116         struct wpa_mbo_non_pref_channel *start_pref;
 117
 118         if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
 119                 if (subelement)
 120                         wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
 121                 return;
 122         }
 123         start_pref = &wpa_s->non_pref_chan[0];
 124
 125         for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
 126                 struct wpa_mbo_non_pref_channel *non_pref = NULL;
 127
 128                 if (i < wpa_s->non_pref_chan_num)
 129                         non_pref = &wpa_s->non_pref_chan[i];
 130                 if (!non_pref ||
 131                     non_pref->oper_class != start_pref->oper_class ||
 132                     non_pref->reason != start_pref->reason ||
 133                     non_pref->preference != start_pref->preference) {
 134                         if (subelement)
 135                                 wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
 136                                                                   start, i);
 137                         else
 138                                 wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
 139                                                             i);
 140
 141                         if (!non_pref)
 142                                 return;
 143
 144                         start = i;
 145                         start_pref = non_pref;
 146                 }
 147         }
 148 }
 149
 150
 151 int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len)
 152 {
 153         struct wpabuf *mbo;
 154         int res;
 155
 156         if (len < MBO_IE_HEADER + 3 + 7)
 157                 return 0;
 158
 159         /* Leave room for the MBO IE header */
 160         mbo = wpabuf_alloc(len - MBO_IE_HEADER);
 161         if (!mbo)
 162                 return 0;
 163
 164         /* Add non-preferred channels attribute */
 165         wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
 166
 167         /*
 168          * Send cellular capabilities attribute even if AP does not advertise
 169          * cellular capabilities.
 170          */
 171         wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
 172         wpabuf_put_u8(mbo, 1);
 173         wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);
 174
 175         res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
 176         if (!res)
 177                 wpa_printf(MSG_ERROR, "Failed to add MBO IE");
 178
 179         wpabuf_free(mbo);
 180         return res;
 181 }
 182
 183
 184 static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
 185                                            const u8 *data, size_t len)
 186 {
 187         struct wpabuf *buf;
 188         int res;
 189
 190         /*
 191          * Send WNM-Notification Request frame only in case of a change in
 192          * non-preferred channels list during association, if the AP supports
 193          * MBO.
 194          */
 195         if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss ||
 196             !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
 197                 return;
 198
 199         buf = wpabuf_alloc(4 + len);
 200         if (!buf)
 201                 return;
 202
 203         wpabuf_put_u8(buf, WLAN_ACTION_WNM);
 204         wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
 205         wpa_s->mbo_wnm_token++;
 206         if (wpa_s->mbo_wnm_token == 0)
 207                 wpa_s->mbo_wnm_token++;
 208         wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
 209         wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
 210
 211         wpabuf_put_data(buf, data, len);
 212
 213         res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 214                                   wpa_s->own_addr, wpa_s->bssid,
 215                                   wpabuf_head(buf), wpabuf_len(buf), 0);
 216         if (res < 0)
 217                 wpa_printf(MSG_DEBUG,
 218                            "Failed to send WNM-Notification Request frame with non-preferred channel list");
 219
 220         wpabuf_free(buf);
 221 }
 222
 223
 224 static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
 225 {
 226         struct wpabuf *buf;
 227
 228         buf = wpabuf_alloc(512);
 229         if (!buf)
 230                 return;
 231
 232         wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
 233         wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
 234                                        wpabuf_len(buf));
 235         wpabuf_free(buf);
 236 }
 237
 238
 239 static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
 240                                    struct wpa_mbo_non_pref_channel *b)
 241 {
 242         return a->oper_class == b->oper_class && a->chan == b->chan;
 243 }
 244
 245
 246 /*
 247  * wpa_non_pref_chan_cmp - Compare two channels for sorting
 248  *
 249  * In MBO IE non-preferred channel subelement we can put many channels in an
 250  * attribute if they are in the same operating class and have the same
 251  * preference and reason. To make it easy for the functions that build
 252  * the IE attributes and WNM Request subelements, save the channels sorted
 253  * by their oper_class and reason.
 254  */
 255 static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
 256 {
 257         const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;
 258
 259         if (a->oper_class != b->oper_class)
 260                 return a->oper_class - b->oper_class;
 261         if (a->reason != b->reason)
 262                 return a->reason - b->reason;
 263         return a->preference - b->preference;
 264 }
 265
 266
 267 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
 268                                   const char *non_pref_chan)
 269 {
 270         char *cmd, *token, *context = NULL;
 271         struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
 272         size_t num = 0, size = 0;
 273         unsigned i;
 274
 275         wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
 276                    non_pref_chan ? non_pref_chan : "N/A");
 277
 278         /*
 279          * The shortest channel configuration is 10 characters - commas, 3
 280          * colons, and 4 values that one of them (oper_class) is 2 digits or
 281          * more.
 282          */
 283         if (!non_pref_chan || os_strlen(non_pref_chan) < 10)
 284                 goto update;
 285
 286         cmd = os_strdup(non_pref_chan);
 287         if (!cmd)
 288                 return -1;
 289
 290         while ((token = str_token(cmd, " ", &context))) {
 291                 struct wpa_mbo_non_pref_channel *chan;
 292                 int ret;
 293                 unsigned int _oper_class;
 294                 unsigned int _chan;
 295                 unsigned int _preference;
 296                 unsigned int _reason;
 297
 298                 if (num == size) {
 299                         size = size ? size * 2 : 1;
 300                         tmp_chans = os_realloc_array(chans, size,
 301                                                      sizeof(*chans));
 302                         if (!tmp_chans) {
 303                                 wpa_printf(MSG_ERROR,
 304                                            "Couldn't reallocate non_pref_chan");
 305                                 goto fail;
 306                         }
 307                         chans = tmp_chans;
 308                 }
 309
 310                 chan = &chans[num];
 311
 312                 ret = sscanf(token, "%u:%u:%u:%u", &_oper_class,
 313                              &_chan, &_preference, &_reason);
 314                 if (ret != 4 ||
 315                     _oper_class > 255 || _chan > 255 ||
 316                     _preference > 255 || _reason > 65535 ) {
 317                         wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
 318                                    token);
 319                         goto fail;
 320                 }
 321                 chan->oper_class = _oper_class;
 322                 chan->chan = _chan;
 323                 chan->preference = _preference;
 324                 chan->reason = _reason;
 325
 326                 if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
 327                                                     chan->chan, chan->reason)) {
 328                         wpa_printf(MSG_ERROR,
 329                                    "Invalid non_pref_chan: oper class %d chan %d reason %d",
 330                                    chan->oper_class, chan->chan, chan->reason);
 331                         goto fail;
 332                 }
 333
 334                 for (i = 0; i < num; i++)
 335                         if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
 336                                 break;
 337                 if (i != num) {
 338                         wpa_printf(MSG_ERROR,
 339                                    "oper class %d chan %d is duplicated",
 340                                    chan->oper_class, chan->chan);
 341                         goto fail;
 342                 }
 343
 344                 num++;
 345         }
 346
 347         os_free(cmd);
 348
 349         if (chans) {
 350                 qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
 351                       wpa_non_pref_chan_cmp);
 352         }
 353
 354 update:
 355         os_free(wpa_s->non_pref_chan);
 356         wpa_s->non_pref_chan = chans;
 357         wpa_s->non_pref_chan_num = num;
 358         wpas_mbo_non_pref_chan_changed(wpa_s);
 359
 360         return 0;
 361
 362 fail:
 363         os_free(chans);
 364         os_free(cmd);
 365         return -1;
 366 }
 367
 368
 369 void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
 370 {
 371         wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
 372         wpabuf_put_u8(ie, 7);
 373         wpabuf_put_be24(ie, OUI_WFA);
 374         wpabuf_put_u8(ie, MBO_OUI_TYPE);
 375
 376         wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
 377         wpabuf_put_u8(ie, 1);
 378         wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
 379 }
 380
 381
 382 enum chan_allowed {
 383         NOT_ALLOWED, ALLOWED
 384 };
 385
 386 static enum chan_allowed allow_channel(struct hostapd_hw_modes *mode, u8 chan,
 387                                        unsigned int *flags)
 388 {
 389         int i;
 390
 391         for (i = 0; i < mode->num_channels; i++) {
 392                 if (mode->channels[i].chan == chan)
 393                         break;
 394         }
 395
 396         if (i == mode->num_channels ||
 397             (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED))
 398                 return NOT_ALLOWED;
 399
 400         if (flags)
 401                 *flags = mode->channels[i].flag;
 402
 403         return ALLOWED;
 404 }
 405
 406
 407 static int get_center_80mhz(struct hostapd_hw_modes *mode, u8 channel)
 408 {
 409         u8 center_channels[] = {42, 58, 106, 122, 138, 155};
 410         size_t i;
 411
 412         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
 413                 return 0;
 414
 415         for (i = 0; i < ARRAY_SIZE(center_channels); i++) {
 416                 /*
 417                  * In 80 MHz, the bandwidth "spans" 12 channels (e.g., 36-48),
 418                  * so the center channel is 6 channels away from the start/end.
 419                  */
 420                 if (channel >= center_channels[i] - 6 &&
 421                     channel <= center_channels[i] + 6)
 422                         return center_channels[i];
 423         }
 424
 425         return 0;
 426 }
 427
 428
 429 static enum chan_allowed verify_80mhz(struct hostapd_hw_modes *mode, u8 channel)
 430 {
 431         u8 center_chan;
 432         unsigned int i;
 433
 434         center_chan = get_center_80mhz(mode, channel);
 435         if (!center_chan)
 436                 return NOT_ALLOWED;
 437
 438         /* check all the channels are available */
 439         for (i = 0; i < 4; i++) {
 440                 unsigned int flags;
 441                 u8 adj_chan = center_chan - 6 + i * 4;
 442
 443                 if (allow_channel(mode, adj_chan, &flags) == NOT_ALLOWED)
 444                         return NOT_ALLOWED;
 445
 446                 if ((i == 0 && !(flags & HOSTAPD_CHAN_VHT_10_70)) ||
 447                     (i == 1 && !(flags & HOSTAPD_CHAN_VHT_30_50)) ||
 448                     (i == 2 && !(flags & HOSTAPD_CHAN_VHT_50_30)) ||
 449                     (i == 3 && !(flags & HOSTAPD_CHAN_VHT_70_10)))
 450                         return NOT_ALLOWED;
 451         }
 452
 453         return ALLOWED;
 454 }
 455
 456
 457 static int get_center_160mhz(struct hostapd_hw_modes *mode, u8 channel)
 458 {
 459         u8 center_channels[] = { 50, 114 };
 460         unsigned int i;
 461
 462         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
 463                 return 0;
 464
 465         for (i = 0; i < ARRAY_SIZE(center_channels); i++) {
 466                 /*
 467                  * In 160 MHz, the bandwidth "spans" 28 channels (e.g., 36-64),
 468                  * so the center channel is 14 channels away from the start/end.
 469                  */
 470                 if (channel >= center_channels[i] - 14 &&
 471                     channel <= center_channels[i] + 14)
 472                         return center_channels[i];
 473         }
 474
 475         return 0;
 476 }
 477
 478
 479 static enum chan_allowed verify_160mhz(struct hostapd_hw_modes *mode,
 480                                        u8 channel)
 481 {
 482         u8 center_chan;
 483         unsigned int i;
 484
 485         center_chan = get_center_160mhz(mode, channel);
 486         if (!center_chan)
 487                 return NOT_ALLOWED;
 488
 489         /* Check all the channels are available */
 490         for (i = 0; i < 8; i++) {
 491                 unsigned int flags;
 492                 u8 adj_chan = center_chan - 14 + i * 4;
 493
 494                 if (allow_channel(mode, adj_chan, &flags) == NOT_ALLOWED)
 495                         return NOT_ALLOWED;
 496
 497                 if ((i == 0 && !(flags & HOSTAPD_CHAN_VHT_10_150)) ||
 498                     (i == 1 && !(flags & HOSTAPD_CHAN_VHT_30_130)) ||
 499                     (i == 2 && !(flags & HOSTAPD_CHAN_VHT_50_110)) ||
 500                     (i == 3 && !(flags & HOSTAPD_CHAN_VHT_70_90)) ||
 501                     (i == 4 && !(flags & HOSTAPD_CHAN_VHT_90_70)) ||
 502                     (i == 5 && !(flags & HOSTAPD_CHAN_VHT_110_50)) ||
 503                     (i == 6 && !(flags & HOSTAPD_CHAN_VHT_130_30)) ||
 504                     (i == 7 && !(flags & HOSTAPD_CHAN_VHT_150_10)))
 505                         return NOT_ALLOWED;
 506         }
 507
 508         return ALLOWED;
 509 }
 510
 511
 512 static enum chan_allowed verify_channel(struct hostapd_hw_modes *mode,
 513                                         u8 channel, u8 bw)
 514 {
 515         unsigned int flag = 0;
 516         enum chan_allowed res, res2;
 517
 518         res2 = res = allow_channel(mode, channel, &flag);
 519         if (bw == BW40MINUS) {
 520                 if (!(flag & HOSTAPD_CHAN_HT40MINUS))
 521                         return NOT_ALLOWED;
 522                 res2 = allow_channel(mode, channel - 4, NULL);
 523         } else if (bw == BW40PLUS) {
 524                 if (!(flag & HOSTAPD_CHAN_HT40PLUS))
 525                         return NOT_ALLOWED;
 526                 res2 = allow_channel(mode, channel + 4, NULL);
 527         } else if (bw == BW80) {
 528                 /*
 529                  * channel is a center channel and as such, not necessarily a
 530                  * valid 20 MHz channels. Override earlier allow_channel()
 531                  * result and use only the 80 MHz specific version.
 532                  */
 533                 res2 = res = verify_80mhz(mode, channel);
 534         } else if (bw == BW160) {
 535                 /*
 536                  * channel is a center channel and as such, not necessarily a
 537                  * valid 20 MHz channels. Override earlier allow_channel()
 538                  * result and use only the 160 MHz specific version.
 539                  */
 540                 res2 = res = verify_160mhz(mode, channel);
 541         } else if (bw == BW80P80) {
 542                 /*
 543                  * channel is a center channel and as such, not necessarily a
 544                  * valid 20 MHz channels. Override earlier allow_channel()
 545                  * result and use only the 80 MHz specific version.
 546                  */
 547                 res2 = res = verify_80mhz(mode, channel);
 548         }
 549
 550         if (res == NOT_ALLOWED || res2 == NOT_ALLOWED)
 551                 return NOT_ALLOWED;
 552
 553         return ALLOWED;
 554 }
 555
 556
 557 static int wpas_op_class_supported(struct wpa_supplicant *wpa_s,
 558                                    const struct oper_class_map *op_class)
 559 {
 560         int chan;
 561         size_t i;
 562         struct hostapd_hw_modes *mode;
 563         int found;
 564
 565         mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op_class->mode);
 566         if (!mode)
 567                 return 0;
 568
 569         if (op_class->op_class == 128) {
 570                 u8 channels[] = { 42, 58, 106, 122, 138, 155 };
 571
 572                 for (i = 0; i < ARRAY_SIZE(channels); i++) {
 573                         if (verify_channel(mode, channels[i], op_class->bw) ==
 574                             ALLOWED)
 575                                 return 1;
 576                 }
 577
 578                 return 0;
 579         }
 580
 581         if (op_class->op_class == 129) {
 582                 /* Check if either 160 MHz channels is allowed */
 583                 return verify_channel(mode, 50, op_class->bw) == ALLOWED ||
 584                         verify_channel(mode, 114, op_class->bw) == ALLOWED;
 585         }
 586
 587         if (op_class->op_class == 130) {
 588                 /* Need at least two non-contiguous 80 MHz segments */
 589                 found = 0;
 590
 591                 if (verify_channel(mode, 42, op_class->bw) == ALLOWED ||
 592                     verify_channel(mode, 58, op_class->bw) == ALLOWED)
 593                         found++;
 594                 if (verify_channel(mode, 106, op_class->bw) == ALLOWED ||
 595                     verify_channel(mode, 122, op_class->bw) == ALLOWED ||
 596                     verify_channel(mode, 138, op_class->bw) == ALLOWED)
 597                         found++;
 598                 if (verify_channel(mode, 106, op_class->bw) == ALLOWED &&
 599                     verify_channel(mode, 138, op_class->bw) == ALLOWED)
 600                         found++;
 601                 if (verify_channel(mode, 155, op_class->bw) == ALLOWED)
 602                         found++;
 603
 604                 if (found >= 2)
 605                         return 1;
 606
 607                 return 0;
 608         }
 609
 610         found = 0;
 611         for (chan = op_class->min_chan; chan <= op_class->max_chan;
 612              chan += op_class->inc) {
 613                 if (verify_channel(mode, chan, op_class->bw) == ALLOWED) {
 614                         found = 1;
 615                         break;
 616                 }
 617         }
 618
 619         return found;
 620 }
 621
 622
 623 int wpas_mbo_supp_op_class_ie(struct wpa_supplicant *wpa_s, int freq, u8 *pos,
 624                               size_t len)
 625 {
 626         struct wpabuf *buf;
 627         u8 op, current, chan;
 628         u8 *ie_len;
 629         int res;
 630
 631         /*
 632          * Assume 20 MHz channel for now.
 633          * TODO: Use the secondary channel and VHT channel width that will be
 634          * used after association.
 635          */
 636         if (ieee80211_freq_to_channel_ext(freq, 0, VHT_CHANWIDTH_USE_HT,
 637                                           &current, &chan) == NUM_HOSTAPD_MODES)
 638                 return 0;
 639
 640         /*
 641          * Need 3 bytes for EID, length, and current operating class, plus
 642          * 1 byte for every other supported operating class.
 643          */
 644         buf = wpabuf_alloc(global_op_class_size + 3);
 645         if (!buf)
 646                 return 0;
 647
 648         wpabuf_put_u8(buf, WLAN_EID_SUPPORTED_OPERATING_CLASSES);
 649         /* Will set the length later, putting a placeholder */
 650         ie_len = wpabuf_put(buf, 1);
 651         wpabuf_put_u8(buf, current);
 652
 653         for (op = 0; global_op_class[op].op_class; op++) {
 654                 if (wpas_op_class_supported(wpa_s, &global_op_class[op]))
 655                         wpabuf_put_u8(buf, global_op_class[op].op_class);
 656         }
 657
 658         *ie_len = wpabuf_len(buf) - 2;
 659         if (*ie_len < 2 || wpabuf_len(buf) > len) {
 660                 wpa_printf(MSG_ERROR,
 661                            "Failed to add supported operating classes IE");
 662                 res = 0;
 663         } else {
 664                 os_memcpy(pos, wpabuf_head(buf), wpabuf_len(buf));
 665                 res = wpabuf_len(buf);
 666                 wpa_hexdump_buf(MSG_DEBUG,
 667                                 "MBO: Added supported operating classes IE",
 668                                 buf);
 669         }
 670
 671         wpabuf_free(buf);
 672         return res;
 673 }
 674
 675
 676 void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
 677                            size_t len)
 678 {
 679         const u8 *pos, *cell_pref = NULL, *reason = NULL;
 680         u8 id, elen;
 681         u16 disallowed_sec = 0;
 682
 683         if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
 684             mbo_ie[3] != MBO_OUI_TYPE)
 685                 return;
 686
 687         pos = mbo_ie + 4;
 688         len -= 4;
 689
 690         while (len >= 2) {
 691                 id = *pos++;
 692                 elen = *pos++;
 693                 len -= 2;
 694
 695                 if (elen > len)
 696                         goto fail;
 697
 698                 switch (id) {
 699                 case MBO_ATTR_ID_CELL_DATA_PREF:
 700                         if (elen != 1)
 701                                 goto fail;
 702
 703                         if (wpa_s->conf->mbo_cell_capa ==
 704                             MBO_CELL_CAPA_AVAILABLE)
 705                                 cell_pref = pos;
 706                         else
 707                                 wpa_printf(MSG_DEBUG,
 708                                            "MBO: Station does not support Cellular data connection");
 709                         break;
 710                 case MBO_ATTR_ID_TRANSITION_REASON:
 711                         if (elen != 1)
 712                                 goto fail;
 713
 714                         reason = pos;
 715                         break;
 716                 case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
 717                         if (elen != 2)
 718                                 goto fail;
 719
 720                         if (wpa_s->wnm_mode &
 721                             WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
 722                                 wpa_printf(MSG_DEBUG,
 723                                            "MBO: Unexpected association retry delay, BSS is terminating");
 724                                 goto fail;
 725                         } else if (wpa_s->wnm_mode &
 726                                    WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
 727                                 disallowed_sec = WPA_GET_LE16(pos);
 728                         } else {
 729                                 wpa_printf(MSG_DEBUG,
 730                                            "MBO: Association retry delay attribute not in disassoc imminent mode");
 731                         }
 732
 733                         break;
 734                 case MBO_ATTR_ID_AP_CAPA_IND:
 735                 case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
 736                 case MBO_ATTR_ID_CELL_DATA_CAPA:
 737                 case MBO_ATTR_ID_ASSOC_DISALLOW:
 738                 case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
 739                         wpa_printf(MSG_DEBUG,
 740                                    "MBO: Attribute %d should not be included in BTM Request frame",
 741                                    id);
 742                         break;
 743                 default:
 744                         wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
 745                                    id);
 746                         return;
 747                 }
 748
 749                 pos += elen;
 750                 len -= elen;
 751         }
 752
 753         if (cell_pref)
 754                 wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
 755                         *cell_pref);
 756
 757         if (reason)
 758                 wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
 759                         *reason);
 760
 761         if (disallowed_sec && wpa_s->current_bss)
 762                 wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
 763                                      disallowed_sec);
 764
 765         return;
 766 fail:
 767         wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
 768                    id, elen, len);
 769 }
 770
 771
 772 size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos,
 773                                     size_t len,
 774                                     enum mbo_transition_reject_reason reason)
 775 {
 776         u8 reject_attr[3];
 777
 778         reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
 779         reject_attr[1] = 1;
 780         reject_attr[2] = reason;
 781
 782         return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
 783 }
 784
 785
 786 void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
 787 {
 788         u8 cell_capa[7];
 789
 790         if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
 791                 wpa_printf(MSG_DEBUG,
 792                            "MBO: Cellular capability already set to %u",
 793                            mbo_cell_capa);
 794                 return;
 795         }
 796
 797         wpa_s->conf->mbo_cell_capa = mbo_cell_capa;
 798
 799         cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
 800         cell_capa[1] = 5; /* Length */
 801         WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
 802         cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
 803         cell_capa[6] = mbo_cell_capa;
 804
 805         wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
 806         wpa_supplicant_set_default_scan_ies(wpa_s);
 807 }