Home | History | Annotate | Download | only in wpa_supplicant
      1 /*
      2  * wpa_supplicant - MBO
      3  *
      4  * Copyright(c) 2015 Intel Deutschland GmbH
      5  * Contact Information:
      6  * Intel Linux Wireless <ilw (at) linux.intel.com>
      7  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
      8  *
      9  * This software may be distributed under the terms of the BSD license.
     10  * See README for more details.
     11  */
     12 
     13 #include "utils/includes.h"
     14 
     15 #include "utils/common.h"
     16 #include "common/ieee802_11_defs.h"
     17 #include "config.h"
     18 #include "wpa_supplicant_i.h"
     19 #include "driver_i.h"
     20 #include "bss.h"
     21 
     22 /* type + length + oui + oui type */
     23 #define MBO_IE_HEADER 6
     24 
     25 
     26 static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
     27 {
     28 	if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
     29 		return -1;
     30 
     31 	/* Only checking the validity of the channel and oper_class */
     32 	if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
     33 		return -1;
     34 
     35 	return 0;
     36 }
     37 
     38 
     39 const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
     40 {
     41 	const u8 *mbo, *end;
     42 
     43 	if (!bss)
     44 		return NULL;
     45 
     46 	mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
     47 	if (!mbo)
     48 		return NULL;
     49 
     50 	end = mbo + 2 + mbo[1];
     51 	mbo += MBO_IE_HEADER;
     52 
     53 	return get_ie(mbo, end - mbo, attr);
     54 }
     55 
     56 
     57 static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
     58 					     struct wpabuf *mbo,
     59 					     u8 start, u8 end)
     60 {
     61 	u8 i;
     62 
     63 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
     64 
     65 	for (i = start; i < end; i++)
     66 		wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
     67 
     68 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
     69 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
     70 	wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason_detail);
     71 }
     72 
     73 
     74 static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
     75 					struct wpabuf *mbo, u8 start, u8 end)
     76 {
     77 	size_t size = end - start + 4;
     78 
     79 	if (size + 2 > wpabuf_tailroom(mbo))
     80 		return;
     81 
     82 	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
     83 	wpabuf_put_u8(mbo, size); /* Length */
     84 
     85 	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
     86 }
     87 
     88 
     89 static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
     90 {
     91 	wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
     92 	wpabuf_put_u8(mbo, len); /* Length */
     93 	wpabuf_put_be24(mbo, OUI_WFA);
     94 	wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
     95 }
     96 
     97 
     98 static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
     99 					      struct wpabuf *mbo, u8 start,
    100 					      u8 end)
    101 {
    102 	size_t size = end - start + 8;
    103 
    104 	if (size + 2 > wpabuf_tailroom(mbo))
    105 		return;
    106 
    107 	wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
    108 	wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
    109 }
    110 
    111 
    112 static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
    113 					 struct wpabuf *mbo, int subelement)
    114 {
    115 	u8 i, start = 0;
    116 	struct wpa_mbo_non_pref_channel *start_pref;
    117 
    118 	if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
    119 		if (subelement)
    120 			wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
    121 		return;
    122 	}
    123 	start_pref = &wpa_s->non_pref_chan[0];
    124 
    125 	for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
    126 		struct wpa_mbo_non_pref_channel *non_pref = NULL;
    127 
    128 		if (i < wpa_s->non_pref_chan_num)
    129 			non_pref = &wpa_s->non_pref_chan[i];
    130 		if (!non_pref ||
    131 		    non_pref->oper_class != start_pref->oper_class ||
    132 		    non_pref->reason != start_pref->reason ||
    133 		    non_pref->reason_detail != start_pref->reason_detail ||
    134 		    non_pref->preference != start_pref->preference) {
    135 			if (subelement)
    136 				wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
    137 								  start, i);
    138 			else
    139 				wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
    140 							    i);
    141 
    142 			if (!non_pref)
    143 				return;
    144 
    145 			start = i;
    146 			start_pref = non_pref;
    147 		}
    148 	}
    149 }
    150 
    151 
    152 int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len)
    153 {
    154 	struct wpabuf *mbo;
    155 	int res;
    156 
    157 	if (len < MBO_IE_HEADER + 3 + 7)
    158 		return 0;
    159 
    160 	/* Leave room for the MBO IE header */
    161 	mbo = wpabuf_alloc(len - MBO_IE_HEADER);
    162 	if (!mbo)
    163 		return 0;
    164 
    165 	/* Add non-preferred channels attribute */
    166 	wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
    167 
    168 	/*
    169 	 * Send cellular capabilities attribute even if AP does not advertise
    170 	 * cellular capabilities.
    171 	 */
    172 	wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
    173 	wpabuf_put_u8(mbo, 1);
    174 	wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);
    175 
    176 	res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
    177 	if (!res)
    178 		wpa_printf(MSG_ERROR, "Failed to add MBO IE");
    179 
    180 	wpabuf_free(mbo);
    181 	return res;
    182 }
    183 
    184 
    185 static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s,
    186 					   const u8 *data, size_t len)
    187 {
    188 	struct wpabuf *buf;
    189 	int res;
    190 
    191 	/*
    192 	 * Send WNM-Notification Request frame only in case of a change in
    193 	 * non-preferred channels list during association, if the AP supports
    194 	 * MBO.
    195 	 */
    196 	if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss ||
    197 	    !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
    198 		return;
    199 
    200 	buf = wpabuf_alloc(4 + len);
    201 	if (!buf)
    202 		return;
    203 
    204 	wpabuf_put_u8(buf, WLAN_ACTION_WNM);
    205 	wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
    206 	wpa_s->mbo_wnm_token++;
    207 	if (wpa_s->mbo_wnm_token == 0)
    208 		wpa_s->mbo_wnm_token++;
    209 	wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
    210 	wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
    211 
    212 	wpabuf_put_data(buf, data, len);
    213 
    214 	res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
    215 				  wpa_s->own_addr, wpa_s->bssid,
    216 				  wpabuf_head(buf), wpabuf_len(buf), 0);
    217 	if (res < 0)
    218 		wpa_printf(MSG_DEBUG,
    219 			   "Failed to send WNM-Notification Request frame with non-preferred channel list");
    220 
    221 	wpabuf_free(buf);
    222 }
    223 
    224 
    225 static void wpas_mbo_non_pref_chan_changed(struct wpa_supplicant *wpa_s)
    226 {
    227 	struct wpabuf *buf;
    228 
    229 	buf = wpabuf_alloc(512);
    230 	if (!buf)
    231 		return;
    232 
    233 	wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
    234 	wpas_mbo_send_wnm_notification(wpa_s, wpabuf_head_u8(buf),
    235 				       wpabuf_len(buf));
    236 	wpabuf_free(buf);
    237 }
    238 
    239 
    240 static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
    241 				   struct wpa_mbo_non_pref_channel *b)
    242 {
    243 	return a->oper_class == b->oper_class && a->chan == b->chan;
    244 }
    245 
    246 
    247 /*
    248  * wpa_non_pref_chan_cmp - Compare two channels for sorting
    249  *
    250  * In MBO IE non-preferred channel subelement we can put many channels in an
    251  * attribute if they are in the same operating class and have the same
    252  * preference, reason, and reason detail. To make it easy for the functions that
    253  * build the IE attributes and WNM Request subelements, save the channels sorted
    254  * by their oper_class, reason, and reason_detail.
    255  */
    256 static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
    257 {
    258 	const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;
    259 
    260 	if (a->oper_class != b->oper_class)
    261 		return a->oper_class - b->oper_class;
    262 	if (a->reason != b->reason)
    263 		return a->reason - b->reason;
    264 	if (a->reason_detail != b->reason_detail)
    265 		return a->reason_detail - b->reason_detail;
    266 	return a->preference - b->preference;
    267 }
    268 
    269 
    270 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
    271 				  const char *non_pref_chan)
    272 {
    273 	char *cmd, *token, *context = NULL;
    274 	struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
    275 	size_t num = 0, size = 0;
    276 	unsigned i;
    277 
    278 	wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
    279 		   non_pref_chan ? non_pref_chan : "N/A");
    280 
    281 	/*
    282 	 * The shortest channel configuration is 10 characters - commas, 3
    283 	 * colons, and 4 values that one of them (oper_class) is 2 digits or
    284 	 * more.
    285 	 */
    286 	if (!non_pref_chan || os_strlen(non_pref_chan) < 10)
    287 		goto update;
    288 
    289 	cmd = os_strdup(non_pref_chan);
    290 	if (!cmd)
    291 		return -1;
    292 
    293 	while ((token = str_token(cmd, " ", &context))) {
    294 		struct wpa_mbo_non_pref_channel *chan;
    295 		int ret;
    296 		unsigned int _oper_class;
    297 		unsigned int _chan;
    298 		unsigned int _preference;
    299 		unsigned int _reason;
    300 		unsigned int _reason_detail;
    301 
    302 		if (num == size) {
    303 			size = size ? size * 2 : 1;
    304 			tmp_chans = os_realloc_array(chans, size,
    305 						     sizeof(*chans));
    306 			if (!tmp_chans) {
    307 				wpa_printf(MSG_ERROR,
    308 					   "Couldn't reallocate non_pref_chan");
    309 				goto fail;
    310 			}
    311 			chans = tmp_chans;
    312 		}
    313 
    314 		chan = &chans[num];
    315 
    316 		ret = sscanf(token, "%u:%u:%u:%u:%u", &_oper_class,
    317 			     &_chan, &_preference, &_reason,
    318 			     &_reason_detail);
    319 		if ((ret != 4 && ret != 5) ||
    320 		    _oper_class > 255 || _chan > 255 ||
    321 		    _preference > 255 || _reason > 65535 ||
    322 		    (ret == 5 && _reason_detail > 255)) {
    323 			wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
    324 				   token);
    325 			goto fail;
    326 		}
    327 		chan->oper_class = _oper_class;
    328 		chan->chan = _chan;
    329 		chan->preference = _preference;
    330 		chan->reason = _reason;
    331 		chan->reason_detail = ret == 4 ? 0 : _reason_detail;
    332 
    333 		if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
    334 						    chan->chan, chan->reason)) {
    335 			wpa_printf(MSG_ERROR,
    336 				   "Invalid non_pref_chan: oper class %d chan %d reason %d",
    337 				   chan->oper_class, chan->chan, chan->reason);
    338 			goto fail;
    339 		}
    340 
    341 		for (i = 0; i < num; i++)
    342 			if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
    343 				break;
    344 		if (i != num) {
    345 			wpa_printf(MSG_ERROR,
    346 				   "oper class %d chan %d is duplicated",
    347 				   chan->oper_class, chan->chan);
    348 			goto fail;
    349 		}
    350 
    351 		num++;
    352 	}
    353 
    354 	os_free(cmd);
    355 
    356 	if (chans) {
    357 		qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
    358 		      wpa_non_pref_chan_cmp);
    359 	}
    360 
    361 update:
    362 	os_free(wpa_s->non_pref_chan);
    363 	wpa_s->non_pref_chan = chans;
    364 	wpa_s->non_pref_chan_num = num;
    365 	wpas_mbo_non_pref_chan_changed(wpa_s);
    366 
    367 	return 0;
    368 
    369 fail:
    370 	os_free(chans);
    371 	os_free(cmd);
    372 	return -1;
    373 }
    374 
    375 
    376 void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
    377 {
    378 	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
    379 	wpabuf_put_u8(ie, 7);
    380 	wpabuf_put_be24(ie, OUI_WFA);
    381 	wpabuf_put_u8(ie, MBO_OUI_TYPE);
    382 
    383 	wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
    384 	wpabuf_put_u8(ie, 1);
    385 	wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
    386 }
    387 
    388 
    389 enum chan_allowed {
    390 	NOT_ALLOWED, ALLOWED
    391 };
    392 
    393 static enum chan_allowed allow_channel(struct hostapd_hw_modes *mode, u8 chan,
    394 				       unsigned int *flags)
    395 {
    396 	int i;
    397 
    398 	for (i = 0; i < mode->num_channels; i++) {
    399 		if (mode->channels[i].chan == chan)
    400 			break;
    401 	}
    402 
    403 	if (i == mode->num_channels ||
    404 	    (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED))
    405 		return NOT_ALLOWED;
    406 
    407 	if (flags)
    408 		*flags = mode->channels[i].flag;
    409 
    410 	return ALLOWED;
    411 }
    412 
    413 
    414 static int get_center_80mhz(struct hostapd_hw_modes *mode, u8 channel)
    415 {
    416 	u8 center_channels[] = {42, 58, 106, 122, 138, 155};
    417 	size_t i;
    418 
    419 	if (mode->mode != HOSTAPD_MODE_IEEE80211A)
    420 		return 0;
    421 
    422 	for (i = 0; i < ARRAY_SIZE(center_channels); i++) {
    423 		/*
    424 		 * In 80 MHz, the bandwidth "spans" 12 channels (e.g., 36-48),
    425 		 * so the center channel is 6 channels away from the start/end.
    426 		 */
    427 		if (channel >= center_channels[i] - 6 &&
    428 		    channel <= center_channels[i] + 6)
    429 			return center_channels[i];
    430 	}
    431 
    432 	return 0;
    433 }
    434 
    435 
    436 static enum chan_allowed verify_80mhz(struct hostapd_hw_modes *mode, u8 channel)
    437 {
    438 	u8 center_chan;
    439 	unsigned int i;
    440 
    441 	center_chan = get_center_80mhz(mode, channel);
    442 	if (!center_chan)
    443 		return NOT_ALLOWED;
    444 
    445 	/* check all the channels are available */
    446 	for (i = 0; i < 4; i++) {
    447 		unsigned int flags;
    448 		u8 adj_chan = center_chan - 6 + i * 4;
    449 
    450 		if (allow_channel(mode, adj_chan, &flags) == NOT_ALLOWED)
    451 			return NOT_ALLOWED;
    452 
    453 		if ((i == 0 && !(flags & HOSTAPD_CHAN_VHT_10_70)) ||
    454 		    (i == 1 && !(flags & HOSTAPD_CHAN_VHT_30_50)) ||
    455 		    (i == 2 && !(flags & HOSTAPD_CHAN_VHT_50_30)) ||
    456 		    (i == 3 && !(flags & HOSTAPD_CHAN_VHT_70_10)))
    457 			return NOT_ALLOWED;
    458 	}
    459 
    460 	return ALLOWED;
    461 }
    462 
    463 
    464 static int get_center_160mhz(struct hostapd_hw_modes *mode, u8 channel)
    465 {
    466 	u8 center_channels[] = { 50, 114 };
    467 	unsigned int i;
    468 
    469 	if (mode->mode != HOSTAPD_MODE_IEEE80211A)
    470 		return 0;
    471 
    472 	for (i = 0; i < ARRAY_SIZE(center_channels); i++) {
    473 		/*
    474 		 * In 160 MHz, the bandwidth "spans" 28 channels (e.g., 36-64),
    475 		 * so the center channel is 14 channels away from the start/end.
    476 		 */
    477 		if (channel >= center_channels[i] - 14 &&
    478 		    channel <= center_channels[i] + 14)
    479 			return center_channels[i];
    480 	}
    481 
    482 	return 0;
    483 }
    484 
    485 
    486 static enum chan_allowed verify_160mhz(struct hostapd_hw_modes *mode,
    487 				       u8 channel)
    488 {
    489 	u8 center_chan;
    490 	unsigned int i;
    491 
    492 	center_chan = get_center_160mhz(mode, channel);
    493 	if (!center_chan)
    494 		return NOT_ALLOWED;
    495 
    496 	/* Check all the channels are available */
    497 	for (i = 0; i < 8; i++) {
    498 		unsigned int flags;
    499 		u8 adj_chan = center_chan - 14 + i * 4;
    500 
    501 		if (allow_channel(mode, adj_chan, &flags) == NOT_ALLOWED)
    502 			return NOT_ALLOWED;
    503 
    504 		if ((i == 0 && !(flags & HOSTAPD_CHAN_VHT_10_150)) ||
    505 		    (i == 1 && !(flags & HOSTAPD_CHAN_VHT_30_130)) ||
    506 		    (i == 2 && !(flags & HOSTAPD_CHAN_VHT_50_110)) ||
    507 		    (i == 3 && !(flags & HOSTAPD_CHAN_VHT_70_90)) ||
    508 		    (i == 4 && !(flags & HOSTAPD_CHAN_VHT_90_70)) ||
    509 		    (i == 5 && !(flags & HOSTAPD_CHAN_VHT_110_50)) ||
    510 		    (i == 6 && !(flags & HOSTAPD_CHAN_VHT_130_30)) ||
    511 		    (i == 7 && !(flags & HOSTAPD_CHAN_VHT_150_10)))
    512 			return NOT_ALLOWED;
    513 	}
    514 
    515 	return ALLOWED;
    516 }
    517 
    518 
    519 enum chan_allowed verify_channel(struct hostapd_hw_modes *mode, u8 channel,
    520 				 u8 bw)
    521 {
    522 	unsigned int flag = 0;
    523 	enum chan_allowed res, res2;
    524 
    525 	res2 = res = allow_channel(mode, channel, &flag);
    526 	if (bw == BW40MINUS) {
    527 		if (!(flag & HOSTAPD_CHAN_HT40MINUS))
    528 			return NOT_ALLOWED;
    529 		res2 = allow_channel(mode, channel - 4, NULL);
    530 	} else if (bw == BW40PLUS) {
    531 		if (!(flag & HOSTAPD_CHAN_HT40PLUS))
    532 			return NOT_ALLOWED;
    533 		res2 = allow_channel(mode, channel + 4, NULL);
    534 	} else if (bw == BW80) {
    535 		res2 = verify_80mhz(mode, channel);
    536 	} else if (bw == BW160) {
    537 		res2 = verify_160mhz(mode, channel);
    538 	}
    539 
    540 	if (res == NOT_ALLOWED || res2 == NOT_ALLOWED)
    541 		return NOT_ALLOWED;
    542 
    543 	return ALLOWED;
    544 }
    545 
    546 
    547 static int wpas_op_class_supported(struct wpa_supplicant *wpa_s,
    548 				   const struct oper_class_map *op_class)
    549 {
    550 	int chan;
    551 	size_t i;
    552 	struct hostapd_hw_modes *mode;
    553 
    554 	mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op_class->mode);
    555 	if (!mode)
    556 		return 0;
    557 
    558 	if (op_class->op_class == 128 || op_class->op_class == 130) {
    559 		u8 channels[] = { 42, 58, 106, 122, 138, 155 };
    560 
    561 		for (i = 0; i < ARRAY_SIZE(channels); i++) {
    562 			if (verify_channel(mode, channels[i], op_class->bw) ==
    563 			    NOT_ALLOWED)
    564 				return 0;
    565 		}
    566 
    567 		return 1;
    568 	}
    569 
    570 	if (op_class->op_class == 129) {
    571 		if (verify_channel(mode, 50, op_class->bw) == NOT_ALLOWED ||
    572 		    verify_channel(mode, 114, op_class->bw) == NOT_ALLOWED)
    573 			return 0;
    574 
    575 		return 1;
    576 	}
    577 
    578 	for (chan = op_class->min_chan; chan <= op_class->max_chan;
    579 	     chan += op_class->inc) {
    580 		if (verify_channel(mode, chan, op_class->bw) == NOT_ALLOWED)
    581 			return 0;
    582 	}
    583 
    584 	return 1;
    585 }
    586 
    587 
    588 int wpas_mbo_supp_op_class_ie(struct wpa_supplicant *wpa_s, int freq, u8 *pos,
    589 			      size_t len)
    590 {
    591 	struct wpabuf *buf;
    592 	u8 op, current, chan;
    593 	u8 *ie_len;
    594 	int res;
    595 
    596 	/*
    597 	 * Assume 20 MHz channel for now.
    598 	 * TODO: Use the secondary channel and VHT channel width that will be
    599 	 * used after association.
    600 	 */
    601 	if (ieee80211_freq_to_channel_ext(freq, 0, VHT_CHANWIDTH_USE_HT,
    602 					  &current, &chan) == NUM_HOSTAPD_MODES)
    603 		return 0;
    604 
    605 	/*
    606 	 * Need 3 bytes for EID, length, and current operating class, plus
    607 	 * 1 byte for every other supported operating class.
    608 	 */
    609 	buf = wpabuf_alloc(global_op_class_size + 3);
    610 	if (!buf)
    611 		return 0;
    612 
    613 	wpabuf_put_u8(buf, WLAN_EID_SUPPORTED_OPERATING_CLASSES);
    614 	/* Will set the length later, putting a placeholder */
    615 	ie_len = wpabuf_put(buf, 1);
    616 	wpabuf_put_u8(buf, current);
    617 
    618 	for (op = 0; global_op_class[op].op_class; op++) {
    619 		if (wpas_op_class_supported(wpa_s, &global_op_class[op]))
    620 			wpabuf_put_u8(buf, global_op_class[op].op_class);
    621 	}
    622 
    623 	*ie_len = wpabuf_len(buf) - 2;
    624 	if (*ie_len < 2 || wpabuf_len(buf) > len) {
    625 		wpa_printf(MSG_ERROR,
    626 			   "Failed to add supported operating classes IE");
    627 		res = 0;
    628 	} else {
    629 		os_memcpy(pos, wpabuf_head(buf), wpabuf_len(buf));
    630 		res = wpabuf_len(buf);
    631 		wpa_hexdump_buf(MSG_DEBUG,
    632 				"MBO: Added supported operating classes IE",
    633 				buf);
    634 	}
    635 
    636 	wpabuf_free(buf);
    637 	return res;
    638 }
    639 
    640 
    641 void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
    642 			   size_t len)
    643 {
    644 	const u8 *pos, *cell_pref = NULL, *reason = NULL;
    645 	u8 id, elen;
    646 	u16 disallowed_sec = 0;
    647 
    648 	if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
    649 	    mbo_ie[3] != MBO_OUI_TYPE)
    650 		return;
    651 
    652 	pos = mbo_ie + 4;
    653 	len -= 4;
    654 
    655 	while (len >= 2) {
    656 		id = *pos++;
    657 		elen = *pos++;
    658 		len -= 2;
    659 
    660 		if (elen > len)
    661 			goto fail;
    662 
    663 		switch (id) {
    664 		case MBO_ATTR_ID_CELL_DATA_PREF:
    665 			if (elen != 1)
    666 				goto fail;
    667 
    668 			if (wpa_s->conf->mbo_cell_capa ==
    669 			    MBO_CELL_CAPA_AVAILABLE)
    670 				cell_pref = pos;
    671 			else
    672 				wpa_printf(MSG_DEBUG,
    673 					   "MBO: Station does not support Cellular data connection");
    674 			break;
    675 		case MBO_ATTR_ID_TRANSITION_REASON:
    676 			if (elen != 1)
    677 				goto fail;
    678 
    679 			reason = pos;
    680 			break;
    681 		case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
    682 			if (elen != 2)
    683 				goto fail;
    684 
    685 			if (wpa_s->wnm_mode &
    686 			    WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
    687 				wpa_printf(MSG_DEBUG,
    688 					   "MBO: Unexpected association retry delay, BSS is terminating");
    689 				goto fail;
    690 			} else if (wpa_s->wnm_mode &
    691 				   WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
    692 				disallowed_sec = WPA_GET_LE16(pos);
    693 			} else {
    694 				wpa_printf(MSG_DEBUG,
    695 					   "MBO: Association retry delay attribute not in disassoc imminent mode");
    696 			}
    697 
    698 			break;
    699 		case MBO_ATTR_ID_AP_CAPA_IND:
    700 		case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
    701 		case MBO_ATTR_ID_CELL_DATA_CAPA:
    702 		case MBO_ATTR_ID_ASSOC_DISALLOW:
    703 		case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
    704 			wpa_printf(MSG_DEBUG,
    705 				   "MBO: Attribute %d should not be included in BTM Request frame",
    706 				   id);
    707 			break;
    708 		default:
    709 			wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
    710 				   id);
    711 			return;
    712 		}
    713 
    714 		pos += elen;
    715 		len -= elen;
    716 	}
    717 
    718 	if (cell_pref)
    719 		wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
    720 			*cell_pref);
    721 
    722 	if (reason)
    723 		wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
    724 			*reason);
    725 
    726 	if (disallowed_sec && wpa_s->current_bss)
    727 		wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
    728 				     disallowed_sec);
    729 
    730 	return;
    731 fail:
    732 	wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
    733 		   id, elen, len);
    734 }
    735 
    736 
    737 size_t wpas_mbo_ie_bss_trans_reject(struct wpa_supplicant *wpa_s, u8 *pos,
    738 				    size_t len,
    739 				    enum mbo_transition_reject_reason reason)
    740 {
    741 	u8 reject_attr[3];
    742 
    743 	reject_attr[0] = MBO_ATTR_ID_TRANSITION_REJECT_REASON;
    744 	reject_attr[1] = 1;
    745 	reject_attr[2] = reason;
    746 
    747 	return mbo_add_ie(pos, len, reject_attr, sizeof(reject_attr));
    748 }
    749 
    750 
    751 void wpas_mbo_update_cell_capa(struct wpa_supplicant *wpa_s, u8 mbo_cell_capa)
    752 {
    753 	u8 cell_capa[7];
    754 
    755 	if (wpa_s->conf->mbo_cell_capa == mbo_cell_capa) {
    756 		wpa_printf(MSG_DEBUG,
    757 			   "MBO: Cellular capability already set to %u",
    758 			   mbo_cell_capa);
    759 		return;
    760 	}
    761 
    762 	wpa_s->conf->mbo_cell_capa = mbo_cell_capa;
    763 
    764 	cell_capa[0] = WLAN_EID_VENDOR_SPECIFIC;
    765 	cell_capa[1] = 5; /* Length */
    766 	WPA_PUT_BE24(cell_capa + 2, OUI_WFA);
    767 	cell_capa[5] = MBO_ATTR_ID_CELL_DATA_CAPA;
    768 	cell_capa[6] = mbo_cell_capa;
    769 
    770 	wpas_mbo_send_wnm_notification(wpa_s, cell_capa, 7);
    771 }
    772