net/mac80211/mlme.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * BSS client mode implementation
   4  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
   5  * Copyright 2004, Instant802 Networks, Inc.
   6  * Copyright 2005, Devicescape Software, Inc.
   7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   9  * Copyright 2013-2014  Intel Mobile Communications GmbH
  10  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
  11  * Copyright (C) 2018 - 2023 Intel Corporation
  12  */
  13
  14 #include <linux/delay.h>
  15 #include <linux/fips.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/etherdevice.h>
  20 #include <linux/moduleparam.h>
  21 #include <linux/rtnetlink.h>
  22 #include <linux/crc32.h>
  23 #include <linux/slab.h>
  24 #include <linux/export.h>
  25 #include <net/mac80211.h>
  26 #include <asm/unaligned.h>
  27
  28 #include "ieee80211_i.h"
  29 #include "driver-ops.h"
  30 #include "rate.h"
  31 #include "led.h"
  32 #include "fils_aead.h"
  33
  34 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
  35 #define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
  36 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
  37 #define IEEE80211_AUTH_TIMEOUT_SAE      (HZ * 2)
  38 #define IEEE80211_AUTH_MAX_TRIES        3
  39 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
  40 #define IEEE80211_AUTH_WAIT_SAE_RETRY   (HZ * 2)
  41 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
  42 #define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
  43 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
  44 #define IEEE80211_ASSOC_MAX_TRIES       3
  45
  46 static int max_nullfunc_tries = 2;
  47 module_param(max_nullfunc_tries, int, 0644);
  48 MODULE_PARM_DESC(max_nullfunc_tries,
  49                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
  50
  51 static int max_probe_tries = 5;
  52 module_param(max_probe_tries, int, 0644);
  53 MODULE_PARM_DESC(max_probe_tries,
  54                  "Maximum probe tries before disconnecting (reason 4).");
  55
  56 /*
  57  * Beacon loss timeout is calculated as N frames times the
  58  * advertised beacon interval.  This may need to be somewhat
  59  * higher than what hardware might detect to account for
  60  * delays in the host processing frames. But since we also
  61  * probe on beacon miss before declaring the connection lost
  62  * default to what we want.
  63  */
  64 static int beacon_loss_count = 7;
  65 module_param(beacon_loss_count, int, 0644);
  66 MODULE_PARM_DESC(beacon_loss_count,
  67                  "Number of beacon intervals before we decide beacon was lost.");
  68
  69 /*
  70  * Time the connection can be idle before we probe
  71  * it to see if we can still talk to the AP.
  72  */
  73 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
  74 /*
  75  * Time we wait for a probe response after sending
  76  * a probe request because of beacon loss or for
  77  * checking the connection still works.
  78  */
  79 static int probe_wait_ms = 500;
  80 module_param(probe_wait_ms, int, 0644);
  81 MODULE_PARM_DESC(probe_wait_ms,
  82                  "Maximum time(ms) to wait for probe response"
  83                  " before disconnecting (reason 4).");
  84
  85 /*
  86  * How many Beacon frames need to have been used in average signal strength
  87  * before starting to indicate signal change events.
  88  */
  89 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
  90
  91 /*
  92  * Extract from the given disabled subchannel bitmap (raw format
  93  * from the EHT Operation Element) the bits for the subchannel
  94  * we're using right now.
  95  */
  96 static u16
  97 ieee80211_extract_dis_subch_bmap(const struct ieee80211_eht_operation *eht_oper,
  98                                  struct cfg80211_chan_def *chandef, u16 bitmap)
  99 {
 100         struct ieee80211_eht_operation_info *info = (void *)eht_oper->optional;
 101         struct cfg80211_chan_def ap_chandef = *chandef;
 102         u32 ap_center_freq, local_center_freq;
 103         u32 ap_bw, local_bw;
 104         int ap_start_freq, local_start_freq;
 105         u16 shift, mask;
 106
 107         if (!(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) ||
 108             !(eht_oper->params &
 109               IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT))
 110                 return 0;
 111
 112         /* set 160/320 supported to get the full AP definition */
 113         ieee80211_chandef_eht_oper(eht_oper, true, true, &ap_chandef);
 114         ap_center_freq = ap_chandef.center_freq1;
 115         ap_bw = 20 * BIT(u8_get_bits(info->control,
 116                                      IEEE80211_EHT_OPER_CHAN_WIDTH));
 117         ap_start_freq = ap_center_freq - ap_bw / 2;
 118         local_center_freq = chandef->center_freq1;
 119         local_bw = 20 * BIT(ieee80211_chan_width_to_rx_bw(chandef->width));
 120         local_start_freq = local_center_freq - local_bw / 2;
 121         shift = (local_start_freq - ap_start_freq) / 20;
 122         mask = BIT(local_bw / 20) - 1;
 123
 124         return (bitmap >> shift) & mask;
 125 }
 126
 127 /*
 128  * Handle the puncturing bitmap, possibly downgrading bandwidth to get a
 129  * valid bitmap.
 130  */
 131 static void
 132 ieee80211_handle_puncturing_bitmap(struct ieee80211_link_data *link,
 133                                    const struct ieee80211_eht_operation *eht_oper,
 134                                    u16 bitmap, u64 *changed)
 135 {
 136         struct cfg80211_chan_def *chandef = &link->conf->chandef;
 137         u16 extracted;
 138         u64 _changed = 0;
 139
 140         if (!changed)
 141                 changed = &_changed;
 142
 143         while (chandef->width > NL80211_CHAN_WIDTH_40) {
 144                 extracted =
 145                         ieee80211_extract_dis_subch_bmap(eht_oper, chandef,
 146                                                          bitmap);
 147
 148                 if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
 149                                                              chandef))
 150                         break;
 151                 link->u.mgd.conn_flags |=
 152                         ieee80211_chandef_downgrade(chandef);
 153                 *changed |= BSS_CHANGED_BANDWIDTH;
 154         }
 155
 156         if (chandef->width <= NL80211_CHAN_WIDTH_40)
 157                 extracted = 0;
 158
 159         if (link->conf->eht_puncturing != extracted) {
 160                 link->conf->eht_puncturing = extracted;
 161                 *changed |= BSS_CHANGED_EHT_PUNCTURING;
 162         }
 163 }
 164
 165 /*
 166  * We can have multiple work items (and connection probing)
 167  * scheduling this timer, but we need to take care to only
 168  * reschedule it when it should fire _earlier_ than it was
 169  * asked for before, or if it's not pending right now. This
 170  * function ensures that. Note that it then is required to
 171  * run this function for all timeouts after the first one
 172  * has happened -- the work that runs from this timer will
 173  * do that.
 174  */
 175 static void run_again(struct ieee80211_sub_if_data *sdata,
 176                       unsigned long timeout)
 177 {
 178         sdata_assert_lock(sdata);
 179
 180         if (!timer_pending(&sdata->u.mgd.timer) ||
 181             time_before(timeout, sdata->u.mgd.timer.expires))
 182                 mod_timer(&sdata->u.mgd.timer, timeout);
 183 }
 184
 185 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 186 {
 187         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
 188                 return;
 189
 190         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 191                 return;
 192
 193         mod_timer(&sdata->u.mgd.bcn_mon_timer,
 194                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 195 }
 196
 197 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 198 {
 199         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 200
 201         if (unlikely(!ifmgd->associated))
 202                 return;
 203
 204         if (ifmgd->probe_send_count)
 205                 ifmgd->probe_send_count = 0;
 206
 207         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 208                 return;
 209
 210         mod_timer(&ifmgd->conn_mon_timer,
 211                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 212 }
 213
 214 static int ecw2cw(int ecw)
 215 {
 216         return (1 << ecw) - 1;
 217 }
 218
 219 static ieee80211_conn_flags_t
 220 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 221                              struct ieee80211_link_data *link,
 222                              ieee80211_conn_flags_t conn_flags,
 223                              struct ieee80211_supported_band *sband,
 224                              struct ieee80211_channel *channel,
 225                              u32 vht_cap_info,
 226                              const struct ieee80211_ht_operation *ht_oper,
 227                              const struct ieee80211_vht_operation *vht_oper,
 228                              const struct ieee80211_he_operation *he_oper,
 229                              const struct ieee80211_eht_operation *eht_oper,
 230                              const struct ieee80211_s1g_oper_ie *s1g_oper,
 231                              struct cfg80211_chan_def *chandef, bool tracking)
 232 {
 233         struct cfg80211_chan_def vht_chandef;
 234         struct ieee80211_sta_ht_cap sta_ht_cap;
 235         ieee80211_conn_flags_t ret;
 236         u32 ht_cfreq;
 237
 238         memset(chandef, 0, sizeof(struct cfg80211_chan_def));
 239         chandef->chan = channel;
 240         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
 241         chandef->center_freq1 = channel->center_freq;
 242         chandef->freq1_offset = channel->freq_offset;
 243
 244         if (channel->band == NL80211_BAND_6GHZ) {
 245                 if (!ieee80211_chandef_he_6ghz_oper(sdata, he_oper, eht_oper,
 246                                                     chandef)) {
 247                         mlme_dbg(sdata,
 248                                  "bad 6 GHz operation, disabling HT/VHT/HE/EHT\n");
 249                         ret = IEEE80211_CONN_DISABLE_HT |
 250                               IEEE80211_CONN_DISABLE_VHT |
 251                               IEEE80211_CONN_DISABLE_HE |
 252                               IEEE80211_CONN_DISABLE_EHT;
 253                 } else {
 254                         ret = 0;
 255                 }
 256                 vht_chandef = *chandef;
 257                 goto out;
 258         } else if (sband->band == NL80211_BAND_S1GHZ) {
 259                 if (!ieee80211_chandef_s1g_oper(s1g_oper, chandef)) {
 260                         sdata_info(sdata,
 261                                    "Missing S1G Operation Element? Trying operating == primary\n");
 262                         chandef->width = ieee80211_s1g_channel_width(channel);
 263                 }
 264
 265                 ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_40MHZ |
 266                       IEEE80211_CONN_DISABLE_VHT |
 267                       IEEE80211_CONN_DISABLE_80P80MHZ |
 268                       IEEE80211_CONN_DISABLE_160MHZ;
 269                 goto out;
 270         }
 271
 272         memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
 273         ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
 274
 275         if (!ht_oper || !sta_ht_cap.ht_supported) {
 276                 mlme_dbg(sdata, "HT operation missing / HT not supported\n");
 277                 ret = IEEE80211_CONN_DISABLE_HT |
 278                       IEEE80211_CONN_DISABLE_VHT |
 279                       IEEE80211_CONN_DISABLE_HE |
 280                       IEEE80211_CONN_DISABLE_EHT;
 281                 goto out;
 282         }
 283
 284         chandef->width = NL80211_CHAN_WIDTH_20;
 285
 286         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
 287                                                   channel->band);
 288         /* check that channel matches the right operating channel */
 289         if (!tracking && channel->center_freq != ht_cfreq) {
 290                 /*
 291                  * It's possible that some APs are confused here;
 292                  * Netgear WNDR3700 sometimes reports 4 higher than
 293                  * the actual channel in association responses, but
 294                  * since we look at probe response/beacon data here
 295                  * it should be OK.
 296                  */
 297                 sdata_info(sdata,
 298                            "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
 299                            channel->center_freq, ht_cfreq,
 300                            ht_oper->primary_chan, channel->band);
 301                 ret = IEEE80211_CONN_DISABLE_HT |
 302                       IEEE80211_CONN_DISABLE_VHT |
 303                       IEEE80211_CONN_DISABLE_HE |
 304                       IEEE80211_CONN_DISABLE_EHT;
 305                 goto out;
 306         }
 307
 308         /* check 40 MHz support, if we have it */
 309         if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
 310                 ieee80211_chandef_ht_oper(ht_oper, chandef);
 311         } else {
 312                 mlme_dbg(sdata, "40 MHz not supported\n");
 313                 /* 40 MHz (and 80 MHz) must be supported for VHT */
 314                 ret = IEEE80211_CONN_DISABLE_VHT;
 315                 /* also mark 40 MHz disabled */
 316                 ret |= IEEE80211_CONN_DISABLE_40MHZ;
 317                 goto out;
 318         }
 319
 320         if (!vht_oper || !sband->vht_cap.vht_supported) {
 321                 mlme_dbg(sdata, "VHT operation missing / VHT not supported\n");
 322                 ret = IEEE80211_CONN_DISABLE_VHT;
 323                 goto out;
 324         }
 325
 326         vht_chandef = *chandef;
 327         if (!(conn_flags & IEEE80211_CONN_DISABLE_HE) &&
 328             he_oper &&
 329             (le32_to_cpu(he_oper->he_oper_params) &
 330              IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
 331                 struct ieee80211_vht_operation he_oper_vht_cap;
 332
 333                 /*
 334                  * Set only first 3 bytes (other 2 aren't used in
 335                  * ieee80211_chandef_vht_oper() anyway)
 336                  */
 337                 memcpy(&he_oper_vht_cap, he_oper->optional, 3);
 338                 he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);
 339
 340                 if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
 341                                                 &he_oper_vht_cap, ht_oper,
 342                                                 &vht_chandef)) {
 343                         if (!(conn_flags & IEEE80211_CONN_DISABLE_HE))
 344                                 sdata_info(sdata,
 345                                            "HE AP VHT information is invalid, disabling HE\n");
 346                         ret = IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
 347                         goto out;
 348                 }
 349         } else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
 350                                                vht_cap_info,
 351                                                vht_oper, ht_oper,
 352                                                &vht_chandef)) {
 353                 if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
 354                         sdata_info(sdata,
 355                                    "AP VHT information is invalid, disabling VHT\n");
 356                 ret = IEEE80211_CONN_DISABLE_VHT;
 357                 goto out;
 358         }
 359
 360         if (!cfg80211_chandef_valid(&vht_chandef)) {
 361                 if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
 362                         sdata_info(sdata,
 363                                    "AP VHT information is invalid, disabling VHT\n");
 364                 ret = IEEE80211_CONN_DISABLE_VHT;
 365                 goto out;
 366         }
 367
 368         if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
 369                 ret = 0;
 370                 goto out;
 371         }
 372
 373         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
 374                 if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
 375                         sdata_info(sdata,
 376                                    "AP VHT information doesn't match HT, disabling VHT\n");
 377                 ret = IEEE80211_CONN_DISABLE_VHT;
 378                 goto out;
 379         }
 380
 381         *chandef = vht_chandef;
 382
 383         /*
 384          * handle the case that the EHT operation indicates that it holds EHT
 385          * operation information (in case that the channel width differs from
 386          * the channel width reported in HT/VHT/HE).
 387          */
 388         if (eht_oper && (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT)) {
 389                 struct cfg80211_chan_def eht_chandef = *chandef;
 390
 391                 ieee80211_chandef_eht_oper(eht_oper,
 392                                            eht_chandef.width ==
 393                                            NL80211_CHAN_WIDTH_160,
 394                                            false, &eht_chandef);
 395
 396                 if (!cfg80211_chandef_valid(&eht_chandef)) {
 397                         if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
 398                                 sdata_info(sdata,
 399                                            "AP EHT information is invalid, disabling EHT\n");
 400                         ret = IEEE80211_CONN_DISABLE_EHT;
 401                         goto out;
 402                 }
 403
 404                 if (!cfg80211_chandef_compatible(chandef, &eht_chandef)) {
 405                         if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
 406                                 sdata_info(sdata,
 407                                            "AP EHT information is incompatible, disabling EHT\n");
 408                         ret = IEEE80211_CONN_DISABLE_EHT;
 409                         goto out;
 410                 }
 411
 412                 *chandef = eht_chandef;
 413         }
 414
 415         ret = 0;
 416
 417 out:
 418         /*
 419          * When tracking the current AP, don't do any further checks if the
 420          * new chandef is identical to the one we're currently using for the
 421          * connection. This keeps us from playing ping-pong with regulatory,
 422          * without it the following can happen (for example):
 423          *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
 424          *  - AP advertises regdom US
 425          *  - CRDA loads regdom US with 80 MHz prohibited (old database)
 426          *  - the code below detects an unsupported channel, downgrades, and
 427          *    we disconnect from the AP in the caller
 428          *  - disconnect causes CRDA to reload world regdomain and the game
 429          *    starts anew.
 430          * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
 431          *
 432          * It seems possible that there are still scenarios with CSA or real
 433          * bandwidth changes where a this could happen, but those cases are
 434          * less common and wouldn't completely prevent using the AP.
 435          */
 436         if (tracking &&
 437             cfg80211_chandef_identical(chandef, &link->conf->chandef))
 438                 return ret;
 439
 440         /* don't print the message below for VHT mismatch if VHT is disabled */
 441         if (ret & IEEE80211_CONN_DISABLE_VHT)
 442                 vht_chandef = *chandef;
 443
 444         /*
 445          * Ignore the DISABLED flag when we're already connected and only
 446          * tracking the APs beacon for bandwidth changes - otherwise we
 447          * might get disconnected here if we connect to an AP, update our
 448          * regulatory information based on the AP's country IE and the
 449          * information we have is wrong/outdated and disables the channel
 450          * that we're actually using for the connection to the AP.
 451          */
 452         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
 453                                         tracking ? 0 :
 454                                                    IEEE80211_CHAN_DISABLED)) {
 455                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
 456                         ret = IEEE80211_CONN_DISABLE_HT |
 457                               IEEE80211_CONN_DISABLE_VHT |
 458                               IEEE80211_CONN_DISABLE_HE |
 459                               IEEE80211_CONN_DISABLE_EHT;
 460                         break;
 461                 }
 462
 463                 ret |= ieee80211_chandef_downgrade(chandef);
 464         }
 465
 466         if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
 467                                                  IEEE80211_CHAN_NO_HE))
 468                 ret |= IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
 469
 470         if (!eht_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
 471                                                   IEEE80211_CHAN_NO_EHT))
 472                 ret |= IEEE80211_CONN_DISABLE_EHT;
 473
 474         if (chandef->width != vht_chandef.width && !tracking)
 475                 sdata_info(sdata,
 476                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 477
 478         WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
 479         return ret;
 480 }
 481
 482 static int ieee80211_config_bw(struct ieee80211_link_data *link,
 483                                const struct ieee80211_ht_cap *ht_cap,
 484                                const struct ieee80211_vht_cap *vht_cap,
 485                                const struct ieee80211_ht_operation *ht_oper,
 486                                const struct ieee80211_vht_operation *vht_oper,
 487                                const struct ieee80211_he_operation *he_oper,
 488                                const struct ieee80211_eht_operation *eht_oper,
 489                                const struct ieee80211_s1g_oper_ie *s1g_oper,
 490                                const u8 *bssid, u64 *changed)
 491 {
 492         struct ieee80211_sub_if_data *sdata = link->sdata;
 493         struct ieee80211_local *local = sdata->local;
 494         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 495         struct ieee80211_channel *chan = link->conf->chandef.chan;
 496         struct ieee80211_supported_band *sband =
 497                 local->hw.wiphy->bands[chan->band];
 498         struct cfg80211_chan_def chandef;
 499         u16 ht_opmode;
 500         ieee80211_conn_flags_t flags;
 501         u32 vht_cap_info = 0;
 502         int ret;
 503
 504         /* if HT was/is disabled, don't track any bandwidth changes */
 505         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT || !ht_oper)
 506                 return 0;
 507
 508         /* don't check VHT if we associated as non-VHT station */
 509         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
 510                 vht_oper = NULL;
 511
 512         /* don't check HE if we associated as non-HE station */
 513         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE ||
 514             !ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif)) {
 515                 he_oper = NULL;
 516                 eht_oper = NULL;
 517         }
 518
 519         /* don't check EHT if we associated as non-EHT station */
 520         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT ||
 521             !ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif))
 522                 eht_oper = NULL;
 523
 524         /*
 525          * if bss configuration changed store the new one -
 526          * this may be applicable even if channel is identical
 527          */
 528         ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 529         if (link->conf->ht_operation_mode != ht_opmode) {
 530                 *changed |= BSS_CHANGED_HT;
 531                 link->conf->ht_operation_mode = ht_opmode;
 532         }
 533
 534         if (vht_cap)
 535                 vht_cap_info = le32_to_cpu(vht_cap->vht_cap_info);
 536
 537         /* calculate new channel (type) based on HT/VHT/HE operation IEs */
 538         flags = ieee80211_determine_chantype(sdata, link,
 539                                              link->u.mgd.conn_flags,
 540                                              sband, chan, vht_cap_info,
 541                                              ht_oper, vht_oper,
 542                                              he_oper, eht_oper,
 543                                              s1g_oper, &chandef, true);
 544
 545         /*
 546          * Downgrade the new channel if we associated with restricted
 547          * capabilities. For example, if we associated as a 20 MHz STA
 548          * to a 40 MHz AP (due to regulatory, capabilities or config
 549          * reasons) then switching to a 40 MHz channel now won't do us
 550          * any good -- we couldn't use it with the AP.
 551          */
 552         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ &&
 553             chandef.width == NL80211_CHAN_WIDTH_80P80)
 554                 flags |= ieee80211_chandef_downgrade(&chandef);
 555         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_160MHZ &&
 556             chandef.width == NL80211_CHAN_WIDTH_160)
 557                 flags |= ieee80211_chandef_downgrade(&chandef);
 558         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_40MHZ &&
 559             chandef.width > NL80211_CHAN_WIDTH_20)
 560                 flags |= ieee80211_chandef_downgrade(&chandef);
 561
 562         if (cfg80211_chandef_identical(&chandef, &link->conf->chandef))
 563                 return 0;
 564
 565         link_info(link,
 566                   "AP %pM changed bandwidth, new config is %d.%03d MHz, width %d (%d.%03d/%d MHz)\n",
 567                   link->u.mgd.bssid, chandef.chan->center_freq,
 568                   chandef.chan->freq_offset, chandef.width,
 569                   chandef.center_freq1, chandef.freq1_offset,
 570                   chandef.center_freq2);
 571
 572         if (flags != (link->u.mgd.conn_flags &
 573                                 (IEEE80211_CONN_DISABLE_HT |
 574                                  IEEE80211_CONN_DISABLE_VHT |
 575                                  IEEE80211_CONN_DISABLE_HE |
 576                                  IEEE80211_CONN_DISABLE_EHT |
 577                                  IEEE80211_CONN_DISABLE_40MHZ |
 578                                  IEEE80211_CONN_DISABLE_80P80MHZ |
 579                                  IEEE80211_CONN_DISABLE_160MHZ |
 580                                  IEEE80211_CONN_DISABLE_320MHZ)) ||
 581             !cfg80211_chandef_valid(&chandef)) {
 582                 sdata_info(sdata,
 583                            "AP %pM changed caps/bw in a way we can't support (0x%x/0x%x) - disconnect\n",
 584                            link->u.mgd.bssid, flags, ifmgd->flags);
 585                 return -EINVAL;
 586         }
 587
 588         ret = ieee80211_link_change_bandwidth(link, &chandef, changed);
 589
 590         if (ret) {
 591                 sdata_info(sdata,
 592                            "AP %pM changed bandwidth to incompatible one - disconnect\n",
 593                            link->u.mgd.bssid);
 594                 return ret;
 595         }
 596
 597         return 0;
 598 }
 599
 600 /* frame sending functions */
 601
 602 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 603                                 struct sk_buff *skb, u8 ap_ht_param,
 604                                 struct ieee80211_supported_band *sband,
 605                                 struct ieee80211_channel *channel,
 606                                 enum ieee80211_smps_mode smps,
 607                                 ieee80211_conn_flags_t conn_flags)
 608 {
 609         u8 *pos;
 610         u32 flags = channel->flags;
 611         u16 cap;
 612         struct ieee80211_sta_ht_cap ht_cap;
 613
 614         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 615
 616         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
 617         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 618
 619         /* determine capability flags */
 620         cap = ht_cap.cap;
 621
 622         switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 623         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 624                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
 625                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 626                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 627                 }
 628                 break;
 629         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 630                 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
 631                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 632                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 633                 }
 634                 break;
 635         }
 636
 637         /*
 638          * If 40 MHz was disabled associate as though we weren't
 639          * capable of 40 MHz -- some broken APs will never fall
 640          * back to trying to transmit in 20 MHz.
 641          */
 642         if (conn_flags & IEEE80211_CONN_DISABLE_40MHZ) {
 643                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 644                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 645         }
 646
 647         /* set SM PS mode properly */
 648         cap &= ~IEEE80211_HT_CAP_SM_PS;
 649         switch (smps) {
 650         case IEEE80211_SMPS_AUTOMATIC:
 651         case IEEE80211_SMPS_NUM_MODES:
 652                 WARN_ON(1);
 653                 fallthrough;
 654         case IEEE80211_SMPS_OFF:
 655                 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
 656                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 657                 break;
 658         case IEEE80211_SMPS_STATIC:
 659                 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
 660                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 661                 break;
 662         case IEEE80211_SMPS_DYNAMIC:
 663                 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
 664                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 665                 break;
 666         }
 667
 668         /* reserve and fill IE */
 669         pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
 670         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 671 }
 672
 673 /* This function determines vht capability flags for the association
 674  * and builds the IE.
 675  * Note - the function returns true to own the MU-MIMO capability
 676  */
 677 static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
 678                                  struct sk_buff *skb,
 679                                  struct ieee80211_supported_band *sband,
 680                                  struct ieee80211_vht_cap *ap_vht_cap,
 681                                  ieee80211_conn_flags_t conn_flags)
 682 {
 683         struct ieee80211_local *local = sdata->local;
 684         u8 *pos;
 685         u32 cap;
 686         struct ieee80211_sta_vht_cap vht_cap;
 687         u32 mask, ap_bf_sts, our_bf_sts;
 688         bool mu_mimo_owner = false;
 689
 690         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 691
 692         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
 693         ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
 694
 695         /* determine capability flags */
 696         cap = vht_cap.cap;
 697
 698         if (conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ) {
 699                 u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 700
 701                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 702                 if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
 703                     bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
 704                         cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
 705         }
 706
 707         if (conn_flags & IEEE80211_CONN_DISABLE_160MHZ) {
 708                 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
 709                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 710         }
 711
 712         /*
 713          * Some APs apparently get confused if our capabilities are better
 714          * than theirs, so restrict what we advertise in the assoc request.
 715          */
 716         if (!(ap_vht_cap->vht_cap_info &
 717                         cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
 718                 cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
 719                          IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 720         else if (!(ap_vht_cap->vht_cap_info &
 721                         cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
 722                 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 723
 724         /*
 725          * If some other vif is using the MU-MIMO capability we cannot associate
 726          * using MU-MIMO - this will lead to contradictions in the group-id
 727          * mechanism.
 728          * Ownership is defined since association request, in order to avoid
 729          * simultaneous associations with MU-MIMO.
 730          */
 731         if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
 732                 bool disable_mu_mimo = false;
 733                 struct ieee80211_sub_if_data *other;
 734
 735                 list_for_each_entry_rcu(other, &local->interfaces, list) {
 736                         if (other->vif.bss_conf.mu_mimo_owner) {
 737                                 disable_mu_mimo = true;
 738                                 break;
 739                         }
 740                 }
 741                 if (disable_mu_mimo)
 742                         cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 743                 else
 744                         mu_mimo_owner = true;
 745         }
 746
 747         mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
 748
 749         ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
 750         our_bf_sts = cap & mask;
 751
 752         if (ap_bf_sts < our_bf_sts) {
 753                 cap &= ~mask;
 754                 cap |= ap_bf_sts;
 755         }
 756
 757         /* reserve and fill IE */
 758         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
 759         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
 760
 761         return mu_mimo_owner;
 762 }
 763
 764 /* This function determines HE capability flags for the association
 765  * and builds the IE.
 766  */
 767 static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
 768                                 struct sk_buff *skb,
 769                                 struct ieee80211_supported_band *sband,
 770                                 enum ieee80211_smps_mode smps_mode,
 771                                 ieee80211_conn_flags_t conn_flags)
 772 {
 773         u8 *pos, *pre_he_pos;
 774         const struct ieee80211_sta_he_cap *he_cap;
 775         u8 he_cap_size;
 776
 777         he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
 778         if (WARN_ON(!he_cap))
 779                 return;
 780
 781         /* get a max size estimate */
 782         he_cap_size =
 783                 2 + 1 + sizeof(he_cap->he_cap_elem) +
 784                 ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
 785                 ieee80211_he_ppe_size(he_cap->ppe_thres[0],
 786                                       he_cap->he_cap_elem.phy_cap_info);
 787         pos = skb_put(skb, he_cap_size);
 788         pre_he_pos = pos;
 789         pos = ieee80211_ie_build_he_cap(conn_flags,
 790                                         pos, he_cap, pos + he_cap_size);
 791         /* trim excess if any */
 792         skb_trim(skb, skb->len - (pre_he_pos + he_cap_size - pos));
 793
 794         ieee80211_ie_build_he_6ghz_cap(sdata, smps_mode, skb);
 795 }
 796
 797 static void ieee80211_add_eht_ie(struct ieee80211_sub_if_data *sdata,
 798                                  struct sk_buff *skb,
 799                                  struct ieee80211_supported_band *sband)
 800 {
 801         u8 *pos;
 802         const struct ieee80211_sta_he_cap *he_cap;
 803         const struct ieee80211_sta_eht_cap *eht_cap;
 804         u8 eht_cap_size;
 805
 806         he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
 807         eht_cap = ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
 808
 809         /*
 810          * EHT capabilities element is only added if the HE capabilities element
 811          * was added so assume that 'he_cap' is valid and don't check it.
 812          */
 813         if (WARN_ON(!he_cap || !eht_cap))
 814                 return;
 815
 816         eht_cap_size =
 817                 2 + 1 + sizeof(eht_cap->eht_cap_elem) +
 818                 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
 819                                            &eht_cap->eht_cap_elem,
 820                                            false) +
 821                 ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0],
 822                                        eht_cap->eht_cap_elem.phy_cap_info);
 823         pos = skb_put(skb, eht_cap_size);
 824         ieee80211_ie_build_eht_cap(pos, he_cap, eht_cap, pos + eht_cap_size,
 825                                    false);
 826 }
 827
 828 static void ieee80211_assoc_add_rates(struct sk_buff *skb,
 829                                       enum nl80211_chan_width width,
 830                                       struct ieee80211_supported_band *sband,
 831                                       struct ieee80211_mgd_assoc_data *assoc_data)
 832 {
 833         unsigned int shift = ieee80211_chanwidth_get_shift(width);
 834         unsigned int rates_len, supp_rates_len;
 835         u32 rates = 0;
 836         int i, count;
 837         u8 *pos;
 838
 839         if (assoc_data->supp_rates_len) {
 840                 /*
 841                  * Get all rates supported by the device and the AP as
 842                  * some APs don't like getting a superset of their rates
 843                  * in the association request (e.g. D-Link DAP 1353 in
 844                  * b-only mode)...
 845                  */
 846                 rates_len = ieee80211_parse_bitrates(width, sband,
 847                                                      assoc_data->supp_rates,
 848                                                      assoc_data->supp_rates_len,
 849                                                      &rates);
 850         } else {
 851                 /*
 852                  * In case AP not provide any supported rates information
 853                  * before association, we send information element(s) with
 854                  * all rates that we support.
 855                  */
 856                 rates_len = sband->n_bitrates;
 857                 for (i = 0; i < sband->n_bitrates; i++)
 858                         rates |= BIT(i);
 859         }
 860
 861         supp_rates_len = rates_len;
 862         if (supp_rates_len > 8)
 863                 supp_rates_len = 8;
 864
 865         pos = skb_put(skb, supp_rates_len + 2);
 866         *pos++ = WLAN_EID_SUPP_RATES;
 867         *pos++ = supp_rates_len;
 868
 869         count = 0;
 870         for (i = 0; i < sband->n_bitrates; i++) {
 871                 if (BIT(i) & rates) {
 872                         int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 873                                                 5 * (1 << shift));
 874                         *pos++ = (u8)rate;
 875                         if (++count == 8)
 876                                 break;
 877                 }
 878         }
 879
 880         if (rates_len > count) {
 881                 pos = skb_put(skb, rates_len - count + 2);
 882                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 883                 *pos++ = rates_len - count;
 884
 885                 for (i++; i < sband->n_bitrates; i++) {
 886                         if (BIT(i) & rates) {
 887                                 int rate;
 888
 889                                 rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 890                                                     5 * (1 << shift));
 891                                 *pos++ = (u8)rate;
 892                         }
 893                 }
 894         }
 895 }
 896
 897 static size_t ieee80211_add_before_ht_elems(struct sk_buff *skb,
 898                                             const u8 *elems,
 899                                             size_t elems_len,
 900                                             size_t offset)
 901 {
 902         size_t noffset;
 903
 904         static const u8 before_ht[] = {
 905                 WLAN_EID_SSID,
 906                 WLAN_EID_SUPP_RATES,
 907                 WLAN_EID_EXT_SUPP_RATES,
 908                 WLAN_EID_PWR_CAPABILITY,
 909                 WLAN_EID_SUPPORTED_CHANNELS,
 910                 WLAN_EID_RSN,
 911                 WLAN_EID_QOS_CAPA,
 912                 WLAN_EID_RRM_ENABLED_CAPABILITIES,
 913                 WLAN_EID_MOBILITY_DOMAIN,
 914                 WLAN_EID_FAST_BSS_TRANSITION,   /* reassoc only */
 915                 WLAN_EID_RIC_DATA,              /* reassoc only */
 916                 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 917         };
 918         static const u8 after_ric[] = {
 919                 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 920                 WLAN_EID_HT_CAPABILITY,
 921                 WLAN_EID_BSS_COEX_2040,
 922                 /* luckily this is almost always there */
 923                 WLAN_EID_EXT_CAPABILITY,
 924                 WLAN_EID_QOS_TRAFFIC_CAPA,
 925                 WLAN_EID_TIM_BCAST_REQ,
 926                 WLAN_EID_INTERWORKING,
 927                 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
 928                 WLAN_EID_VHT_CAPABILITY,
 929                 WLAN_EID_OPMODE_NOTIF,
 930         };
 931
 932         if (!elems_len)
 933                 return offset;
 934
 935         noffset = ieee80211_ie_split_ric(elems, elems_len,
 936                                          before_ht,
 937                                          ARRAY_SIZE(before_ht),
 938                                          after_ric,
 939                                          ARRAY_SIZE(after_ric),
 940                                          offset);
 941         skb_put_data(skb, elems + offset, noffset - offset);
 942
 943         return noffset;
 944 }
 945
 946 static size_t ieee80211_add_before_vht_elems(struct sk_buff *skb,
 947                                              const u8 *elems,
 948                                              size_t elems_len,
 949                                              size_t offset)
 950 {
 951         static const u8 before_vht[] = {
 952                 /*
 953                  * no need to list the ones split off before HT
 954                  * or generated here
 955                  */
 956                 WLAN_EID_BSS_COEX_2040,
 957                 WLAN_EID_EXT_CAPABILITY,
 958                 WLAN_EID_QOS_TRAFFIC_CAPA,
 959                 WLAN_EID_TIM_BCAST_REQ,
 960                 WLAN_EID_INTERWORKING,
 961                 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
 962         };
 963         size_t noffset;
 964
 965         if (!elems_len)
 966                 return offset;
 967
 968         /* RIC already taken care of in ieee80211_add_before_ht_elems() */
 969         noffset = ieee80211_ie_split(elems, elems_len,
 970                                      before_vht, ARRAY_SIZE(before_vht),
 971                                      offset);
 972         skb_put_data(skb, elems + offset, noffset - offset);
 973
 974         return noffset;
 975 }
 976
 977 static size_t ieee80211_add_before_he_elems(struct sk_buff *skb,
 978                                             const u8 *elems,
 979                                             size_t elems_len,
 980                                             size_t offset)
 981 {
 982         static const u8 before_he[] = {
 983                 /*
 984                  * no need to list the ones split off before VHT
 985                  * or generated here
 986                  */
 987                 WLAN_EID_OPMODE_NOTIF,
 988                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
 989                 /* 11ai elements */
 990                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
 991                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
 992                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
 993                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
 994                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
 995                 /* TODO: add 11ah/11aj/11ak elements */
 996         };
 997         size_t noffset;
 998
 999         if (!elems_len)
1000                 return offset;
1001
1002         /* RIC already taken care of in ieee80211_add_before_ht_elems() */
1003         noffset = ieee80211_ie_split(elems, elems_len,
1004                                      before_he, ARRAY_SIZE(before_he),
1005                                      offset);
1006         skb_put_data(skb, elems + offset, noffset - offset);
1007
1008         return noffset;
1009 }
1010
1011 #define PRESENT_ELEMS_MAX       8
1012 #define PRESENT_ELEM_EXT_OFFS   0x100
1013
1014 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1015                                         struct sk_buff *skb, u16 capab,
1016                                         const struct element *ext_capa,
1017                                         const u16 *present_elems);
1018
1019 static size_t ieee80211_assoc_link_elems(struct ieee80211_sub_if_data *sdata,
1020                                          struct sk_buff *skb, u16 *capab,
1021                                          const struct element *ext_capa,
1022                                          const u8 *extra_elems,
1023                                          size_t extra_elems_len,
1024                                          unsigned int link_id,
1025                                          struct ieee80211_link_data *link,
1026                                          u16 *present_elems)
1027 {
1028         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1029         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1030         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1031         struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1032         struct ieee80211_channel *chan = cbss->channel;
1033         const struct ieee80211_sband_iftype_data *iftd;
1034         struct ieee80211_local *local = sdata->local;
1035         struct ieee80211_supported_band *sband;
1036         enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20;
1037         struct ieee80211_chanctx_conf *chanctx_conf;
1038         enum ieee80211_smps_mode smps_mode;
1039         u16 orig_capab = *capab;
1040         size_t offset = 0;
1041         int present_elems_len = 0;
1042         u8 *pos;
1043         int i;
1044
1045 #define ADD_PRESENT_ELEM(id) do {                                       \
1046         /* need a last for termination - we use 0 == SSID */            \
1047         if (!WARN_ON(present_elems_len >= PRESENT_ELEMS_MAX - 1))       \
1048                 present_elems[present_elems_len++] = (id);              \
1049 } while (0)
1050 #define ADD_PRESENT_EXT_ELEM(id) ADD_PRESENT_ELEM(PRESENT_ELEM_EXT_OFFS | (id))
1051
1052         if (link)
1053                 smps_mode = link->smps_mode;
1054         else if (sdata->u.mgd.powersave)
1055                 smps_mode = IEEE80211_SMPS_DYNAMIC;
1056         else
1057                 smps_mode = IEEE80211_SMPS_OFF;
1058
1059         if (link) {
1060                 /*
1061                  * 5/10 MHz scenarios are only viable without MLO, in which
1062                  * case this pointer should be used ... All of this is a bit
1063                  * unclear though, not sure this even works at all.
1064                  */
1065                 rcu_read_lock();
1066                 chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
1067                 if (chanctx_conf)
1068                         width = chanctx_conf->def.width;
1069                 rcu_read_unlock();
1070         }
1071
1072         sband = local->hw.wiphy->bands[chan->band];
1073         iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1074
1075         if (sband->band == NL80211_BAND_2GHZ) {
1076                 *capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
1077                 *capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
1078         }
1079
1080         if ((cbss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
1081             ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
1082                 *capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
1083
1084         if (sband->band != NL80211_BAND_S1GHZ)
1085                 ieee80211_assoc_add_rates(skb, width, sband, assoc_data);
1086
1087         if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
1088             *capab & WLAN_CAPABILITY_RADIO_MEASURE) {
1089                 struct cfg80211_chan_def chandef = {
1090                         .width = width,
1091                         .chan = chan,
1092                 };
1093
1094                 pos = skb_put(skb, 4);
1095                 *pos++ = WLAN_EID_PWR_CAPABILITY;
1096                 *pos++ = 2;
1097                 *pos++ = 0; /* min tx power */
1098                  /* max tx power */
1099                 *pos++ = ieee80211_chandef_max_power(&chandef);
1100                 ADD_PRESENT_ELEM(WLAN_EID_PWR_CAPABILITY);
1101         }
1102
1103         /*
1104          * Per spec, we shouldn't include the list of channels if we advertise
1105          * support for extended channel switching, but we've always done that;
1106          * (for now?) apply this restriction only on the (new) 6 GHz band.
1107          */
1108         if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
1109             (sband->band != NL80211_BAND_6GHZ ||
1110              !ext_capa || ext_capa->datalen < 1 ||
1111              !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
1112                 /* TODO: get this in reg domain format */
1113                 pos = skb_put(skb, 2 * sband->n_channels + 2);
1114                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
1115                 *pos++ = 2 * sband->n_channels;
1116                 for (i = 0; i < sband->n_channels; i++) {
1117                         int cf = sband->channels[i].center_freq;
1118
1119                         *pos++ = ieee80211_frequency_to_channel(cf);
1120                         *pos++ = 1; /* one channel in the subband*/
1121                 }
1122                 ADD_PRESENT_ELEM(WLAN_EID_SUPPORTED_CHANNELS);
1123         }
1124
1125         /* if present, add any custom IEs that go before HT */
1126         offset = ieee80211_add_before_ht_elems(skb, extra_elems,
1127                                                extra_elems_len,
1128                                                offset);
1129
1130         if (sband->band != NL80211_BAND_6GHZ &&
1131             !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT)) {
1132                 ieee80211_add_ht_ie(sdata, skb,
1133                                     assoc_data->link[link_id].ap_ht_param,
1134                                     sband, chan, smps_mode,
1135                                     assoc_data->link[link_id].conn_flags);
1136                 ADD_PRESENT_ELEM(WLAN_EID_HT_CAPABILITY);
1137         }
1138
1139         /* if present, add any custom IEs that go before VHT */
1140         offset = ieee80211_add_before_vht_elems(skb, extra_elems,
1141                                                 extra_elems_len,
1142                                                 offset);
1143
1144         if (sband->band != NL80211_BAND_6GHZ &&
1145             !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
1146                 bool mu_mimo_owner =
1147                         ieee80211_add_vht_ie(sdata, skb, sband,
1148                                              &assoc_data->link[link_id].ap_vht_cap,
1149                                              assoc_data->link[link_id].conn_flags);
1150
1151                 if (link)
1152                         link->conf->mu_mimo_owner = mu_mimo_owner;
1153                 ADD_PRESENT_ELEM(WLAN_EID_VHT_CAPABILITY);
1154         }
1155
1156         /*
1157          * If AP doesn't support HT, mark HE and EHT as disabled.
1158          * If on the 5GHz band, make sure it supports VHT.
1159          */
1160         if (assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT ||
1161             (sband->band == NL80211_BAND_5GHZ &&
1162              assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT))
1163                 assoc_data->link[link_id].conn_flags |=
1164                         IEEE80211_CONN_DISABLE_HE |
1165                         IEEE80211_CONN_DISABLE_EHT;
1166
1167         /* if present, add any custom IEs that go before HE */
1168         offset = ieee80211_add_before_he_elems(skb, extra_elems,
1169                                                extra_elems_len,
1170                                                offset);
1171
1172         if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HE)) {
1173                 ieee80211_add_he_ie(sdata, skb, sband, smps_mode,
1174                                     assoc_data->link[link_id].conn_flags);
1175                 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY);
1176         }
1177
1178         /*
1179          * careful - need to know about all the present elems before
1180          * calling ieee80211_assoc_add_ml_elem(), so add this one if
1181          * we're going to put it after the ML element
1182          */
1183         if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
1184                 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_EHT_CAPABILITY);
1185
1186         if (link_id == assoc_data->assoc_link_id)
1187                 ieee80211_assoc_add_ml_elem(sdata, skb, orig_capab, ext_capa,
1188                                             present_elems);
1189
1190         /* crash if somebody gets it wrong */
1191         present_elems = NULL;
1192
1193         if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
1194                 ieee80211_add_eht_ie(sdata, skb, sband);
1195
1196         if (sband->band == NL80211_BAND_S1GHZ) {
1197                 ieee80211_add_aid_request_ie(sdata, skb);
1198                 ieee80211_add_s1g_capab_ie(sdata, &sband->s1g_cap, skb);
1199         }
1200
1201         if (iftd && iftd->vendor_elems.data && iftd->vendor_elems.len)
1202                 skb_put_data(skb, iftd->vendor_elems.data, iftd->vendor_elems.len);
1203
1204         if (link)
1205                 link->u.mgd.conn_flags = assoc_data->link[link_id].conn_flags;
1206
1207         return offset;
1208 }
1209
1210 static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb,
1211                                                const u16 *outer,
1212                                                const u16 *inner)
1213 {
1214         unsigned int skb_len = skb->len;
1215         bool at_extension = false;
1216         bool added = false;
1217         int i, j;
1218         u8 *len, *list_len = NULL;
1219
1220         skb_put_u8(skb, WLAN_EID_EXTENSION);
1221         len = skb_put(skb, 1);
1222         skb_put_u8(skb, WLAN_EID_EXT_NON_INHERITANCE);
1223
1224         for (i = 0; i < PRESENT_ELEMS_MAX && outer[i]; i++) {
1225                 u16 elem = outer[i];
1226                 bool have_inner = false;
1227
1228                 /* should at least be sorted in the sense of normal -> ext */
1229                 WARN_ON(at_extension && elem < PRESENT_ELEM_EXT_OFFS);
1230
1231                 /* switch to extension list */
1232                 if (!at_extension && elem >= PRESENT_ELEM_EXT_OFFS) {
1233                         at_extension = true;
1234                         if (!list_len)
1235                                 skb_put_u8(skb, 0);
1236                         list_len = NULL;
1237                 }
1238
1239                 for (j = 0; j < PRESENT_ELEMS_MAX && inner[j]; j++) {
1240                         if (elem == inner[j]) {
1241                                 have_inner = true;
1242                                 break;
1243                         }
1244                 }
1245
1246                 if (have_inner)
1247                         continue;
1248
1249                 if (!list_len) {
1250                         list_len = skb_put(skb, 1);
1251                         *list_len = 0;
1252                 }
1253                 *list_len += 1;
1254                 skb_put_u8(skb, (u8)elem);
1255                 added = true;
1256         }
1257
1258         /* if we added a list but no extension list, make a zero-len one */
1259         if (added && (!at_extension || !list_len))
1260                 skb_put_u8(skb, 0);
1261
1262         /* if nothing added remove extension element completely */
1263         if (!added)
1264                 skb_trim(skb, skb_len);
1265         else
1266                 *len = skb->len - skb_len - 2;
1267 }
1268
1269 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1270                                         struct sk_buff *skb, u16 capab,
1271                                         const struct element *ext_capa,
1272                                         const u16 *outer_present_elems)
1273 {
1274         struct ieee80211_local *local = sdata->local;
1275         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1276         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1277         struct ieee80211_multi_link_elem *ml_elem;
1278         struct ieee80211_mle_basic_common_info *common;
1279         const struct wiphy_iftype_ext_capab *ift_ext_capa;
1280         __le16 eml_capa = 0, mld_capa_ops = 0;
1281         unsigned int link_id;
1282         u8 *ml_elem_len;
1283         void *capab_pos;
1284
1285         if (!ieee80211_vif_is_mld(&sdata->vif))
1286                 return;
1287
1288         ift_ext_capa = cfg80211_get_iftype_ext_capa(local->hw.wiphy,
1289                                                     ieee80211_vif_type_p2p(&sdata->vif));
1290         if (ift_ext_capa) {
1291                 eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities);
1292                 mld_capa_ops = cpu_to_le16(ift_ext_capa->mld_capa_and_ops);
1293         }
1294
1295         skb_put_u8(skb, WLAN_EID_EXTENSION);
1296         ml_elem_len = skb_put(skb, 1);
1297         skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK);
1298         ml_elem = skb_put(skb, sizeof(*ml_elem));
1299         ml_elem->control =
1300                 cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC |
1301                             IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP);
1302         common = skb_put(skb, sizeof(*common));
1303         common->len = sizeof(*common) +
1304                       2;  /* MLD capa/ops */
1305         memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN);
1306
1307         /* add EML_CAPA only if needed, see Draft P802.11be_D2.1, 35.3.17 */
1308         if (eml_capa &
1309             cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |
1310                          IEEE80211_EML_CAP_EMLMR_SUPPORT))) {
1311                 common->len += 2; /* EML capabilities */
1312                 ml_elem->control |=
1313                         cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EML_CAPA);
1314                 skb_put_data(skb, &eml_capa, sizeof(eml_capa));
1315         }
1316         /* need indication from userspace to support this */
1317         mld_capa_ops &= ~cpu_to_le16(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP);
1318         skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops));
1319
1320         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1321                 u16 link_present_elems[PRESENT_ELEMS_MAX] = {};
1322                 const u8 *extra_elems;
1323                 size_t extra_elems_len;
1324                 size_t extra_used;
1325                 u8 *subelem_len = NULL;
1326                 __le16 ctrl;
1327
1328                 if (!assoc_data->link[link_id].bss ||
1329                     link_id == assoc_data->assoc_link_id)
1330                         continue;
1331
1332                 extra_elems = assoc_data->link[link_id].elems;
1333                 extra_elems_len = assoc_data->link[link_id].elems_len;
1334
1335                 skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE);
1336                 subelem_len = skb_put(skb, 1);
1337
1338                 ctrl = cpu_to_le16(link_id |
1339                                    IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE |
1340                                    IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT);
1341                 skb_put_data(skb, &ctrl, sizeof(ctrl));
1342                 skb_put_u8(skb, 1 + ETH_ALEN); /* STA Info Length */
1343                 skb_put_data(skb, assoc_data->link[link_id].addr,
1344                              ETH_ALEN);
1345                 /*
1346                  * Now add the contents of the (re)association request,
1347                  * but the "listen interval" and "current AP address"
1348                  * (if applicable) are skipped. So we only have
1349                  * the capability field (remember the position and fill
1350                  * later), followed by the elements added below by
1351                  * calling ieee80211_assoc_link_elems().
1352                  */
1353                 capab_pos = skb_put(skb, 2);
1354
1355                 extra_used = ieee80211_assoc_link_elems(sdata, skb, &capab,
1356                                                         ext_capa,
1357                                                         extra_elems,
1358                                                         extra_elems_len,
1359                                                         link_id, NULL,
1360                                                         link_present_elems);
1361                 if (extra_elems)
1362                         skb_put_data(skb, extra_elems + extra_used,
1363                                      extra_elems_len - extra_used);
1364
1365                 put_unaligned_le16(capab, capab_pos);
1366
1367                 ieee80211_add_non_inheritance_elem(skb, outer_present_elems,
1368                                                    link_present_elems);
1369
1370                 ieee80211_fragment_element(skb, subelem_len,
1371                                            IEEE80211_MLE_SUBELEM_FRAGMENT);
1372         }
1373
1374         ieee80211_fragment_element(skb, ml_elem_len, WLAN_EID_FRAGMENT);
1375 }
1376
1377 static int ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
1378 {
1379         struct ieee80211_local *local = sdata->local;
1380         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1381         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1382         struct ieee80211_link_data *link;
1383         struct sk_buff *skb;
1384         struct ieee80211_mgmt *mgmt;
1385         u8 *pos, qos_info, *ie_start;
1386         size_t offset, noffset;
1387         u16 capab = WLAN_CAPABILITY_ESS, link_capab;
1388         __le16 listen_int;
1389         struct element *ext_capa = NULL;
1390         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1391         struct ieee80211_prep_tx_info info = {};
1392         unsigned int link_id, n_links = 0;
1393         u16 present_elems[PRESENT_ELEMS_MAX] = {};
1394         void *capab_pos;
1395         size_t size;
1396         int ret;
1397
1398         /* we know it's writable, cast away the const */
1399         if (assoc_data->ie_len)
1400                 ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
1401                                                       assoc_data->ie,
1402                                                       assoc_data->ie_len);
1403
1404         sdata_assert_lock(sdata);
1405
1406         size = local->hw.extra_tx_headroom +
1407                sizeof(*mgmt) + /* bit too much but doesn't matter */
1408                2 + assoc_data->ssid_len + /* SSID */
1409                assoc_data->ie_len + /* extra IEs */
1410                (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
1411                9; /* WMM */
1412
1413         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1414                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1415                 const struct ieee80211_sband_iftype_data *iftd;
1416                 struct ieee80211_supported_band *sband;
1417
1418                 if (!cbss)
1419                         continue;
1420
1421                 sband = local->hw.wiphy->bands[cbss->channel->band];
1422
1423                 n_links++;
1424                 /* add STA profile elements length */
1425                 size += assoc_data->link[link_id].elems_len;
1426                 /* and supported rates length */
1427                 size += 4 + sband->n_bitrates;
1428                 /* supported channels */
1429                 size += 2 + 2 * sband->n_channels;
1430
1431                 iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1432                 if (iftd)
1433                         size += iftd->vendor_elems.len;
1434
1435                 /* power capability */
1436                 size += 4;
1437
1438                 /* HT, VHT, HE, EHT */
1439                 size += 2 + sizeof(struct ieee80211_ht_cap);
1440                 size += 2 + sizeof(struct ieee80211_vht_cap);
1441                 size += 2 + 1 + sizeof(struct ieee80211_he_cap_elem) +
1442                         sizeof(struct ieee80211_he_mcs_nss_supp) +
1443                         IEEE80211_HE_PPE_THRES_MAX_LEN;
1444
1445                 if (sband->band == NL80211_BAND_6GHZ)
1446                         size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa);
1447
1448                 size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) +
1449                         sizeof(struct ieee80211_eht_mcs_nss_supp) +
1450                         IEEE80211_EHT_PPE_THRES_MAX_LEN;
1451
1452                 /* non-inheritance element */
1453                 size += 2 + 2 + PRESENT_ELEMS_MAX;
1454
1455                 /* should be the same across all BSSes */
1456                 if (cbss->capability & WLAN_CAPABILITY_PRIVACY)
1457                         capab |= WLAN_CAPABILITY_PRIVACY;
1458         }
1459
1460         if (ieee80211_vif_is_mld(&sdata->vif)) {
1461                 /* consider the multi-link element with STA profile */
1462                 size += sizeof(struct ieee80211_multi_link_elem);
1463                 /* max common info field in basic multi-link element */
1464                 size += sizeof(struct ieee80211_mle_basic_common_info) +
1465                         2 + /* capa & op */
1466                         2; /* EML capa */
1467
1468                 /*
1469                  * The capability elements were already considered above;
1470                  * note this over-estimates a bit because there's no
1471                  * STA profile for the assoc link.
1472                  */
1473                 size += (n_links - 1) *
1474                         (1 + 1 + /* subelement ID/length */
1475                          2 + /* STA control */
1476                          1 + ETH_ALEN + 2 /* STA Info field */);
1477         }
1478
1479         link = sdata_dereference(sdata->link[assoc_data->assoc_link_id], sdata);
1480         if (WARN_ON(!link))
1481                 return -EINVAL;
1482
1483         if (WARN_ON(!assoc_data->link[assoc_data->assoc_link_id].bss))
1484                 return -EINVAL;
1485
1486         skb = alloc_skb(size, GFP_KERNEL);
1487         if (!skb)
1488                 return -ENOMEM;
1489
1490         skb_reserve(skb, local->hw.extra_tx_headroom);
1491
1492         if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
1493                 capab |= WLAN_CAPABILITY_RADIO_MEASURE;
1494
1495         /* Set MBSSID support for HE AP if needed */
1496         if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
1497             !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
1498             ext_capa && ext_capa->datalen >= 3)
1499                 ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
1500
1501         mgmt = skb_put_zero(skb, 24);
1502         memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
1503         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1504         memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
1505
1506         listen_int = cpu_to_le16(assoc_data->s1g ?
1507                         ieee80211_encode_usf(local->hw.conf.listen_interval) :
1508                         local->hw.conf.listen_interval);
1509         if (!is_zero_ether_addr(assoc_data->prev_ap_addr)) {
1510                 skb_put(skb, 10);
1511                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1512                                                   IEEE80211_STYPE_REASSOC_REQ);
1513                 capab_pos = &mgmt->u.reassoc_req.capab_info;
1514                 mgmt->u.reassoc_req.listen_interval = listen_int;
1515                 memcpy(mgmt->u.reassoc_req.current_ap,
1516                        assoc_data->prev_ap_addr, ETH_ALEN);
1517                 info.subtype = IEEE80211_STYPE_REASSOC_REQ;
1518         } else {
1519                 skb_put(skb, 4);
1520                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1521                                                   IEEE80211_STYPE_ASSOC_REQ);
1522                 capab_pos = &mgmt->u.assoc_req.capab_info;
1523                 mgmt->u.assoc_req.listen_interval = listen_int;
1524                 info.subtype = IEEE80211_STYPE_ASSOC_REQ;
1525         }
1526
1527         /* SSID */
1528         pos = skb_put(skb, 2 + assoc_data->ssid_len);
1529         ie_start = pos;
1530         *pos++ = WLAN_EID_SSID;
1531         *pos++ = assoc_data->ssid_len;
1532         memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
1533
1534         /* add the elements for the assoc (main) link */
1535         link_capab = capab;
1536         offset = ieee80211_assoc_link_elems(sdata, skb, &link_capab,
1537                                             ext_capa,
1538                                             assoc_data->ie,
1539                                             assoc_data->ie_len,
1540                                             assoc_data->assoc_link_id, link,
1541                                             present_elems);
1542         put_unaligned_le16(link_capab, capab_pos);
1543
1544         /* if present, add any custom non-vendor IEs */
1545         if (assoc_data->ie_len) {
1546                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
1547                                                     assoc_data->ie_len,
1548                                                     offset);
1549                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1550                 offset = noffset;
1551         }
1552
1553         if (assoc_data->wmm) {
1554                 if (assoc_data->uapsd) {
1555                         qos_info = ifmgd->uapsd_queues;
1556                         qos_info |= (ifmgd->uapsd_max_sp_len <<
1557                                      IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
1558                 } else {
1559                         qos_info = 0;
1560                 }
1561
1562                 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
1563         }
1564
1565         /* add any remaining custom (i.e. vendor specific here) IEs */
1566         if (assoc_data->ie_len) {
1567                 noffset = assoc_data->ie_len;
1568                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1569         }
1570
1571         if (assoc_data->fils_kek_len) {
1572                 ret = fils_encrypt_assoc_req(skb, assoc_data);
1573                 if (ret < 0) {
1574                         dev_kfree_skb(skb);
1575                         return ret;
1576                 }
1577         }
1578
1579         pos = skb_tail_pointer(skb);
1580         kfree(ifmgd->assoc_req_ies);
1581         ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
1582         if (!ifmgd->assoc_req_ies) {
1583                 dev_kfree_skb(skb);
1584                 return -ENOMEM;
1585         }
1586
1587         ifmgd->assoc_req_ies_len = pos - ie_start;
1588
1589         drv_mgd_prepare_tx(local, sdata, &info);
1590
1591         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1592         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1593                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
1594                                                 IEEE80211_TX_INTFL_MLME_CONN_TX;
1595         ieee80211_tx_skb(sdata, skb);
1596
1597         return 0;
1598 }
1599
1600 void ieee80211_send_pspoll(struct ieee80211_local *local,
1601                            struct ieee80211_sub_if_data *sdata)
1602 {
1603         struct ieee80211_pspoll *pspoll;
1604         struct sk_buff *skb;
1605
1606         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
1607         if (!skb)
1608                 return;
1609
1610         pspoll = (struct ieee80211_pspoll *) skb->data;
1611         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1612
1613         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1614         ieee80211_tx_skb(sdata, skb);
1615 }
1616
1617 void ieee80211_send_nullfunc(struct ieee80211_local *local,
1618                              struct ieee80211_sub_if_data *sdata,
1619                              bool powersave)
1620 {
1621         struct sk_buff *skb;
1622         struct ieee80211_hdr_3addr *nullfunc;
1623         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1624
1625         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, -1,
1626                                      !ieee80211_hw_check(&local->hw,
1627                                                          DOESNT_SUPPORT_QOS_NDP));
1628         if (!skb)
1629                 return;
1630
1631         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1632         if (powersave)
1633                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1634
1635         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1636                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1637
1638         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1639                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1640
1641         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1642                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1643
1644         ieee80211_tx_skb(sdata, skb);
1645 }
1646
1647 void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
1648                                    struct ieee80211_sub_if_data *sdata)
1649 {
1650         struct sk_buff *skb;
1651         struct ieee80211_hdr *nullfunc;
1652         __le16 fc;
1653
1654         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1655                 return;
1656
1657         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1658         if (!skb)
1659                 return;
1660
1661         skb_reserve(skb, local->hw.extra_tx_headroom);
1662
1663         nullfunc = skb_put_zero(skb, 30);
1664         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
1665                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
1666         nullfunc->frame_control = fc;
1667         memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1668         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1669         memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1670         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
1671
1672         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1673         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1674         ieee80211_tx_skb(sdata, skb);
1675 }
1676
1677 /* spectrum management related things */
1678 static void ieee80211_chswitch_work(struct wiphy *wiphy,
1679                                     struct wiphy_work *work)
1680 {
1681         struct ieee80211_link_data *link =
1682                 container_of(work, struct ieee80211_link_data,
1683                              u.mgd.chswitch_work.work);
1684         struct ieee80211_sub_if_data *sdata = link->sdata;
1685         struct ieee80211_local *local = sdata->local;
1686         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1687         int ret;
1688
1689         if (!ieee80211_sdata_running(sdata))
1690                 return;
1691
1692         sdata_lock(sdata);
1693         mutex_lock(&local->mtx);
1694         mutex_lock(&local->chanctx_mtx);
1695
1696         if (!ifmgd->associated)
1697                 goto out;
1698
1699         if (!link->conf->csa_active)
1700                 goto out;
1701
1702         /*
1703          * using reservation isn't immediate as it may be deferred until later
1704          * with multi-vif. once reservation is complete it will re-schedule the
1705          * work with no reserved_chanctx so verify chandef to check if it
1706          * completed successfully
1707          */
1708
1709         if (link->reserved_chanctx) {
1710                 /*
1711                  * with multi-vif csa driver may call ieee80211_csa_finish()
1712                  * many times while waiting for other interfaces to use their
1713                  * reservations
1714                  */
1715                 if (link->reserved_ready)
1716                         goto out;
1717
1718                 ret = ieee80211_link_use_reserved_context(link);
1719                 if (ret) {
1720                         sdata_info(sdata,
1721                                    "failed to use reserved channel context, disconnecting (err=%d)\n",
1722                                    ret);
1723                         wiphy_work_queue(sdata->local->hw.wiphy,
1724                                          &ifmgd->csa_connection_drop_work);
1725                         goto out;
1726                 }
1727
1728                 goto out;
1729         }
1730
1731         if (!cfg80211_chandef_identical(&link->conf->chandef,
1732                                         &link->csa_chandef)) {
1733                 sdata_info(sdata,
1734                            "failed to finalize channel switch, disconnecting\n");
1735                 wiphy_work_queue(sdata->local->hw.wiphy,
1736                                  &ifmgd->csa_connection_drop_work);
1737                 goto out;
1738         }
1739
1740         link->u.mgd.csa_waiting_bcn = true;
1741
1742         ieee80211_sta_reset_beacon_monitor(sdata);
1743         ieee80211_sta_reset_conn_monitor(sdata);
1744
1745 out:
1746         mutex_unlock(&local->chanctx_mtx);
1747         mutex_unlock(&local->mtx);
1748         sdata_unlock(sdata);
1749 }
1750
1751 static void ieee80211_chswitch_post_beacon(struct ieee80211_link_data *link)
1752 {
1753         struct ieee80211_sub_if_data *sdata = link->sdata;
1754         struct ieee80211_local *local = sdata->local;
1755         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1756         int ret;
1757
1758         sdata_assert_lock(sdata);
1759
1760         WARN_ON(!link->conf->csa_active);
1761
1762         if (link->csa_block_tx) {
1763                 ieee80211_wake_vif_queues(local, sdata,
1764                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1765                 link->csa_block_tx = false;
1766         }
1767
1768         link->conf->csa_active = false;
1769         link->u.mgd.csa_waiting_bcn = false;
1770         /*
1771          * If the CSA IE is still present on the beacon after the switch,
1772          * we need to consider it as a new CSA (possibly to self).
1773          */
1774         link->u.mgd.beacon_crc_valid = false;
1775
1776         ret = drv_post_channel_switch(sdata);
1777         if (ret) {
1778                 sdata_info(sdata,
1779                            "driver post channel switch failed, disconnecting\n");
1780                 wiphy_work_queue(sdata->local->hw.wiphy,
1781                                  &ifmgd->csa_connection_drop_work);
1782                 return;
1783         }
1784
1785         cfg80211_ch_switch_notify(sdata->dev, &link->reserved_chandef, 0, 0);
1786 }
1787
1788 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1789 {
1790         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1791         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1792
1793         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
1794                 success = false;
1795
1796         trace_api_chswitch_done(sdata, success);
1797         if (!success) {
1798                 sdata_info(sdata,
1799                            "driver channel switch failed, disconnecting\n");
1800                 wiphy_work_queue(sdata->local->hw.wiphy,
1801                                  &ifmgd->csa_connection_drop_work);
1802         } else {
1803                 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
1804                                          &sdata->deflink.u.mgd.chswitch_work,
1805                                          0);
1806         }
1807 }
1808 EXPORT_SYMBOL(ieee80211_chswitch_done);
1809
1810 static void
1811 ieee80211_sta_abort_chanswitch(struct ieee80211_link_data *link)
1812 {
1813         struct ieee80211_sub_if_data *sdata = link->sdata;
1814         struct ieee80211_local *local = sdata->local;
1815
1816         if (!local->ops->abort_channel_switch)
1817                 return;
1818
1819         mutex_lock(&local->mtx);
1820
1821         mutex_lock(&local->chanctx_mtx);
1822         ieee80211_link_unreserve_chanctx(link);
1823         mutex_unlock(&local->chanctx_mtx);
1824
1825         if (link->csa_block_tx)
1826                 ieee80211_wake_vif_queues(local, sdata,
1827                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1828
1829         link->csa_block_tx = false;
1830         link->conf->csa_active = false;
1831
1832         mutex_unlock(&local->mtx);
1833
1834         drv_abort_channel_switch(sdata);
1835 }
1836
1837 static void
1838 ieee80211_sta_process_chanswitch(struct ieee80211_link_data *link,
1839                                  u64 timestamp, u32 device_timestamp,
1840                                  struct ieee802_11_elems *elems,
1841                                  bool beacon)
1842 {
1843         struct ieee80211_sub_if_data *sdata = link->sdata;
1844         struct ieee80211_local *local = sdata->local;
1845         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1846         struct cfg80211_bss *cbss = link->u.mgd.bss;
1847         struct ieee80211_chanctx_conf *conf;
1848         struct ieee80211_chanctx *chanctx;
1849         enum nl80211_band current_band;
1850         struct ieee80211_csa_ie csa_ie;
1851         struct ieee80211_channel_switch ch_switch;
1852         struct ieee80211_bss *bss;
1853         unsigned long timeout;
1854         int res;
1855
1856         sdata_assert_lock(sdata);
1857
1858         if (!cbss)
1859                 return;
1860
1861         current_band = cbss->channel->band;
1862         bss = (void *)cbss->priv;
1863         res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1864                                            bss->vht_cap_info,
1865                                            link->u.mgd.conn_flags,
1866                                            link->u.mgd.bssid, &csa_ie);
1867
1868         if (!res) {
1869                 ch_switch.timestamp = timestamp;
1870                 ch_switch.device_timestamp = device_timestamp;
1871                 ch_switch.block_tx = csa_ie.mode;
1872                 ch_switch.chandef = csa_ie.chandef;
1873                 ch_switch.count = csa_ie.count;
1874                 ch_switch.delay = csa_ie.max_switch_time;
1875         }
1876
1877         if (res < 0)
1878                 goto lock_and_drop_connection;
1879
1880         if (beacon && link->conf->csa_active &&
1881             !link->u.mgd.csa_waiting_bcn) {
1882                 if (res)
1883                         ieee80211_sta_abort_chanswitch(link);
1884                 else
1885                         drv_channel_switch_rx_beacon(sdata, &ch_switch);
1886                 return;
1887         } else if (link->conf->csa_active || res) {
1888                 /* disregard subsequent announcements if already processing */
1889                 return;
1890         }
1891
1892         if (link->conf->chandef.chan->band !=
1893             csa_ie.chandef.chan->band) {
1894                 sdata_info(sdata,
1895                            "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1896                            link->u.mgd.bssid,
1897                            csa_ie.chandef.chan->center_freq,
1898                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1899                            csa_ie.chandef.center_freq2);
1900                 goto lock_and_drop_connection;
1901         }
1902
1903         if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1904                                      IEEE80211_CHAN_DISABLED)) {
1905                 sdata_info(sdata,
1906                            "AP %pM switches to unsupported channel "
1907                            "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
1908                            "disconnecting\n",
1909                            link->u.mgd.bssid,
1910                            csa_ie.chandef.chan->center_freq,
1911                            csa_ie.chandef.chan->freq_offset,
1912                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1913                            csa_ie.chandef.freq1_offset,
1914                            csa_ie.chandef.center_freq2);
1915                 goto lock_and_drop_connection;
1916         }
1917
1918         if (cfg80211_chandef_identical(&csa_ie.chandef,
1919                                        &link->conf->chandef) &&
1920             (!csa_ie.mode || !beacon)) {
1921                 if (link->u.mgd.csa_ignored_same_chan)
1922                         return;
1923                 sdata_info(sdata,
1924                            "AP %pM tries to chanswitch to same channel, ignore\n",
1925                            link->u.mgd.bssid);
1926                 link->u.mgd.csa_ignored_same_chan = true;
1927                 return;
1928         }
1929
1930         /*
1931          * Drop all TDLS peers - either we disconnect or move to a different
1932          * channel from this point on. There's no telling what our peer will do.
1933          * The TDLS WIDER_BW scenario is also problematic, as peers might now
1934          * have an incompatible wider chandef.
1935          */
1936         ieee80211_teardown_tdls_peers(sdata);
1937
1938         mutex_lock(&local->mtx);
1939         mutex_lock(&local->chanctx_mtx);
1940         conf = rcu_dereference_protected(link->conf->chanctx_conf,
1941                                          lockdep_is_held(&local->chanctx_mtx));
1942         if (!conf) {
1943                 sdata_info(sdata,
1944                            "no channel context assigned to vif?, disconnecting\n");
1945                 goto drop_connection;
1946         }
1947
1948         chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1949
1950         if (local->use_chanctx &&
1951             !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1952                 sdata_info(sdata,
1953                            "driver doesn't support chan-switch with channel contexts\n");
1954                 goto drop_connection;
1955         }
1956
1957         if (drv_pre_channel_switch(sdata, &ch_switch)) {
1958                 sdata_info(sdata,
1959                            "preparing for channel switch failed, disconnecting\n");
1960                 goto drop_connection;
1961         }
1962
1963         res = ieee80211_link_reserve_chanctx(link, &csa_ie.chandef,
1964                                              chanctx->mode, false);
1965         if (res) {
1966                 sdata_info(sdata,
1967                            "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1968                            res);
1969                 goto drop_connection;
1970         }
1971         mutex_unlock(&local->chanctx_mtx);
1972
1973         link->conf->csa_active = true;
1974         link->csa_chandef = csa_ie.chandef;
1975         link->csa_block_tx = csa_ie.mode;
1976         link->u.mgd.csa_ignored_same_chan = false;
1977         link->u.mgd.beacon_crc_valid = false;
1978
1979         if (link->csa_block_tx)
1980                 ieee80211_stop_vif_queues(local, sdata,
1981                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1982         mutex_unlock(&local->mtx);
1983
1984         cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
1985                                           link->link_id, csa_ie.count,
1986                                           csa_ie.mode, 0);
1987
1988         if (local->ops->channel_switch) {
1989                 /* use driver's channel switch callback */
1990                 drv_channel_switch(local, sdata, &ch_switch);
1991                 return;
1992         }
1993
1994         /* channel switch handled in software */
1995         timeout = TU_TO_JIFFIES((max_t(int, csa_ie.count, 1) - 1) *
1996                                 cbss->beacon_interval);
1997         wiphy_delayed_work_queue(local->hw.wiphy,
1998                                  &link->u.mgd.chswitch_work,
1999                                  timeout);
2000         return;
2001  lock_and_drop_connection:
2002         mutex_lock(&local->mtx);
2003         mutex_lock(&local->chanctx_mtx);
2004  drop_connection:
2005         /*
2006          * This is just so that the disconnect flow will know that
2007          * we were trying to switch channel and failed. In case the
2008          * mode is 1 (we are not allowed to Tx), we will know not to
2009          * send a deauthentication frame. Those two fields will be
2010          * reset when the disconnection worker runs.
2011          */
2012         link->conf->csa_active = true;
2013         link->csa_block_tx = csa_ie.mode;
2014
2015         wiphy_work_queue(sdata->local->hw.wiphy,
2016                          &ifmgd->csa_connection_drop_work);
2017         mutex_unlock(&local->chanctx_mtx);
2018         mutex_unlock(&local->mtx);
2019 }
2020
2021 static bool
2022 ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
2023                                  struct ieee80211_channel *channel,
2024                                  const u8 *country_ie, u8 country_ie_len,
2025                                  const u8 *pwr_constr_elem,
2026                                  int *chan_pwr, int *pwr_reduction)
2027 {
2028         struct ieee80211_country_ie_triplet *triplet;
2029         int chan = ieee80211_frequency_to_channel(channel->center_freq);
2030         int i, chan_increment;
2031         bool have_chan_pwr = false;
2032
2033         /* Invalid IE */
2034         if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
2035                 return false;
2036
2037         triplet = (void *)(country_ie + 3);
2038         country_ie_len -= 3;
2039
2040         switch (channel->band) {
2041         default:
2042                 WARN_ON_ONCE(1);
2043                 fallthrough;
2044         case NL80211_BAND_2GHZ:
2045         case NL80211_BAND_60GHZ:
2046         case NL80211_BAND_LC:
2047                 chan_increment = 1;
2048                 break;
2049         case NL80211_BAND_5GHZ:
2050                 chan_increment = 4;
2051                 break;
2052         case NL80211_BAND_6GHZ:
2053                 /*
2054                  * In the 6 GHz band, the "maximum transmit power level"
2055                  * field in the triplets is reserved, and thus will be
2056                  * zero and we shouldn't use it to control TX power.
2057                  * The actual TX power will be given in the transmit
2058                  * power envelope element instead.
2059                  */
2060                 return false;
2061         }
2062
2063         /* find channel */
2064         while (country_ie_len >= 3) {
2065                 u8 first_channel = triplet->chans.first_channel;
2066
2067                 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
2068                         goto next;
2069
2070                 for (i = 0; i < triplet->chans.num_channels; i++) {
2071                         if (first_channel + i * chan_increment == chan) {
2072                                 have_chan_pwr = true;
2073                                 *chan_pwr = triplet->chans.max_power;
2074                                 break;
2075                         }
2076                 }
2077                 if (have_chan_pwr)
2078                         break;
2079
2080  next:
2081                 triplet++;
2082                 country_ie_len -= 3;
2083         }
2084
2085         if (have_chan_pwr && pwr_constr_elem)
2086                 *pwr_reduction = *pwr_constr_elem;
2087         else
2088                 *pwr_reduction = 0;
2089
2090         return have_chan_pwr;
2091 }
2092
2093 static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
2094                                       struct ieee80211_channel *channel,
2095                                       const u8 *cisco_dtpc_ie,
2096                                       int *pwr_level)
2097 {
2098         /* From practical testing, the first data byte of the DTPC element
2099          * seems to contain the requested dBm level, and the CLI on Cisco
2100          * APs clearly state the range is -127 to 127 dBm, which indicates
2101          * a signed byte, although it seemingly never actually goes negative.
2102          * The other byte seems to always be zero.
2103          */
2104         *pwr_level = (__s8)cisco_dtpc_ie[4];
2105 }
2106
2107 static u64 ieee80211_handle_pwr_constr(struct ieee80211_link_data *link,
2108                                        struct ieee80211_channel *channel,
2109                                        struct ieee80211_mgmt *mgmt,
2110                                        const u8 *country_ie, u8 country_ie_len,
2111                                        const u8 *pwr_constr_ie,
2112                                        const u8 *cisco_dtpc_ie)
2113 {
2114         struct ieee80211_sub_if_data *sdata = link->sdata;
2115         bool has_80211h_pwr = false, has_cisco_pwr = false;
2116         int chan_pwr = 0, pwr_reduction_80211h = 0;
2117         int pwr_level_cisco, pwr_level_80211h;
2118         int new_ap_level;
2119         __le16 capab = mgmt->u.probe_resp.capab_info;
2120
2121         if (ieee80211_is_s1g_beacon(mgmt->frame_control))
2122                 return 0;       /* TODO */
2123
2124         if (country_ie &&
2125             (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
2126              capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
2127                 has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
2128                         sdata, channel, country_ie, country_ie_len,
2129                         pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
2130                 pwr_level_80211h =
2131                         max_t(int, 0, chan_pwr - pwr_reduction_80211h);
2132         }
2133
2134         if (cisco_dtpc_ie) {
2135                 ieee80211_find_cisco_dtpc(
2136                         sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
2137                 has_cisco_pwr = true;
2138         }
2139
2140         if (!has_80211h_pwr && !has_cisco_pwr)
2141                 return 0;
2142
2143         /* If we have both 802.11h and Cisco DTPC, apply both limits
2144          * by picking the smallest of the two power levels advertised.
2145          */
2146         if (has_80211h_pwr &&
2147             (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
2148                 new_ap_level = pwr_level_80211h;
2149
2150                 if (link->ap_power_level == new_ap_level)
2151                         return 0;
2152
2153                 sdata_dbg(sdata,
2154                           "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
2155                           pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
2156                           link->u.mgd.bssid);
2157         } else {  /* has_cisco_pwr is always true here. */
2158                 new_ap_level = pwr_level_cisco;
2159
2160                 if (link->ap_power_level == new_ap_level)
2161                         return 0;
2162
2163                 sdata_dbg(sdata,
2164                           "Limiting TX power to %d dBm as advertised by %pM\n",
2165                           pwr_level_cisco, link->u.mgd.bssid);
2166         }
2167
2168         link->ap_power_level = new_ap_level;
2169         if (__ieee80211_recalc_txpower(sdata))
2170                 return BSS_CHANGED_TXPOWER;
2171         return 0;
2172 }
2173
2174 /* powersave */
2175 static void ieee80211_enable_ps(struct ieee80211_local *local,
2176                                 struct ieee80211_sub_if_data *sdata)
2177 {
2178         struct ieee80211_conf *conf = &local->hw.conf;
2179
2180         /*
2181          * If we are scanning right now then the parameters will
2182          * take effect when scan finishes.
2183          */
2184         if (local->scanning)
2185                 return;
2186
2187         if (conf->dynamic_ps_timeout > 0 &&
2188             !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2189                 mod_timer(&local->dynamic_ps_timer, jiffies +
2190                           msecs_to_jiffies(conf->dynamic_ps_timeout));
2191         } else {
2192                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
2193                         ieee80211_send_nullfunc(local, sdata, true);
2194
2195                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2196                     ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2197                         return;
2198
2199                 conf->flags |= IEEE80211_CONF_PS;
2200                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2201         }
2202 }
2203
2204 static void ieee80211_change_ps(struct ieee80211_local *local)
2205 {
2206         struct ieee80211_conf *conf = &local->hw.conf;
2207
2208         if (local->ps_sdata) {
2209                 ieee80211_enable_ps(local, local->ps_sdata);
2210         } else if (conf->flags & IEEE80211_CONF_PS) {
2211                 conf->flags &= ~IEEE80211_CONF_PS;
2212                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2213                 del_timer_sync(&local->dynamic_ps_timer);
2214                 cancel_work_sync(&local->dynamic_ps_enable_work);
2215         }
2216 }
2217
2218 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
2219 {
2220         struct ieee80211_local *local = sdata->local;
2221         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
2222         struct sta_info *sta = NULL;
2223         bool authorized = false;
2224
2225         if (!mgd->powersave)
2226                 return false;
2227
2228         if (mgd->broken_ap)
2229                 return false;
2230
2231         if (!mgd->associated)
2232                 return false;
2233
2234         if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
2235                 return false;
2236
2237         if (!(local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO) &&
2238             !sdata->deflink.u.mgd.have_beacon)
2239                 return false;
2240
2241         rcu_read_lock();
2242         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
2243         if (sta)
2244                 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2245         rcu_read_unlock();
2246
2247         return authorized;
2248 }
2249
2250 /* need to hold RTNL or interface lock */
2251 void ieee80211_recalc_ps(struct ieee80211_local *local)
2252 {
2253         struct ieee80211_sub_if_data *sdata, *found = NULL;
2254         int count = 0;
2255         int timeout;
2256
2257         if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS) ||
2258             ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2259                 local->ps_sdata = NULL;
2260                 return;
2261         }
2262
2263         list_for_each_entry(sdata, &local->interfaces, list) {
2264                 if (!ieee80211_sdata_running(sdata))
2265                         continue;
2266                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
2267                         /* If an AP vif is found, then disable PS
2268                          * by setting the count to zero thereby setting
2269                          * ps_sdata to NULL.
2270                          */
2271                         count = 0;
2272                         break;
2273                 }
2274                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2275                         continue;
2276                 found = sdata;
2277                 count++;
2278         }
2279
2280         if (count == 1 && ieee80211_powersave_allowed(found)) {
2281                 u8 dtimper = found->deflink.u.mgd.dtim_period;
2282
2283                 timeout = local->dynamic_ps_forced_timeout;
2284                 if (timeout < 0)
2285                         timeout = 100;
2286                 local->hw.conf.dynamic_ps_timeout = timeout;
2287
2288                 /* If the TIM IE is invalid, pretend the value is 1 */
2289                 if (!dtimper)
2290                         dtimper = 1;
2291
2292                 local->hw.conf.ps_dtim_period = dtimper;
2293                 local->ps_sdata = found;
2294         } else {
2295                 local->ps_sdata = NULL;
2296         }
2297
2298         ieee80211_change_ps(local);
2299 }
2300
2301 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
2302 {
2303         bool ps_allowed = ieee80211_powersave_allowed(sdata);
2304
2305         if (sdata->vif.cfg.ps != ps_allowed) {
2306                 sdata->vif.cfg.ps = ps_allowed;
2307                 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_PS);
2308         }
2309 }
2310
2311 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
2312 {
2313         struct ieee80211_local *local =
2314                 container_of(work, struct ieee80211_local,
2315                              dynamic_ps_disable_work);
2316
2317         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2318                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2319                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2320         }
2321
2322         ieee80211_wake_queues_by_reason(&local->hw,
2323                                         IEEE80211_MAX_QUEUE_MAP,
2324                                         IEEE80211_QUEUE_STOP_REASON_PS,
2325                                         false);
2326 }
2327
2328 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
2329 {
2330         struct ieee80211_local *local =
2331                 container_of(work, struct ieee80211_local,
2332                              dynamic_ps_enable_work);
2333         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
2334         struct ieee80211_if_managed *ifmgd;
2335         unsigned long flags;
2336         int q;
2337
2338         /* can only happen when PS was just disabled anyway */
2339         if (!sdata)
2340                 return;
2341
2342         ifmgd = &sdata->u.mgd;
2343
2344         if (local->hw.conf.flags & IEEE80211_CONF_PS)
2345                 return;
2346
2347         if (local->hw.conf.dynamic_ps_timeout > 0) {
2348                 /* don't enter PS if TX frames are pending */
2349                 if (drv_tx_frames_pending(local)) {
2350                         mod_timer(&local->dynamic_ps_timer, jiffies +
2351                                   msecs_to_jiffies(
2352                                   local->hw.conf.dynamic_ps_timeout));
2353                         return;
2354                 }
2355
2356                 /*
2357                  * transmission can be stopped by others which leads to
2358                  * dynamic_ps_timer expiry. Postpone the ps timer if it
2359                  * is not the actual idle state.
2360                  */
2361                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2362                 for (q = 0; q < local->hw.queues; q++) {
2363                         if (local->queue_stop_reasons[q]) {
2364                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
2365                                                        flags);
2366                                 mod_timer(&local->dynamic_ps_timer, jiffies +
2367                                           msecs_to_jiffies(
2368                                           local->hw.conf.dynamic_ps_timeout));
2369                                 return;
2370                         }
2371                 }
2372                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2373         }
2374
2375         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2376             !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2377                 if (drv_tx_frames_pending(local)) {
2378                         mod_timer(&local->dynamic_ps_timer, jiffies +
2379                                   msecs_to_jiffies(
2380                                   local->hw.conf.dynamic_ps_timeout));
2381                 } else {
2382                         ieee80211_send_nullfunc(local, sdata, true);
2383                         /* Flush to get the tx status of nullfunc frame */
2384                         ieee80211_flush_queues(local, sdata, false);
2385                 }
2386         }
2387
2388         if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
2389               ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
2390             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2391                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
2392                 local->hw.conf.flags |= IEEE80211_CONF_PS;
2393                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2394         }
2395 }
2396
2397 void ieee80211_dynamic_ps_timer(struct timer_list *t)
2398 {
2399         struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
2400
2401         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
2402 }
2403
2404 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
2405 {
2406         struct delayed_work *delayed_work = to_delayed_work(work);
2407         struct ieee80211_link_data *link =
2408                 container_of(delayed_work, struct ieee80211_link_data,
2409                              dfs_cac_timer_work);
2410         struct cfg80211_chan_def chandef = link->conf->chandef;
2411         struct ieee80211_sub_if_data *sdata = link->sdata;
2412
2413         mutex_lock(&sdata->local->mtx);
2414         if (sdata->wdev.cac_started) {
2415                 ieee80211_link_release_channel(link);
2416                 cfg80211_cac_event(sdata->dev, &chandef,
2417                                    NL80211_RADAR_CAC_FINISHED,
2418                                    GFP_KERNEL);
2419         }
2420         mutex_unlock(&sdata->local->mtx);
2421 }
2422
2423 static bool
2424 __ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2425 {
2426         struct ieee80211_local *local = sdata->local;
2427         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2428         bool ret = false;
2429         int ac;
2430
2431         if (local->hw.queues < IEEE80211_NUM_ACS)
2432                 return false;
2433
2434         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2435                 struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
2436                 int non_acm_ac;
2437                 unsigned long now = jiffies;
2438
2439                 if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
2440                     tx_tspec->admitted_time &&
2441                     time_after(now, tx_tspec->time_slice_start + HZ)) {
2442                         tx_tspec->consumed_tx_time = 0;
2443                         tx_tspec->time_slice_start = now;
2444
2445                         if (tx_tspec->downgraded)
2446                                 tx_tspec->action =
2447                                         TX_TSPEC_ACTION_STOP_DOWNGRADE;
2448                 }
2449
2450                 switch (tx_tspec->action) {
2451                 case TX_TSPEC_ACTION_STOP_DOWNGRADE:
2452                         /* take the original parameters */
2453                         if (drv_conf_tx(local, &sdata->deflink, ac,
2454                                         &sdata->deflink.tx_conf[ac]))
2455                                 link_err(&sdata->deflink,
2456                                          "failed to set TX queue parameters for queue %d\n",
2457                                          ac);
2458                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
2459                         tx_tspec->downgraded = false;
2460                         ret = true;
2461                         break;
2462                 case TX_TSPEC_ACTION_DOWNGRADE:
2463                         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
2464                                 tx_tspec->action = TX_TSPEC_ACTION_NONE;
2465                                 ret = true;
2466                                 break;
2467                         }
2468                         /* downgrade next lower non-ACM AC */
2469                         for (non_acm_ac = ac + 1;
2470                              non_acm_ac < IEEE80211_NUM_ACS;
2471                              non_acm_ac++)
2472                                 if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
2473                                         break;
2474                         /* Usually the loop will result in using BK even if it
2475                          * requires admission control, but such a configuration
2476                          * makes no sense and we have to transmit somehow - the
2477                          * AC selection does the same thing.
2478                          * If we started out trying to downgrade from BK, then
2479                          * the extra condition here might be needed.
2480                          */
2481                         if (non_acm_ac >= IEEE80211_NUM_ACS)
2482                                 non_acm_ac = IEEE80211_AC_BK;
2483                         if (drv_conf_tx(local, &sdata->deflink, ac,
2484                                         &sdata->deflink.tx_conf[non_acm_ac]))
2485                                 link_err(&sdata->deflink,
2486                                          "failed to set TX queue parameters for queue %d\n",
2487                                          ac);
2488                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
2489                         ret = true;
2490                         schedule_delayed_work(&ifmgd->tx_tspec_wk,
2491                                 tx_tspec->time_slice_start + HZ - now + 1);
2492                         break;
2493                 case TX_TSPEC_ACTION_NONE:
2494                         /* nothing now */
2495                         break;
2496                 }
2497         }
2498
2499         return ret;
2500 }
2501
2502 void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2503 {
2504         if (__ieee80211_sta_handle_tspec_ac_params(sdata))
2505                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
2506                                                   BSS_CHANGED_QOS);
2507 }
2508
2509 static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
2510 {
2511         struct ieee80211_sub_if_data *sdata;
2512
2513         sdata = container_of(work, struct ieee80211_sub_if_data,
2514                              u.mgd.tx_tspec_wk.work);
2515         ieee80211_sta_handle_tspec_ac_params(sdata);
2516 }
2517
2518 void ieee80211_mgd_set_link_qos_params(struct ieee80211_link_data *link)
2519 {
2520         struct ieee80211_sub_if_data *sdata = link->sdata;
2521         struct ieee80211_local *local = sdata->local;
2522         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2523         struct ieee80211_tx_queue_params *params = link->tx_conf;
2524         u8 ac;
2525
2526         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2527                 mlme_dbg(sdata,
2528                          "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
2529                          ac, params[ac].acm,
2530                          params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
2531                          params[ac].txop, params[ac].uapsd,
2532                          ifmgd->tx_tspec[ac].downgraded);
2533                 if (!ifmgd->tx_tspec[ac].downgraded &&
2534                     drv_conf_tx(local, link, ac, &params[ac]))
2535                         link_err(link,
2536                                  "failed to set TX queue parameters for AC %d\n",
2537                                  ac);
2538         }
2539 }
2540
2541 /* MLME */
2542 static bool
2543 ieee80211_sta_wmm_params(struct ieee80211_local *local,
2544                          struct ieee80211_link_data *link,
2545                          const u8 *wmm_param, size_t wmm_param_len,
2546                          const struct ieee80211_mu_edca_param_set *mu_edca)
2547 {
2548         struct ieee80211_sub_if_data *sdata = link->sdata;
2549         struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
2550         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2551         size_t left;
2552         int count, mu_edca_count, ac;
2553         const u8 *pos;
2554         u8 uapsd_queues = 0;
2555
2556         if (!local->ops->conf_tx)
2557                 return false;
2558
2559         if (local->hw.queues < IEEE80211_NUM_ACS)
2560                 return false;
2561
2562         if (!wmm_param)
2563                 return false;
2564
2565         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
2566                 return false;
2567
2568         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
2569                 uapsd_queues = ifmgd->uapsd_queues;
2570
2571         count = wmm_param[6] & 0x0f;
2572         /* -1 is the initial value of ifmgd->mu_edca_last_param_set.
2573          * if mu_edca was preset before and now it disappeared tell
2574          * the driver about it.
2575          */
2576         mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
2577         if (count == link->u.mgd.wmm_last_param_set &&
2578             mu_edca_count == link->u.mgd.mu_edca_last_param_set)
2579                 return false;
2580         link->u.mgd.wmm_last_param_set = count;
2581         link->u.mgd.mu_edca_last_param_set = mu_edca_count;
2582
2583         pos = wmm_param + 8;
2584         left = wmm_param_len - 8;
2585
2586         memset(&params, 0, sizeof(params));
2587
2588         sdata->wmm_acm = 0;
2589         for (; left >= 4; left -= 4, pos += 4) {
2590                 int aci = (pos[0] >> 5) & 0x03;
2591                 int acm = (pos[0] >> 4) & 0x01;
2592                 bool uapsd = false;
2593
2594                 switch (aci) {
2595                 case 1: /* AC_BK */
2596                         ac = IEEE80211_AC_BK;
2597                         if (acm)
2598                                 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
2599                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
2600                                 uapsd = true;
2601                         params[ac].mu_edca = !!mu_edca;
2602                         if (mu_edca)
2603                                 params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2604                         break;
2605                 case 2: /* AC_VI */
2606                         ac = IEEE80211_AC_VI;
2607                         if (acm)
2608                                 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
2609                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
2610                                 uapsd = true;
2611                         params[ac].mu_edca = !!mu_edca;
2612                         if (mu_edca)
2613                                 params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2614                         break;
2615                 case 3: /* AC_VO */
2616                         ac = IEEE80211_AC_VO;
2617                         if (acm)
2618                                 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
2619                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
2620                                 uapsd = true;
2621                         params[ac].mu_edca = !!mu_edca;
2622                         if (mu_edca)
2623                                 params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2624                         break;
2625                 case 0: /* AC_BE */
2626                 default:
2627                         ac = IEEE80211_AC_BE;
2628                         if (acm)
2629                                 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
2630                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
2631                                 uapsd = true;
2632                         params[ac].mu_edca = !!mu_edca;
2633                         if (mu_edca)
2634                                 params[ac].mu_edca_param_rec = mu_edca->ac_be;
2635                         break;
2636                 }
2637
2638                 params[ac].aifs = pos[0] & 0x0f;
2639
2640                 if (params[ac].aifs < 2) {
2641                         link_info(link,
2642                                   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2643                                   params[ac].aifs, aci);
2644                         params[ac].aifs = 2;
2645                 }
2646                 params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
2647                 params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
2648                 params[ac].txop = get_unaligned_le16(pos + 2);
2649                 params[ac].acm = acm;
2650                 params[ac].uapsd = uapsd;
2651
2652                 if (params[ac].cw_min == 0 ||
2653                     params[ac].cw_min > params[ac].cw_max) {
2654                         link_info(link,
2655                                   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
2656                                   params[ac].cw_min, params[ac].cw_max, aci);
2657                         return false;
2658                 }
2659                 ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2660         }
2661
2662         /* WMM specification requires all 4 ACIs. */
2663         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2664                 if (params[ac].cw_min == 0) {
2665                         link_info(link,
2666                                   "AP has invalid WMM params (missing AC %d), using defaults\n",
2667                                   ac);
2668                         return false;
2669                 }
2670         }
2671
2672         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2673                 link->tx_conf[ac] = params[ac];
2674
2675         ieee80211_mgd_set_link_qos_params(link);
2676
2677         /* enable WMM or activate new settings */
2678         link->conf->qos = true;
2679         return true;
2680 }
2681
2682 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2683 {
2684         lockdep_assert_held(&sdata->local->mtx);
2685
2686         sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2687         ieee80211_run_deferred_scan(sdata->local);
2688 }
2689
2690 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2691 {
2692         mutex_lock(&sdata->local->mtx);
2693         __ieee80211_stop_poll(sdata);
2694         mutex_unlock(&sdata->local->mtx);
2695 }
2696
2697 static u64 ieee80211_handle_bss_capability(struct ieee80211_link_data *link,
2698                                            u16 capab, bool erp_valid, u8 erp)
2699 {
2700         struct ieee80211_bss_conf *bss_conf = link->conf;
2701         struct ieee80211_supported_band *sband;
2702         u64 changed = 0;
2703         bool use_protection;
2704         bool use_short_preamble;
2705         bool use_short_slot;
2706
2707         sband = ieee80211_get_link_sband(link);
2708         if (!sband)
2709                 return changed;
2710
2711         if (erp_valid) {
2712                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
2713                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
2714         } else {
2715                 use_protection = false;
2716                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
2717         }
2718
2719         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2720         if (sband->band == NL80211_BAND_5GHZ ||
2721             sband->band == NL80211_BAND_6GHZ)
2722                 use_short_slot = true;
2723
2724         if (use_protection != bss_conf->use_cts_prot) {
2725                 bss_conf->use_cts_prot = use_protection;
2726                 changed |= BSS_CHANGED_ERP_CTS_PROT;
2727         }
2728
2729         if (use_short_preamble != bss_conf->use_short_preamble) {
2730                 bss_conf->use_short_preamble = use_short_preamble;
2731                 changed |= BSS_CHANGED_ERP_PREAMBLE;
2732         }
2733
2734         if (use_short_slot != bss_conf->use_short_slot) {
2735                 bss_conf->use_short_slot = use_short_slot;
2736                 changed |= BSS_CHANGED_ERP_SLOT;
2737         }
2738
2739         return changed;
2740 }
2741
2742 static u64 ieee80211_link_set_associated(struct ieee80211_link_data *link,
2743                                          struct cfg80211_bss *cbss)
2744 {
2745         struct ieee80211_sub_if_data *sdata = link->sdata;
2746         struct ieee80211_bss_conf *bss_conf = link->conf;
2747         struct ieee80211_bss *bss = (void *)cbss->priv;
2748         u64 changed = BSS_CHANGED_QOS;
2749
2750         /* not really used in MLO */
2751         sdata->u.mgd.beacon_timeout =
2752                 usecs_to_jiffies(ieee80211_tu_to_usec(beacon_loss_count *
2753                                                       bss_conf->beacon_int));
2754
2755         changed |= ieee80211_handle_bss_capability(link,
2756                                                    bss_conf->assoc_capability,
2757                                                    bss->has_erp_value,
2758                                                    bss->erp_value);
2759
2760         ieee80211_check_rate_mask(link);
2761
2762         link->u.mgd.bss = cbss;
2763         memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2764
2765         if (sdata->vif.p2p ||
2766             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2767                 const struct cfg80211_bss_ies *ies;
2768
2769                 rcu_read_lock();
2770                 ies = rcu_dereference(cbss->ies);
2771                 if (ies) {
2772                         int ret;
2773
2774                         ret = cfg80211_get_p2p_attr(
2775                                         ies->data, ies->len,
2776                                         IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
2777                                         (u8 *) &bss_conf->p2p_noa_attr,
2778                                         sizeof(bss_conf->p2p_noa_attr));
2779                         if (ret >= 2) {
2780                                 link->u.mgd.p2p_noa_index =
2781                                         bss_conf->p2p_noa_attr.index;
2782                                 changed |= BSS_CHANGED_P2P_PS;
2783                         }
2784                 }
2785                 rcu_read_unlock();
2786         }
2787
2788         if (link->u.mgd.have_beacon) {
2789                 bss_conf->beacon_rate = bss->beacon_rate;
2790                 changed |= BSS_CHANGED_BEACON_INFO;
2791         } else {
2792                 bss_conf->beacon_rate = NULL;
2793         }
2794
2795         /* Tell the driver to monitor connection quality (if supported) */
2796         if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2797             bss_conf->cqm_rssi_thold)
2798                 changed |= BSS_CHANGED_CQM;
2799
2800         return changed;
2801 }
2802
2803 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2804                                      struct ieee80211_mgd_assoc_data *assoc_data,
2805                                      u64 changed[IEEE80211_MLD_MAX_NUM_LINKS])
2806 {
2807         struct ieee80211_local *local = sdata->local;
2808         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
2809         u64 vif_changed = BSS_CHANGED_ASSOC;
2810         unsigned int link_id;
2811
2812         sdata->u.mgd.associated = true;
2813
2814         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
2815                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
2816                 struct ieee80211_link_data *link;
2817
2818                 if (!cbss ||
2819                     assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
2820                         continue;
2821
2822                 if (ieee80211_vif_is_mld(&sdata->vif) &&
2823                     !(ieee80211_vif_usable_links(&sdata->vif) & BIT(link_id)))
2824                         continue;
2825
2826                 link = sdata_dereference(sdata->link[link_id], sdata);
2827                 if (WARN_ON(!link))
2828                         return;
2829
2830                 changed[link_id] |= ieee80211_link_set_associated(link, cbss);
2831         }
2832
2833         /* just to be sure */
2834         ieee80211_stop_poll(sdata);
2835
2836         ieee80211_led_assoc(local, 1);
2837
2838         vif_cfg->assoc = 1;
2839
2840         /* Enable ARP filtering */
2841         if (vif_cfg->arp_addr_cnt)
2842                 vif_changed |= BSS_CHANGED_ARP_FILTER;
2843
2844         if (ieee80211_vif_is_mld(&sdata->vif)) {
2845                 for (link_id = 0;
2846                      link_id < IEEE80211_MLD_MAX_NUM_LINKS;
2847                      link_id++) {
2848                         struct ieee80211_link_data *link;
2849                         struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
2850
2851                         if (!cbss ||
2852                             !(BIT(link_id) &
2853                               ieee80211_vif_usable_links(&sdata->vif)) ||
2854                             assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
2855                                 continue;
2856
2857                         link = sdata_dereference(sdata->link[link_id], sdata);
2858                         if (WARN_ON(!link))
2859                                 return;
2860
2861                         ieee80211_link_info_change_notify(sdata, link,
2862                                                           changed[link_id]);
2863
2864                         ieee80211_recalc_smps(sdata, link);
2865                 }
2866
2867                 ieee80211_vif_cfg_change_notify(sdata, vif_changed);
2868         } else {
2869                 ieee80211_bss_info_change_notify(sdata,
2870                                                  vif_changed | changed[0]);
2871         }
2872
2873         mutex_lock(&local->iflist_mtx);
2874         ieee80211_recalc_ps(local);
2875         mutex_unlock(&local->iflist_mtx);
2876
2877         /* leave this here to not change ordering in non-MLO cases */
2878         if (!ieee80211_vif_is_mld(&sdata->vif))
2879                 ieee80211_recalc_smps(sdata, &sdata->deflink);
2880         ieee80211_recalc_ps_vif(sdata);
2881
2882         netif_carrier_on(sdata->dev);
2883 }
2884
2885 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2886                                    u16 stype, u16 reason, bool tx,
2887                                    u8 *frame_buf)
2888 {
2889         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2890         struct ieee80211_local *local = sdata->local;
2891         unsigned int link_id;
2892         u64 changed = 0;
2893         struct ieee80211_prep_tx_info info = {
2894                 .subtype = stype,
2895         };
2896
2897         sdata_assert_lock(sdata);
2898
2899         if (WARN_ON_ONCE(tx && !frame_buf))
2900                 return;
2901
2902         if (WARN_ON(!ifmgd->associated))
2903                 return;
2904
2905         ieee80211_stop_poll(sdata);
2906
2907         ifmgd->associated = false;
2908
2909         /* other links will be destroyed */
2910         sdata->deflink.u.mgd.bss = NULL;
2911
2912         netif_carrier_off(sdata->dev);
2913
2914         /*
2915          * if we want to get out of ps before disassoc (why?) we have
2916          * to do it before sending disassoc, as otherwise the null-packet
2917          * won't be valid.
2918          */
2919         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2920                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2921                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2922         }
2923         local->ps_sdata = NULL;
2924
2925         /* disable per-vif ps */
2926         ieee80211_recalc_ps_vif(sdata);
2927
2928         /* make sure ongoing transmission finishes */
2929         synchronize_net();
2930
2931         /*
2932          * drop any frame before deauth/disassoc, this can be data or
2933          * management frame. Since we are disconnecting, we should not
2934          * insist sending these frames which can take time and delay
2935          * the disconnection and possible the roaming.
2936          */
2937         if (tx)
2938                 ieee80211_flush_queues(local, sdata, true);
2939
2940         /* deauthenticate/disassociate now */
2941         if (tx || frame_buf) {
2942                 /*
2943                  * In multi channel scenarios guarantee that the virtual
2944                  * interface is granted immediate airtime to transmit the
2945                  * deauthentication frame by calling mgd_prepare_tx, if the
2946                  * driver requested so.
2947                  */
2948                 if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
2949                     !sdata->deflink.u.mgd.have_beacon) {
2950                         drv_mgd_prepare_tx(sdata->local, sdata, &info);
2951                 }
2952
2953                 ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr,
2954                                                sdata->vif.cfg.ap_addr, stype,
2955                                                reason, tx, frame_buf);
2956         }
2957
2958         /* flush out frame - make sure the deauth was actually sent */
2959         if (tx)
2960                 ieee80211_flush_queues(local, sdata, false);
2961
2962         drv_mgd_complete_tx(sdata->local, sdata, &info);
2963
2964         /* clear AP addr only after building the needed mgmt frames */
2965         eth_zero_addr(sdata->deflink.u.mgd.bssid);
2966         eth_zero_addr(sdata->vif.cfg.ap_addr);
2967
2968         sdata->vif.cfg.ssid_len = 0;
2969
2970         /* remove AP and TDLS peers */
2971         sta_info_flush(sdata);
2972
2973         /* finally reset all BSS / config parameters */
2974         if (!ieee80211_vif_is_mld(&sdata->vif))
2975                 changed |= ieee80211_reset_erp_info(sdata);
2976
2977         ieee80211_led_assoc(local, 0);
2978         changed |= BSS_CHANGED_ASSOC;
2979         sdata->vif.cfg.assoc = false;
2980
2981         sdata->deflink.u.mgd.p2p_noa_index = -1;
2982         memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
2983                sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2984
2985         /* on the next assoc, re-program HT/VHT parameters */
2986         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
2987         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2988         memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
2989         memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2990
2991         /*
2992          * reset MU-MIMO ownership and group data in default link,
2993          * if used, other links are destroyed
2994          */
2995         memset(sdata->vif.bss_conf.mu_group.membership, 0,
2996                sizeof(sdata->vif.bss_conf.mu_group.membership));
2997         memset(sdata->vif.bss_conf.mu_group.position, 0,
2998                sizeof(sdata->vif.bss_conf.mu_group.position));
2999         if (!ieee80211_vif_is_mld(&sdata->vif))
3000                 changed |= BSS_CHANGED_MU_GROUPS;
3001         sdata->vif.bss_conf.mu_mimo_owner = false;
3002
3003         sdata->deflink.ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
3004
3005         del_timer_sync(&local->dynamic_ps_timer);
3006         cancel_work_sync(&local->dynamic_ps_enable_work);
3007
3008         /* Disable ARP filtering */
3009         if (sdata->vif.cfg.arp_addr_cnt)
3010                 changed |= BSS_CHANGED_ARP_FILTER;
3011
3012         sdata->vif.bss_conf.qos = false;
3013         if (!ieee80211_vif_is_mld(&sdata->vif)) {
3014                 changed |= BSS_CHANGED_QOS;
3015                 /* The BSSID (not really interesting) and HT changed */
3016                 changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
3017                 ieee80211_bss_info_change_notify(sdata, changed);
3018         } else {
3019                 ieee80211_vif_cfg_change_notify(sdata, changed);
3020         }
3021
3022         /* disassociated - set to defaults now */
3023         ieee80211_set_wmm_default(&sdata->deflink, false, false);
3024
3025         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
3026         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
3027         del_timer_sync(&sdata->u.mgd.timer);
3028
3029         sdata->vif.bss_conf.dtim_period = 0;
3030         sdata->vif.bss_conf.beacon_rate = NULL;
3031
3032         sdata->deflink.u.mgd.have_beacon = false;
3033         sdata->deflink.u.mgd.tracking_signal_avg = false;
3034         sdata->deflink.u.mgd.disable_wmm_tracking = false;
3035
3036         ifmgd->flags = 0;
3037         sdata->deflink.u.mgd.conn_flags = 0;
3038         mutex_lock(&local->mtx);
3039
3040         for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
3041                 struct ieee80211_link_data *link;
3042
3043                 link = sdata_dereference(sdata->link[link_id], sdata);
3044                 if (!link)
3045                         continue;
3046                 ieee80211_link_release_channel(link);
3047         }
3048
3049         sdata->vif.bss_conf.csa_active = false;
3050         sdata->deflink.u.mgd.csa_waiting_bcn = false;
3051         sdata->deflink.u.mgd.csa_ignored_same_chan = false;
3052         if (sdata->deflink.csa_block_tx) {
3053                 ieee80211_wake_vif_queues(local, sdata,
3054                                           IEEE80211_QUEUE_STOP_REASON_CSA);
3055                 sdata->deflink.csa_block_tx = false;
3056         }
3057         mutex_unlock(&local->mtx);
3058
3059         /* existing TX TSPEC sessions no longer exist */
3060         memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
3061         cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
3062
3063         sdata->vif.bss_conf.pwr_reduction = 0;
3064         sdata->vif.bss_conf.tx_pwr_env_num = 0;
3065         memset(sdata->vif.bss_conf.tx_pwr_env, 0,
3066                sizeof(sdata->vif.bss_conf.tx_pwr_env));
3067
3068         ieee80211_vif_set_links(sdata, 0, 0);
3069 }
3070
3071 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
3072 {
3073         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3074         struct ieee80211_local *local = sdata->local;
3075
3076         mutex_lock(&local->mtx);
3077         if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
3078                 goto out;
3079
3080         __ieee80211_stop_poll(sdata);
3081
3082         mutex_lock(&local->iflist_mtx);
3083         ieee80211_recalc_ps(local);
3084         mutex_unlock(&local->iflist_mtx);
3085
3086         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
3087                 goto out;
3088
3089         /*
3090          * We've received a probe response, but are not sure whether
3091          * we have or will be receiving any beacons or data, so let's
3092          * schedule the timers again, just in case.
3093          */
3094         ieee80211_sta_reset_beacon_monitor(sdata);
3095
3096         mod_timer(&ifmgd->conn_mon_timer,
3097                   round_jiffies_up(jiffies +
3098                                    IEEE80211_CONNECTION_IDLE_TIME));
3099 out:
3100         mutex_unlock(&local->mtx);
3101 }
3102
3103 static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
3104                                            struct ieee80211_hdr *hdr,
3105                                            u16 tx_time)
3106 {
3107         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3108         u16 tid;
3109         int ac;
3110         struct ieee80211_sta_tx_tspec *tx_tspec;
3111         unsigned long now = jiffies;
3112
3113         if (!ieee80211_is_data_qos(hdr->frame_control))
3114                 return;
3115
3116         tid = ieee80211_get_tid(hdr);
3117         ac = ieee80211_ac_from_tid(tid);
3118         tx_tspec = &ifmgd->tx_tspec[ac];
3119
3120         if (likely(!tx_tspec->admitted_time))
3121                 return;
3122
3123         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
3124                 tx_tspec->consumed_tx_time = 0;
3125                 tx_tspec->time_slice_start = now;
3126
3127                 if (tx_tspec->downgraded) {
3128                         tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
3129                         schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
3130                 }
3131         }
3132
3133         if (tx_tspec->downgraded)
3134                 return;
3135
3136         tx_tspec->consumed_tx_time += tx_time;
3137
3138         if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
3139                 tx_tspec->downgraded = true;
3140                 tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
3141                 schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
3142         }
3143 }
3144
3145 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
3146                              struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
3147 {
3148         ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
3149
3150         if (!ieee80211_is_any_nullfunc(hdr->frame_control) ||
3151             !sdata->u.mgd.probe_send_count)
3152                 return;
3153
3154         if (ack)
3155                 sdata->u.mgd.probe_send_count = 0;
3156         else
3157                 sdata->u.mgd.nullfunc_failed = true;
3158         wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
3159 }
3160
3161 static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
3162                                           const u8 *src, const u8 *dst,
3163                                           const u8 *ssid, size_t ssid_len,
3164                                           struct ieee80211_channel *channel)
3165 {
3166         struct sk_buff *skb;
3167
3168         skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
3169                                         ssid, ssid_len, NULL, 0,
3170                                         IEEE80211_PROBE_FLAG_DIRECTED);
3171         if (skb)
3172                 ieee80211_tx_skb(sdata, skb);
3173 }
3174
3175 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
3176 {
3177         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3178         u8 *dst = sdata->vif.cfg.ap_addr;
3179         u8 unicast_limit = max(1, max_probe_tries - 3);
3180         struct sta_info *sta;
3181
3182         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
3183                 return;
3184
3185         /*
3186          * Try sending broadcast probe requests for the last three
3187          * probe requests after the first ones failed since some
3188          * buggy APs only support broadcast probe requests.
3189          */
3190         if (ifmgd->probe_send_count >= unicast_limit)
3191                 dst = NULL;
3192
3193         /*
3194          * When the hardware reports an accurate Tx ACK status, it's
3195          * better to send a nullfunc frame instead of a probe request,
3196          * as it will kick us off the AP quickly if we aren't associated
3197          * anymore. The timeout will be reset if the frame is ACKed by
3198          * the AP.
3199          */
3200         ifmgd->probe_send_count++;
3201
3202         if (dst) {
3203                 mutex_lock(&sdata->local->sta_mtx);
3204                 sta = sta_info_get(sdata, dst);
3205                 if (!WARN_ON(!sta))
3206                         ieee80211_check_fast_rx(sta);
3207                 mutex_unlock(&sdata->local->sta_mtx);
3208         }
3209
3210         if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
3211                 ifmgd->nullfunc_failed = false;
3212                 ieee80211_send_nullfunc(sdata->local, sdata, false);
3213         } else {
3214                 ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
3215                                               sdata->vif.cfg.ssid,
3216                                               sdata->vif.cfg.ssid_len,
3217                                               sdata->deflink.u.mgd.bss->channel);
3218         }
3219
3220         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
3221         run_again(sdata, ifmgd->probe_timeout);
3222 }
3223
3224 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
3225                                    bool beacon)
3226 {
3227         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3228         bool already = false;
3229
3230         if (WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif)))
3231                 return;
3232
3233         if (!ieee80211_sdata_running(sdata))
3234                 return;
3235
3236         sdata_lock(sdata);
3237
3238         if (!ifmgd->associated)
3239                 goto out;
3240
3241         mutex_lock(&sdata->local->mtx);
3242
3243         if (sdata->local->tmp_channel || sdata->local->scanning) {
3244                 mutex_unlock(&sdata->local->mtx);
3245                 goto out;
3246         }
3247
3248         if (sdata->local->suspending) {
3249                 /* reschedule after resume */
3250                 mutex_unlock(&sdata->local->mtx);
3251                 ieee80211_reset_ap_probe(sdata);
3252                 goto out;
3253         }
3254
3255         if (beacon) {
3256                 mlme_dbg_ratelimited(sdata,
3257                                      "detected beacon loss from AP (missed %d beacons) - probing\n",
3258                                      beacon_loss_count);
3259
3260                 ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
3261         }
3262
3263         /*
3264          * The driver/our work has already reported this event or the
3265          * connection monitoring has kicked in and we have already sent
3266          * a probe request. Or maybe the AP died and the driver keeps
3267          * reporting until we disassociate...
3268          *
3269          * In either case we have to ignore the current call to this
3270          * function (except for setting the correct probe reason bit)
3271          * because otherwise we would reset the timer every time and
3272          * never check whether we received a probe response!
3273          */
3274         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
3275                 already = true;
3276
3277         ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
3278
3279         mutex_unlock(&sdata->local->mtx);
3280
3281         if (already)
3282                 goto out;
3283
3284         mutex_lock(&sdata->local->iflist_mtx);
3285         ieee80211_recalc_ps(sdata->local);
3286         mutex_unlock(&sdata->local->iflist_mtx);
3287
3288         ifmgd->probe_send_count = 0;
3289         ieee80211_mgd_probe_ap_send(sdata);
3290  out:
3291         sdata_unlock(sdata);
3292 }
3293
3294 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
3295                                           struct ieee80211_vif *vif)
3296 {
3297         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3298         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3299         struct cfg80211_bss *cbss;
3300         struct sk_buff *skb;
3301         const struct element *ssid;
3302         int ssid_len;
3303
3304         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
3305                     ieee80211_vif_is_mld(&sdata->vif)))
3306                 return NULL;
3307
3308         sdata_assert_lock(sdata);
3309
3310         if (ifmgd->associated)
3311                 cbss = sdata->deflink.u.mgd.bss;
3312         else if (ifmgd->auth_data)
3313                 cbss = ifmgd->auth_data->bss;
3314         else if (ifmgd->assoc_data && ifmgd->assoc_data->link[0].bss)
3315                 cbss = ifmgd->assoc_data->link[0].bss;
3316         else
3317                 return NULL;
3318
3319         rcu_read_lock();
3320         ssid = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
3321         if (WARN_ONCE(!ssid || ssid->datalen > IEEE80211_MAX_SSID_LEN,
3322                       "invalid SSID element (len=%d)",
3323                       ssid ? ssid->datalen : -1))
3324                 ssid_len = 0;
3325         else
3326                 ssid_len = ssid->datalen;
3327
3328         skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
3329                                         (u32) -1, cbss->channel,
3330                                         ssid->data, ssid_len,
3331                                         NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
3332         rcu_read_unlock();
3333
3334         return skb;
3335 }
3336 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
3337
3338 static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
3339                                         const u8 *buf, size_t len, bool tx,
3340                                         u16 reason, bool reconnect)
3341 {
3342         struct ieee80211_event event = {
3343                 .type = MLME_EVENT,
3344                 .u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
3345                 .u.mlme.reason = reason,
3346         };
3347
3348         if (tx)
3349                 cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
3350         else
3351                 cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
3352
3353         drv_event_callback(sdata->local, sdata, &event);
3354 }
3355
3356 static void ___ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
3357 {
3358         struct ieee80211_local *local = sdata->local;
3359         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3360         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3361         bool tx;
3362
3363         if (!ifmgd->associated)
3364                 return;
3365
3366         /* in MLO assume we have a link where we can TX the frame */
3367         tx = ieee80211_vif_is_mld(&sdata->vif) ||
3368                 !sdata->deflink.csa_block_tx;
3369
3370         if (!ifmgd->driver_disconnect) {
3371                 unsigned int link_id;
3372
3373                 /*
3374                  * AP is probably out of range (or not reachable for another
3375                  * reason) so remove the bss structs for that AP. In the case
3376                  * of multi-link, it's not clear that all of them really are
3377                  * out of range, but if they weren't the driver likely would
3378                  * have switched to just have a single link active?
3379                  */
3380                 for (link_id = 0;
3381                      link_id < ARRAY_SIZE(sdata->link);
3382                      link_id++) {
3383                         struct ieee80211_link_data *link;
3384
3385                         link = sdata_dereference(sdata->link[link_id], sdata);
3386                         if (!link)
3387                                 continue;
3388                         cfg80211_unlink_bss(local->hw.wiphy, link->u.mgd.bss);
3389                         link->u.mgd.bss = NULL;
3390                 }
3391         }
3392
3393         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3394                                ifmgd->driver_disconnect ?
3395                                         WLAN_REASON_DEAUTH_LEAVING :
3396                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3397                                tx, frame_buf);
3398         mutex_lock(&local->mtx);
3399         /* the other links will be destroyed */
3400         sdata->vif.bss_conf.csa_active = false;
3401         sdata->deflink.u.mgd.csa_waiting_bcn = false;
3402         if (sdata->deflink.csa_block_tx) {
3403                 ieee80211_wake_vif_queues(local, sdata,
3404                                           IEEE80211_QUEUE_STOP_REASON_CSA);
3405                 sdata->deflink.csa_block_tx = false;
3406         }
3407         mutex_unlock(&local->mtx);
3408
3409         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
3410                                     WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3411                                     ifmgd->reconnect);
3412         ifmgd->reconnect = false;
3413 }
3414
3415 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
3416 {
3417         sdata_lock(sdata);
3418         ___ieee80211_disconnect(sdata);
3419         sdata_unlock(sdata);
3420 }
3421
3422 static void ieee80211_beacon_connection_loss_work(struct wiphy *wiphy,
3423                                                   struct wiphy_work *work)
3424 {
3425         struct ieee80211_sub_if_data *sdata =
3426                 container_of(work, struct ieee80211_sub_if_data,
3427                              u.mgd.beacon_connection_loss_work);
3428         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3429
3430         if (ifmgd->connection_loss) {
3431                 sdata_info(sdata, "Connection to AP %pM lost\n",
3432                            sdata->vif.cfg.ap_addr);
3433                 __ieee80211_disconnect(sdata);
3434                 ifmgd->connection_loss = false;
3435         } else if (ifmgd->driver_disconnect) {
3436                 sdata_info(sdata,
3437                            "Driver requested disconnection from AP %pM\n",
3438                            sdata->vif.cfg.ap_addr);
3439                 __ieee80211_disconnect(sdata);
3440                 ifmgd->driver_disconnect = false;
3441         } else {
3442                 if (ifmgd->associated)
3443                         sdata->deflink.u.mgd.beacon_loss_count++;
3444                 ieee80211_mgd_probe_ap(sdata, true);
3445         }
3446 }
3447
3448 static void ieee80211_csa_connection_drop_work(struct wiphy *wiphy,
3449                                                struct wiphy_work *work)
3450 {
3451         struct ieee80211_sub_if_data *sdata =
3452                 container_of(work, struct ieee80211_sub_if_data,
3453                              u.mgd.csa_connection_drop_work);
3454
3455         __ieee80211_disconnect(sdata);
3456 }
3457
3458 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
3459 {
3460         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3461         struct ieee80211_hw *hw = &sdata->local->hw;
3462
3463         trace_api_beacon_loss(sdata);
3464
3465         sdata->u.mgd.connection_loss = false;
3466         wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3467 }
3468 EXPORT_SYMBOL(ieee80211_beacon_loss);
3469
3470 void ieee80211_connection_loss(struct ieee80211_vif *vif)
3471 {
3472         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3473         struct ieee80211_hw *hw = &sdata->local->hw;
3474
3475         trace_api_connection_loss(sdata);
3476
3477         sdata->u.mgd.connection_loss = true;
3478         wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3479 }
3480 EXPORT_SYMBOL(ieee80211_connection_loss);
3481
3482 void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
3483 {
3484         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3485         struct ieee80211_hw *hw = &sdata->local->hw;
3486
3487         trace_api_disconnect(sdata, reconnect);
3488
3489         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
3490                 return;
3491
3492         sdata->u.mgd.driver_disconnect = true;
3493         sdata->u.mgd.reconnect = reconnect;
3494         wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3495 }
3496 EXPORT_SYMBOL(ieee80211_disconnect);
3497
3498 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
3499                                         bool assoc)
3500 {
3501         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3502
3503         sdata_assert_lock(sdata);
3504
3505         if (!assoc) {
3506                 /*
3507                  * we are not authenticated yet, the only timer that could be
3508                  * running is the timeout for the authentication response which
3509                  * which is not relevant anymore.
3510                  */
3511                 del_timer_sync(&sdata->u.mgd.timer);
3512                 sta_info_destroy_addr(sdata, auth_data->ap_addr);
3513
3514                 /* other links are destroyed */
3515                 sdata->deflink.u.mgd.conn_flags = 0;
3516                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
3517                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3518                                                   BSS_CHANGED_BSSID);
3519                 sdata->u.mgd.flags = 0;
3520
3521                 mutex_lock(&sdata->local->mtx);
3522                 ieee80211_link_release_channel(&sdata->deflink);
3523                 ieee80211_vif_set_links(sdata, 0, 0);
3524                 mutex_unlock(&sdata->local->mtx);
3525         }
3526
3527         cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
3528         kfree(auth_data);
3529         sdata->u.mgd.auth_data = NULL;
3530 }
3531
3532 enum assoc_status {
3533         ASSOC_SUCCESS,
3534         ASSOC_REJECTED,
3535         ASSOC_TIMEOUT,
3536         ASSOC_ABANDON,
3537 };
3538
3539 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
3540                                          enum assoc_status status)
3541 {
3542         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3543
3544         sdata_assert_lock(sdata);
3545
3546         if (status != ASSOC_SUCCESS) {
3547                 /*
3548                  * we are not associated yet, the only timer that could be
3549                  * running is the timeout for the association response which
3550                  * which is not relevant anymore.
3551                  */
3552                 del_timer_sync(&sdata->u.mgd.timer);
3553                 sta_info_destroy_addr(sdata, assoc_data->ap_addr);
3554
3555                 sdata->deflink.u.mgd.conn_flags = 0;
3556                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
3557                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3558                                                   BSS_CHANGED_BSSID);
3559                 sdata->u.mgd.flags = 0;
3560                 sdata->vif.bss_conf.mu_mimo_owner = false;
3561
3562                 if (status != ASSOC_REJECTED) {
3563                         struct cfg80211_assoc_failure data = {
3564                                 .timeout = status == ASSOC_TIMEOUT,
3565                         };
3566                         int i;
3567
3568                         BUILD_BUG_ON(ARRAY_SIZE(data.bss) !=
3569                                      ARRAY_SIZE(assoc_data->link));
3570
3571                         for (i = 0; i < ARRAY_SIZE(data.bss); i++)
3572                                 data.bss[i] = assoc_data->link[i].bss;
3573
3574                         if (ieee80211_vif_is_mld(&sdata->vif))
3575                                 data.ap_mld_addr = assoc_data->ap_addr;
3576
3577                         cfg80211_assoc_failure(sdata->dev, &data);
3578                 }
3579
3580                 mutex_lock(&sdata->local->mtx);
3581                 ieee80211_link_release_channel(&sdata->deflink);
3582                 ieee80211_vif_set_links(sdata, 0, 0);
3583                 mutex_unlock(&sdata->local->mtx);
3584         }
3585
3586         kfree(assoc_data);
3587         sdata->u.mgd.assoc_data = NULL;
3588 }
3589
3590 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
3591                                      struct ieee80211_mgmt *mgmt, size_t len)
3592 {
3593         struct ieee80211_local *local = sdata->local;
3594         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3595         const struct element *challenge;
3596         u8 *pos;
3597         u32 tx_flags = 0;
3598         struct ieee80211_prep_tx_info info = {
3599                 .subtype = IEEE80211_STYPE_AUTH,
3600         };
3601
3602         pos = mgmt->u.auth.variable;
3603         challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
3604                                        len - (pos - (u8 *)mgmt));
3605         if (!challenge)
3606                 return;
3607         auth_data->expected_transaction = 4;
3608         drv_mgd_prepare_tx(sdata->local, sdata, &info);
3609         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3610                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3611                            IEEE80211_TX_INTFL_MLME_CONN_TX;
3612         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
3613                             (void *)challenge,
3614                             challenge->datalen + sizeof(*challenge),
3615                             auth_data->ap_addr, auth_data->ap_addr,
3616                             auth_data->key, auth_data->key_len,
3617                             auth_data->key_idx, tx_flags);
3618 }
3619
3620 static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata)
3621 {
3622         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3623         const u8 *ap_addr = ifmgd->auth_data->ap_addr;
3624         struct sta_info *sta;
3625         bool result = true;
3626
3627         sdata_info(sdata, "authenticated\n");
3628         ifmgd->auth_data->done = true;
3629         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
3630         ifmgd->auth_data->timeout_started = true;
3631         run_again(sdata, ifmgd->auth_data->timeout);
3632
3633         /* move station state to auth */
3634         mutex_lock(&sdata->local->sta_mtx);
3635         sta = sta_info_get(sdata, ap_addr);
3636         if (!sta) {
3637                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, ap_addr);
3638                 result = false;
3639                 goto out;
3640         }
3641         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
3642                 sdata_info(sdata, "failed moving %pM to auth\n", ap_addr);
3643                 result = false;
3644                 goto out;
3645         }
3646
3647 out:
3648         mutex_unlock(&sdata->local->sta_mtx);
3649         return result;
3650 }
3651
3652 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
3653                                    struct ieee80211_mgmt *mgmt, size_t len)
3654 {
3655         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3656         u16 auth_alg, auth_transaction, status_code;
3657         struct ieee80211_event event = {
3658                 .type = MLME_EVENT,
3659                 .u.mlme.data = AUTH_EVENT,
3660         };
3661         struct ieee80211_prep_tx_info info = {
3662                 .subtype = IEEE80211_STYPE_AUTH,
3663         };
3664
3665         sdata_assert_lock(sdata);
3666
3667         if (len < 24 + 6)
3668                 return;
3669
3670         if (!ifmgd->auth_data || ifmgd->auth_data->done)
3671                 return;
3672
3673         if (!ether_addr_equal(ifmgd->auth_data->ap_addr, mgmt->bssid))
3674                 return;
3675
3676         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
3677         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
3678         status_code = le16_to_cpu(mgmt->u.auth.status_code);
3679
3680         if (auth_alg != ifmgd->auth_data->algorithm ||
3681             (auth_alg != WLAN_AUTH_SAE &&
3682              auth_transaction != ifmgd->auth_data->expected_transaction) ||
3683             (auth_alg == WLAN_AUTH_SAE &&
3684              (auth_transaction < ifmgd->auth_data->expected_transaction ||
3685               auth_transaction > 2))) {
3686                 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
3687                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
3688                            auth_transaction,
3689                            ifmgd->auth_data->expected_transaction);
3690                 goto notify_driver;
3691         }
3692
3693         if (status_code != WLAN_STATUS_SUCCESS) {
3694                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3695
3696                 if (auth_alg == WLAN_AUTH_SAE &&
3697                     (status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED ||
3698                      (auth_transaction == 1 &&
3699                       (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
3700                        status_code == WLAN_STATUS_SAE_PK)))) {
3701                         /* waiting for userspace now */
3702                         ifmgd->auth_data->waiting = true;
3703                         ifmgd->auth_data->timeout =
3704                                 jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY;
3705                         ifmgd->auth_data->timeout_started = true;
3706                         run_again(sdata, ifmgd->auth_data->timeout);
3707                         goto notify_driver;
3708                 }
3709
3710                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
3711                            mgmt->sa, status_code);
3712                 ieee80211_destroy_auth_data(sdata, false);
3713                 event.u.mlme.status = MLME_DENIED;
3714                 event.u.mlme.reason = status_code;
3715                 drv_event_callback(sdata->local, sdata, &event);
3716                 goto notify_driver;
3717         }
3718
3719         switch (ifmgd->auth_data->algorithm) {
3720         case WLAN_AUTH_OPEN:
3721         case WLAN_AUTH_LEAP:
3722         case WLAN_AUTH_FT:
3723         case WLAN_AUTH_SAE:
3724         case WLAN_AUTH_FILS_SK:
3725         case WLAN_AUTH_FILS_SK_PFS:
3726         case WLAN_AUTH_FILS_PK:
3727                 break;
3728         case WLAN_AUTH_SHARED_KEY:
3729                 if (ifmgd->auth_data->expected_transaction != 4) {
3730                         ieee80211_auth_challenge(sdata, mgmt, len);
3731                         /* need another frame */
3732                         return;
3733                 }
3734                 break;
3735         default:
3736                 WARN_ONCE(1, "invalid auth alg %d",
3737                           ifmgd->auth_data->algorithm);
3738                 goto notify_driver;
3739         }
3740
3741         event.u.mlme.status = MLME_SUCCESS;
3742         info.success = 1;
3743         drv_event_callback(sdata->local, sdata, &event);
3744         if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
3745             (auth_transaction == 2 &&
3746              ifmgd->auth_data->expected_transaction == 2)) {
3747                 if (!ieee80211_mark_sta_auth(sdata))
3748                         return; /* ignore frame -- wait for timeout */
3749         } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
3750                    auth_transaction == 2) {
3751                 sdata_info(sdata, "SAE peer confirmed\n");
3752                 ifmgd->auth_data->peer_confirmed = true;
3753         }
3754
3755         cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3756 notify_driver:
3757         drv_mgd_complete_tx(sdata->local, sdata, &info);
3758 }
3759
3760 #define case_WLAN(type) \
3761         case WLAN_REASON_##type: return #type
3762
3763 const char *ieee80211_get_reason_code_string(u16 reason_code)
3764 {
3765         switch (reason_code) {
3766         case_WLAN(UNSPECIFIED);
3767         case_WLAN(PREV_AUTH_NOT_VALID);
3768         case_WLAN(DEAUTH_LEAVING);
3769         case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
3770         case_WLAN(DISASSOC_AP_BUSY);
3771         case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
3772         case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
3773         case_WLAN(DISASSOC_STA_HAS_LEFT);
3774         case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
3775         case_WLAN(DISASSOC_BAD_POWER);
3776         case_WLAN(DISASSOC_BAD_SUPP_CHAN);
3777         case_WLAN(INVALID_IE);
3778         case_WLAN(MIC_FAILURE);
3779         case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
3780         case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
3781         case_WLAN(IE_DIFFERENT);
3782         case_WLAN(INVALID_GROUP_CIPHER);
3783         case_WLAN(INVALID_PAIRWISE_CIPHER);
3784         case_WLAN(INVALID_AKMP);
3785         case_WLAN(UNSUPP_RSN_VERSION);
3786         case_WLAN(INVALID_RSN_IE_CAP);
3787         case_WLAN(IEEE8021X_FAILED);
3788         case_WLAN(CIPHER_SUITE_REJECTED);
3789         case_WLAN(DISASSOC_UNSPECIFIED_QOS);
3790         case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
3791         case_WLAN(DISASSOC_LOW_ACK);
3792         case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
3793         case_WLAN(QSTA_LEAVE_QBSS);
3794         case_WLAN(QSTA_NOT_USE);
3795         case_WLAN(QSTA_REQUIRE_SETUP);
3796         case_WLAN(QSTA_TIMEOUT);
3797         case_WLAN(QSTA_CIPHER_NOT_SUPP);
3798         case_WLAN(MESH_PEER_CANCELED);
3799         case_WLAN(MESH_MAX_PEERS);
3800         case_WLAN(MESH_CONFIG);
3801         case_WLAN(MESH_CLOSE);
3802         case_WLAN(MESH_MAX_RETRIES);
3803         case_WLAN(MESH_CONFIRM_TIMEOUT);
3804         case_WLAN(MESH_INVALID_GTK);
3805         case_WLAN(MESH_INCONSISTENT_PARAM);
3806         case_WLAN(MESH_INVALID_SECURITY);
3807         case_WLAN(MESH_PATH_ERROR);
3808         case_WLAN(MESH_PATH_NOFORWARD);
3809         case_WLAN(MESH_PATH_DEST_UNREACHABLE);
3810         case_WLAN(MAC_EXISTS_IN_MBSS);
3811         case_WLAN(MESH_CHAN_REGULATORY);
3812         case_WLAN(MESH_CHAN);
3813         default: return "<unknown>";
3814         }
3815 }
3816
3817 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
3818                                      struct ieee80211_mgmt *mgmt, size_t len)
3819 {
3820         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3821         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3822
3823         sdata_assert_lock(sdata);
3824
3825         if (len < 24 + 2)
3826                 return;
3827
3828         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3829                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3830                 return;
3831         }
3832
3833         if (ifmgd->associated &&
3834             ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {
3835                 sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
3836                            sdata->vif.cfg.ap_addr, reason_code,
3837                            ieee80211_get_reason_code_string(reason_code));
3838
3839                 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3840
3841                 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
3842                                             reason_code, false);
3843                 return;
3844         }
3845
3846         if (ifmgd->assoc_data &&
3847             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->ap_addr)) {
3848                 sdata_info(sdata,
3849                            "deauthenticated from %pM while associating (Reason: %u=%s)\n",
3850                            ifmgd->assoc_data->ap_addr, reason_code,
3851                            ieee80211_get_reason_code_string(reason_code));
3852
3853                 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
3854
3855                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3856                 return;
3857         }
3858 }
3859
3860
3861 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
3862                                        struct ieee80211_mgmt *mgmt, size_t len)
3863 {
3864         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3865         u16 reason_code;
3866
3867         sdata_assert_lock(sdata);
3868
3869         if (len < 24 + 2)
3870                 return;
3871
3872         if (!ifmgd->associated ||
3873             !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
3874                 return;
3875
3876         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
3877
3878         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3879                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3880                 return;
3881         }
3882
3883         sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
3884                    sdata->vif.cfg.ap_addr, reason_code,
3885                    ieee80211_get_reason_code_string(reason_code));
3886
3887         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3888
3889         ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
3890                                     false);
3891 }
3892
3893 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
3894                                 u8 *supp_rates, unsigned int supp_rates_len,
3895                                 u32 *rates, u32 *basic_rates,
3896                                 bool *have_higher_than_11mbit,
3897                                 int *min_rate, int *min_rate_index,
3898                                 int shift)
3899 {
3900         int i, j;
3901
3902         for (i = 0; i < supp_rates_len; i++) {
3903                 int rate = supp_rates[i] & 0x7f;
3904                 bool is_basic = !!(supp_rates[i] & 0x80);
3905
3906                 if ((rate * 5 * (1 << shift)) > 110)
3907                         *have_higher_than_11mbit = true;
3908
3909                 /*
3910                  * Skip HT, VHT, HE, EHT and SAE H2E only BSS membership
3911                  * selectors since they're not rates.
3912                  *
3913                  * Note: Even though the membership selector and the basic
3914                  *       rate flag share the same bit, they are not exactly
3915                  *       the same.
3916                  */
3917                 if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3918                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
3919                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY) ||
3920                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_EHT_PHY) ||
3921                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E))
3922                         continue;
3923
3924                 for (j = 0; j < sband->n_bitrates; j++) {
3925                         struct ieee80211_rate *br;
3926                         int brate;
3927
3928                         br = &sband->bitrates[j];
3929
3930                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
3931                         if (brate == rate) {
3932                                 *rates |= BIT(j);
3933                                 if (is_basic)
3934                                         *basic_rates |= BIT(j);
3935                                 if ((rate * 5) < *min_rate) {
3936                                         *min_rate = rate * 5;
3937                                         *min_rate_index = j;
3938                                 }
3939                                 break;
3940                         }
3941                 }
3942         }
3943 }
3944
3945 static bool ieee80211_twt_req_supported(struct ieee80211_sub_if_data *sdata,
3946                                         struct ieee80211_supported_band *sband,
3947                                         const struct link_sta_info *link_sta,
3948                                         const struct ieee802_11_elems *elems)
3949 {
3950         const struct ieee80211_sta_he_cap *own_he_cap =
3951                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
3952
3953         if (elems->ext_capab_len < 10)
3954                 return false;
3955
3956         if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
3957                 return false;
3958
3959         return link_sta->pub->he_cap.he_cap_elem.mac_cap_info[0] &
3960                 IEEE80211_HE_MAC_CAP0_TWT_RES &&
3961                 own_he_cap &&
3962                 (own_he_cap->he_cap_elem.mac_cap_info[0] &
3963                         IEEE80211_HE_MAC_CAP0_TWT_REQ);
3964 }
3965
3966 static u64 ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
3967                                     struct ieee80211_supported_band *sband,
3968                                     struct ieee80211_link_data *link,
3969                                     struct link_sta_info *link_sta,
3970                                     struct ieee802_11_elems *elems)
3971 {
3972         bool twt = ieee80211_twt_req_supported(sdata, sband, link_sta, elems);
3973
3974         if (link->conf->twt_requester != twt) {
3975                 link->conf->twt_requester = twt;
3976                 return BSS_CHANGED_TWT;
3977         }
3978         return 0;
3979 }
3980
3981 static bool ieee80211_twt_bcast_support(struct ieee80211_sub_if_data *sdata,
3982                                         struct ieee80211_bss_conf *bss_conf,
3983                                         struct ieee80211_supported_band *sband,
3984                                         struct link_sta_info *link_sta)
3985 {
3986         const struct ieee80211_sta_he_cap *own_he_cap =
3987                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
3988
3989         return bss_conf->he_support &&
3990                 (link_sta->pub->he_cap.he_cap_elem.mac_cap_info[2] &
3991                         IEEE80211_HE_MAC_CAP2_BCAST_TWT) &&
3992                 own_he_cap &&
3993                 (own_he_cap->he_cap_elem.mac_cap_info[2] &
3994                         IEEE80211_HE_MAC_CAP2_BCAST_TWT);
3995 }
3996
3997 static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
3998                                         struct link_sta_info *link_sta,
3999                                         struct cfg80211_bss *cbss,
4000                                         struct ieee80211_mgmt *mgmt,
4001                                         const u8 *elem_start,
4002                                         unsigned int elem_len,
4003                                         u64 *changed)
4004 {
4005         struct ieee80211_sub_if_data *sdata = link->sdata;
4006         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
4007         struct ieee80211_bss_conf *bss_conf = link->conf;
4008         struct ieee80211_local *local = sdata->local;
4009         unsigned int link_id = link->link_id;
4010         struct ieee80211_elems_parse_params parse_params = {
4011                 .start = elem_start,
4012                 .len = elem_len,
4013                 .link_id = link_id == assoc_data->assoc_link_id ? -1 : link_id,
4014                 .from_ap = true,
4015         };
4016         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4017         bool is_s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
4018         const struct cfg80211_bss_ies *bss_ies = NULL;
4019         struct ieee80211_supported_band *sband;
4020         struct ieee802_11_elems *elems;
4021         const __le16 prof_bss_param_ch_present =
4022                 cpu_to_le16(IEEE80211_MLE_STA_CONTROL_BSS_PARAM_CHANGE_CNT_PRESENT);
4023         u16 capab_info;
4024         bool ret;
4025
4026         elems = ieee802_11_parse_elems_full(&parse_params);
4027         if (!elems)
4028                 return false;
4029
4030         if (link_id == assoc_data->assoc_link_id) {
4031                 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
4032
4033                 /*
4034                  * we should not get to this flow unless the association was
4035                  * successful, so set the status directly to success
4036                  */
4037                 assoc_data->link[link_id].status = WLAN_STATUS_SUCCESS;
4038                 if (elems->ml_basic) {
4039                         if (!(elems->ml_basic->control &
4040                                         cpu_to_le16(IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT))) {
4041                                 ret = false;
4042                                 goto out;
4043                         }
4044                         link->u.mgd.bss_param_ch_cnt =
4045                                 ieee80211_mle_get_bss_param_ch_cnt(elems->ml_basic);
4046                 }
4047         } else if (!elems->prof ||
4048                    !(elems->prof->control & prof_bss_param_ch_present)) {
4049                 ret = false;
4050                 goto out;
4051         } else {
4052                 const u8 *ptr = elems->prof->variable +
4053                                 elems->prof->sta_info_len - 1;
4054
4055                 /*
4056                  * During parsing, we validated that these fields exist,
4057                  * otherwise elems->prof would have been set to NULL.
4058                  */
4059                 capab_info = get_unaligned_le16(ptr);
4060                 assoc_data->link[link_id].status = get_unaligned_le16(ptr + 2);
4061                 link->u.mgd.bss_param_ch_cnt =
4062                         ieee80211_mle_basic_sta_prof_bss_param_ch_cnt(elems->prof);
4063
4064                 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
4065                         link_info(link, "association response status code=%u\n",
4066                                   assoc_data->link[link_id].status);
4067                         ret = true;
4068                         goto out;
4069                 }
4070         }
4071
4072         if (!is_s1g && !elems->supp_rates) {
4073                 sdata_info(sdata, "no SuppRates element in AssocResp\n");
4074                 ret = false;
4075                 goto out;
4076         }
4077
4078         link->u.mgd.tdls_chan_switch_prohibited =
4079                 elems->ext_capab && elems->ext_capab_len >= 5 &&
4080                 (elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
4081
4082         /*
4083          * Some APs are erroneously not including some information in their
4084          * (re)association response frames. Try to recover by using the data
4085          * from the beacon or probe response. This seems to afflict mobile
4086          * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
4087          * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
4088          */
4089         if (!is_6ghz &&
4090             ((assoc_data->wmm && !elems->wmm_param) ||
4091              (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
4092               (!elems->ht_cap_elem || !elems->ht_operation)) ||
4093              (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
4094               (!elems->vht_cap_elem || !elems->vht_operation)))) {
4095                 const struct cfg80211_bss_ies *ies;
4096                 struct ieee802_11_elems *bss_elems;
4097
4098                 rcu_read_lock();
4099                 ies = rcu_dereference(cbss->ies);
4100                 if (ies)
4101                         bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
4102                                           GFP_ATOMIC);
4103                 rcu_read_unlock();
4104                 if (!bss_ies) {
4105                         ret = false;
4106                         goto out;
4107                 }
4108
4109                 parse_params.start = bss_ies->data;
4110                 parse_params.len = bss_ies->len;
4111                 parse_params.bss = cbss;
4112                 bss_elems = ieee802_11_parse_elems_full(&parse_params);
4113                 if (!bss_elems) {
4114                         ret = false;
4115                         goto out;
4116                 }
4117
4118                 if (assoc_data->wmm &&
4119                     !elems->wmm_param && bss_elems->wmm_param) {
4120                         elems->wmm_param = bss_elems->wmm_param;
4121                         sdata_info(sdata,
4122                                    "AP bug: WMM param missing from AssocResp\n");
4123                 }
4124
4125                 /*
4126                  * Also check if we requested HT/VHT, otherwise the AP doesn't
4127                  * have to include the IEs in the (re)association response.
4128                  */
4129                 if (!elems->ht_cap_elem && bss_elems->ht_cap_elem &&
4130                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
4131                         elems->ht_cap_elem = bss_elems->ht_cap_elem;
4132                         sdata_info(sdata,
4133                                    "AP bug: HT capability missing from AssocResp\n");
4134                 }
4135                 if (!elems->ht_operation && bss_elems->ht_operation &&
4136                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
4137                         elems->ht_operation = bss_elems->ht_operation;
4138                         sdata_info(sdata,
4139                                    "AP bug: HT operation missing from AssocResp\n");
4140                 }
4141                 if (!elems->vht_cap_elem && bss_elems->vht_cap_elem &&
4142                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4143                         elems->vht_cap_elem = bss_elems->vht_cap_elem;
4144                         sdata_info(sdata,
4145                                    "AP bug: VHT capa missing from AssocResp\n");
4146                 }
4147                 if (!elems->vht_operation && bss_elems->vht_operation &&
4148                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4149                         elems->vht_operation = bss_elems->vht_operation;
4150                         sdata_info(sdata,
4151                                    "AP bug: VHT operation missing from AssocResp\n");
4152                 }
4153
4154                 kfree(bss_elems);
4155         }
4156
4157         /*
4158          * We previously checked these in the beacon/probe response, so
4159          * they should be present here. This is just a safety net.
4160          */
4161         if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
4162             (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
4163                 sdata_info(sdata,
4164                            "HT AP is missing WMM params or HT capability/operation\n");
4165                 ret = false;
4166                 goto out;
4167         }
4168
4169         if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
4170             (!elems->vht_cap_elem || !elems->vht_operation)) {
4171                 sdata_info(sdata,
4172                            "VHT AP is missing VHT capability/operation\n");
4173                 ret = false;
4174                 goto out;
4175         }
4176
4177         if (is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4178             !elems->he_6ghz_capa) {
4179                 sdata_info(sdata,
4180                            "HE 6 GHz AP is missing HE 6 GHz band capability\n");
4181                 ret = false;
4182                 goto out;
4183         }
4184
4185         if (WARN_ON(!link->conf->chandef.chan)) {
4186                 ret = false;
4187                 goto out;
4188         }
4189         sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
4190
4191         if (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4192             (!elems->he_cap || !elems->he_operation)) {
4193                 sdata_info(sdata,
4194                            "HE AP is missing HE capability/operation\n");
4195                 ret = false;
4196                 goto out;
4197         }
4198
4199         /* Set up internal HT/VHT capabilities */
4200         if (elems->ht_cap_elem && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT))
4201                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
4202                                                   elems->ht_cap_elem,
4203                                                   link_sta);
4204
4205         if (elems->vht_cap_elem &&
4206             !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4207                 const struct ieee80211_vht_cap *bss_vht_cap = NULL;
4208                 const struct cfg80211_bss_ies *ies;
4209
4210                 /*
4211                  * Cisco AP module 9115 with FW 17.3 has a bug and sends a
4212                  * too large maximum MPDU length in the association response
4213                  * (indicating 12k) that it cannot actually process ...
4214                  * Work around that.
4215                  */
4216                 rcu_read_lock();
4217                 ies = rcu_dereference(cbss->ies);
4218                 if (ies) {
4219                         const struct element *elem;
4220
4221                         elem = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY,
4222                                                   ies->data, ies->len);
4223                         if (elem && elem->datalen >= sizeof(*bss_vht_cap))
4224                                 bss_vht_cap = (const void *)elem->data;
4225                 }
4226
4227                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
4228                                                     elems->vht_cap_elem,
4229                                                     bss_vht_cap, link_sta);
4230                 rcu_read_unlock();
4231         }
4232
4233         if (elems->he_operation && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4234             elems->he_cap) {
4235                 ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
4236                                                   elems->he_cap,
4237                                                   elems->he_cap_len,
4238                                                   elems->he_6ghz_capa,
4239                                                   link_sta);
4240
4241                 bss_conf->he_support = link_sta->pub->he_cap.has_he;
4242                 if (elems->rsnx && elems->rsnx_len &&
4243                     (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
4244                     wiphy_ext_feature_isset(local->hw.wiphy,
4245                                             NL80211_EXT_FEATURE_PROTECTED_TWT))
4246                         bss_conf->twt_protected = true;
4247                 else
4248                         bss_conf->twt_protected = false;
4249
4250                 *changed |= ieee80211_recalc_twt_req(sdata, sband, link,
4251                                                      link_sta, elems);
4252
4253                 if (elems->eht_operation && elems->eht_cap &&
4254                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
4255                         ieee80211_eht_cap_ie_to_sta_eht_cap(sdata, sband,
4256                                                             elems->he_cap,
4257                                                             elems->he_cap_len,
4258                                                             elems->eht_cap,
4259                                                             elems->eht_cap_len,
4260                                                             link_sta);
4261
4262                         bss_conf->eht_support = link_sta->pub->eht_cap.has_eht;
4263                         *changed |= BSS_CHANGED_EHT_PUNCTURING;
4264                 } else {
4265                         bss_conf->eht_support = false;
4266                 }
4267         } else {
4268                 bss_conf->he_support = false;
4269                 bss_conf->twt_requester = false;
4270                 bss_conf->twt_protected = false;
4271                 bss_conf->eht_support = false;
4272         }
4273
4274         bss_conf->twt_broadcast =
4275                 ieee80211_twt_bcast_support(sdata, bss_conf, sband, link_sta);
4276
4277         if (bss_conf->he_support) {
4278                 bss_conf->he_bss_color.color =
4279                         le32_get_bits(elems->he_operation->he_oper_params,
4280                                       IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
4281                 bss_conf->he_bss_color.partial =
4282                         le32_get_bits(elems->he_operation->he_oper_params,
4283                                       IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
4284                 bss_conf->he_bss_color.enabled =
4285                         !le32_get_bits(elems->he_operation->he_oper_params,
4286                                        IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
4287
4288                 if (bss_conf->he_bss_color.enabled)
4289                         *changed |= BSS_CHANGED_HE_BSS_COLOR;
4290
4291                 bss_conf->htc_trig_based_pkt_ext =
4292                         le32_get_bits(elems->he_operation->he_oper_params,
4293                                       IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
4294                 bss_conf->frame_time_rts_th =
4295                         le32_get_bits(elems->he_operation->he_oper_params,
4296                                       IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
4297
4298                 bss_conf->uora_exists = !!elems->uora_element;
4299                 if (elems->uora_element)
4300                         bss_conf->uora_ocw_range = elems->uora_element[0];
4301
4302                 ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
4303                 ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
4304                 /* TODO: OPEN: what happens if BSS color disable is set? */
4305         }
4306
4307         if (cbss->transmitted_bss) {
4308                 bss_conf->nontransmitted = true;
4309                 ether_addr_copy(bss_conf->transmitter_bssid,
4310                                 cbss->transmitted_bss->bssid);
4311                 bss_conf->bssid_indicator = cbss->max_bssid_indicator;
4312                 bss_conf->bssid_index = cbss->bssid_index;
4313         }
4314
4315         /*
4316          * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
4317          * in their association response, so ignore that data for our own
4318          * configuration. If it changed since the last beacon, we'll get the
4319          * next beacon and update then.
4320          */
4321
4322         /*
4323          * If an operating mode notification IE is present, override the
4324          * NSS calculation (that would be done in rate_control_rate_init())
4325          * and use the # of streams from that element.
4326          */
4327         if (elems->opmode_notif &&
4328             !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
4329                 u8 nss;
4330
4331                 nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
4332                 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
4333                 nss += 1;
4334                 link_sta->pub->rx_nss = nss;
4335         }
4336
4337         /*
4338          * Always handle WMM once after association regardless
4339          * of the first value the AP uses. Setting -1 here has
4340          * that effect because the AP values is an unsigned
4341          * 4-bit value.
4342          */
4343         link->u.mgd.wmm_last_param_set = -1;
4344         link->u.mgd.mu_edca_last_param_set = -1;
4345
4346         if (link->u.mgd.disable_wmm_tracking) {
4347                 ieee80211_set_wmm_default(link, false, false);
4348         } else if (!ieee80211_sta_wmm_params(local, link, elems->wmm_param,
4349                                              elems->wmm_param_len,
4350                                              elems->mu_edca_param_set)) {
4351                 /* still enable QoS since we might have HT/VHT */
4352                 ieee80211_set_wmm_default(link, false, true);
4353                 /* disable WMM tracking in this case to disable
4354                  * tracking WMM parameter changes in the beacon if
4355                  * the parameters weren't actually valid. Doing so
4356                  * avoids changing parameters very strangely when
4357                  * the AP is going back and forth between valid and
4358                  * invalid parameters.
4359                  */
4360                 link->u.mgd.disable_wmm_tracking = true;
4361         }
4362
4363         if (elems->max_idle_period_ie) {
4364                 bss_conf->max_idle_period =
4365                         le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
4366                 bss_conf->protected_keep_alive =
4367                         !!(elems->max_idle_period_ie->idle_options &
4368                            WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
4369                 *changed |= BSS_CHANGED_KEEP_ALIVE;
4370         } else {
4371                 bss_conf->max_idle_period = 0;
4372                 bss_conf->protected_keep_alive = false;
4373         }
4374
4375         /* set assoc capability (AID was already set earlier),
4376          * ieee80211_set_associated() will tell the driver */
4377         bss_conf->assoc_capability = capab_info;
4378
4379         ret = true;
4380 out:
4381         kfree(elems);
4382         kfree(bss_ies);
4383         return ret;
4384 }
4385
4386 static int ieee80211_mgd_setup_link_sta(struct ieee80211_link_data *link,
4387                                         struct sta_info *sta,
4388                                         struct link_sta_info *link_sta,
4389                                         struct cfg80211_bss *cbss)
4390 {
4391         struct ieee80211_sub_if_data *sdata = link->sdata;
4392         struct ieee80211_local *local = sdata->local;
4393         struct ieee80211_bss *bss = (void *)cbss->priv;
4394         u32 rates = 0, basic_rates = 0;
4395         bool have_higher_than_11mbit = false;
4396         int min_rate = INT_MAX, min_rate_index = -1;
4397         /* this is clearly wrong for MLO but we'll just remove it later */
4398         int shift = ieee80211_vif_get_shift(&sdata->vif);
4399         struct ieee80211_supported_band *sband;
4400
4401         memcpy(link_sta->addr, cbss->bssid, ETH_ALEN);
4402         memcpy(link_sta->pub->addr, cbss->bssid, ETH_ALEN);
4403
4404         /* TODO: S1G Basic Rate Set is expressed elsewhere */
4405         if (cbss->channel->band == NL80211_BAND_S1GHZ) {
4406                 ieee80211_s1g_sta_rate_init(sta);
4407                 return 0;
4408         }
4409
4410         sband = local->hw.wiphy->bands[cbss->channel->band];
4411
4412         ieee80211_get_rates(sband, bss->supp_rates, bss->supp_rates_len,
4413                             &rates, &basic_rates, &have_higher_than_11mbit,
4414                             &min_rate, &min_rate_index, shift);
4415
4416         /*
4417          * This used to be a workaround for basic rates missing
4418          * in the association response frame. Now that we no
4419          * longer use the basic rates from there, it probably
4420          * doesn't happen any more, but keep the workaround so
4421          * in case some *other* APs are buggy in different ways
4422          * we can connect -- with a warning.
4423          * Allow this workaround only in case the AP provided at least
4424          * one rate.
4425          */
4426         if (min_rate_index < 0) {
4427                 link_info(link, "No legacy rates in association response\n");
4428                 return -EINVAL;
4429         } else if (!basic_rates) {
4430                 link_info(link, "No basic rates, using min rate instead\n");
4431                 basic_rates = BIT(min_rate_index);
4432         }
4433
4434         if (rates)
4435                 link_sta->pub->supp_rates[cbss->channel->band] = rates;
4436         else
4437                 link_info(link, "No rates found, keeping mandatory only\n");
4438
4439         link->conf->basic_rates = basic_rates;
4440
4441         /* cf. IEEE 802.11 9.2.12 */
4442         link->operating_11g_mode = sband->band == NL80211_BAND_2GHZ &&
4443                                    have_higher_than_11mbit;
4444
4445         return 0;
4446 }
4447
4448 static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
4449                                   struct cfg80211_bss *cbss)
4450 {
4451         struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
4452         const struct element *ht_cap_elem, *vht_cap_elem;
4453         const struct cfg80211_bss_ies *ies;
4454         const struct ieee80211_ht_cap *ht_cap;
4455         const struct ieee80211_vht_cap *vht_cap;
4456         const struct ieee80211_he_cap_elem *he_cap;
4457         const struct element *he_cap_elem;
4458         u16 mcs_80_map, mcs_160_map;
4459         int i, mcs_nss_size;
4460         bool support_160;
4461         u8 chains = 1;
4462
4463         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)
4464                 return chains;
4465
4466         ht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_CAPABILITY);
4467         if (ht_cap_elem && ht_cap_elem->datalen >= sizeof(*ht_cap)) {
4468                 ht_cap = (void *)ht_cap_elem->data;
4469                 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
4470                 /*
4471                  * TODO: use "Tx Maximum Number Spatial Streams Supported" and
4472                  *       "Tx Unequal Modulation Supported" fields.
4473                  */
4474         }
4475
4476         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
4477                 return chains;
4478
4479         vht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
4480         if (vht_cap_elem && vht_cap_elem->datalen >= sizeof(*vht_cap)) {
4481                 u8 nss;
4482                 u16 tx_mcs_map;
4483
4484                 vht_cap = (void *)vht_cap_elem->data;
4485                 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
4486                 for (nss = 8; nss > 0; nss--) {
4487                         if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
4488                                         IEEE80211_VHT_MCS_NOT_SUPPORTED)
4489                                 break;
4490                 }
4491                 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
4492                 chains = max(chains, nss);
4493         }
4494
4495         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE)
4496                 return chains;
4497
4498         ies = rcu_dereference(cbss->ies);
4499         he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
4500                                              ies->data, ies->len);
4501
4502         if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
4503                 return chains;
4504
4505         /* skip one byte ext_tag_id */
4506         he_cap = (void *)(he_cap_elem->data + 1);
4507         mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
4508
4509         /* invalid HE IE */
4510         if (he_cap_elem->datalen < 1 + mcs_nss_size + sizeof(*he_cap))
4511                 return chains;
4512
4513         /* mcs_nss is right after he_cap info */
4514         he_mcs_nss_supp = (void *)(he_cap + 1);
4515
4516         mcs_80_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
4517
4518         for (i = 7; i >= 0; i--) {
4519                 u8 mcs_80 = mcs_80_map >> (2 * i) & 3;
4520
4521                 if (mcs_80 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4522                         chains = max_t(u8, chains, i + 1);
4523                         break;
4524                 }
4525         }
4526
4527         support_160 = he_cap->phy_cap_info[0] &
4528                       IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
4529
4530         if (!support_160)
4531                 return chains;
4532
4533         mcs_160_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_160);
4534         for (i = 7; i >= 0; i--) {
4535                 u8 mcs_160 = mcs_160_map >> (2 * i) & 3;
4536
4537                 if (mcs_160 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4538                         chains = max_t(u8, chains, i + 1);
4539                         break;
4540                 }
4541         }
4542
4543         return chains;
4544 }
4545
4546 static bool
4547 ieee80211_verify_peer_he_mcs_support(struct ieee80211_sub_if_data *sdata,
4548                                      const struct cfg80211_bss_ies *ies,
4549                                      const struct ieee80211_he_operation *he_op)
4550 {
4551         const struct element *he_cap_elem;
4552         const struct ieee80211_he_cap_elem *he_cap;
4553         struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
4554         u16 mcs_80_map_tx, mcs_80_map_rx;
4555         u16 ap_min_req_set;
4556         int mcs_nss_size;
4557         int nss;
4558
4559         he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
4560                                              ies->data, ies->len);
4561
4562         if (!he_cap_elem)
4563                 return false;
4564
4565         /* invalid HE IE */
4566         if (he_cap_elem->datalen < 1 + sizeof(*he_cap)) {
4567                 sdata_info(sdata,
4568                            "Invalid HE elem, Disable HE\n");
4569                 return false;
4570         }
4571
4572         /* skip one byte ext_tag_id */
4573         he_cap = (void *)(he_cap_elem->data + 1);
4574         mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
4575
4576         /* invalid HE IE */
4577         if (he_cap_elem->datalen < 1 + sizeof(*he_cap) + mcs_nss_size) {
4578                 sdata_info(sdata,
4579                            "Invalid HE elem with nss size, Disable HE\n");
4580                 return false;
4581         }
4582
4583         /* mcs_nss is right after he_cap info */
4584         he_mcs_nss_supp = (void *)(he_cap + 1);
4585
4586         mcs_80_map_tx = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
4587         mcs_80_map_rx = le16_to_cpu(he_mcs_nss_supp->rx_mcs_80);
4588
4589         /* P802.11-REVme/D0.3
4590          * 27.1.1 Introduction to the HE PHY
4591          * ...
4592          * An HE STA shall support the following features:
4593          * ...
4594          * Single spatial stream HE-MCSs 0 to 7 (transmit and receive) in all
4595          * supported channel widths for HE SU PPDUs
4596          */
4597         if ((mcs_80_map_tx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4598             (mcs_80_map_rx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED) {
4599                 sdata_info(sdata,
4600                            "Missing mandatory rates for 1 Nss, rx 0x%x, tx 0x%x, disable HE\n",
4601                            mcs_80_map_tx, mcs_80_map_rx);
4602                 return false;
4603         }
4604
4605         if (!he_op)
4606                 return true;
4607
4608         ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
4609
4610         /*
4611          * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
4612          * zeroes, which is nonsense, and completely inconsistent with itself
4613          * (it doesn't have 8 streams). Accept the settings in this case anyway.
4614          */
4615         if (!ap_min_req_set)
4616                 return true;
4617
4618         /* make sure the AP is consistent with itself
4619          *
4620          * P802.11-REVme/D0.3
4621          * 26.17.1 Basic HE BSS operation
4622          *
4623          * A STA that is operating in an HE BSS shall be able to receive and
4624          * transmit at each of the <HE-MCS, NSS> tuple values indicated by the
4625          * Basic HE-MCS And NSS Set field of the HE Operation parameter of the
4626          * MLME-START.request primitive and shall be able to receive at each of
4627          * the <HE-MCS, NSS> tuple values indicated by the Supported HE-MCS and
4628          * NSS Set field in the HE Capabilities parameter of the MLMESTART.request
4629          * primitive
4630          */
4631         for (nss = 8; nss > 0; nss--) {
4632                 u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
4633                 u8 ap_rx_val;
4634                 u8 ap_tx_val;
4635
4636                 if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
4637                         continue;
4638
4639                 ap_rx_val = (mcs_80_map_rx >> (2 * (nss - 1))) & 3;
4640                 ap_tx_val = (mcs_80_map_tx >> (2 * (nss - 1))) & 3;
4641
4642                 if (ap_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4643                     ap_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4644                     ap_rx_val < ap_op_val || ap_tx_val < ap_op_val) {
4645                         sdata_info(sdata,
4646                                    "Invalid rates for %d Nss, rx %d, tx %d oper %d, disable HE\n",
4647                                    nss, ap_rx_val, ap_rx_val, ap_op_val);
4648                         return false;
4649                 }
4650         }
4651
4652         return true;
4653 }
4654
4655 static bool
4656 ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
4657                                     struct ieee80211_supported_band *sband,
4658                                     const struct ieee80211_he_operation *he_op)
4659 {
4660         const struct ieee80211_sta_he_cap *sta_he_cap =
4661                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
4662         u16 ap_min_req_set;
4663         int i;
4664
4665         if (!sta_he_cap || !he_op)
4666                 return false;
4667
4668         ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
4669
4670         /*
4671          * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
4672          * zeroes, which is nonsense, and completely inconsistent with itself
4673          * (it doesn't have 8 streams). Accept the settings in this case anyway.
4674          */
4675         if (!ap_min_req_set)
4676                 return true;
4677
4678         /* Need to go over for 80MHz, 160MHz and for 80+80 */
4679         for (i = 0; i < 3; i++) {
4680                 const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
4681                         &sta_he_cap->he_mcs_nss_supp;
4682                 u16 sta_mcs_map_rx =
4683                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
4684                 u16 sta_mcs_map_tx =
4685                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
4686                 u8 nss;
4687                 bool verified = true;
4688
4689                 /*
4690                  * For each band there is a maximum of 8 spatial streams
4691                  * possible. Each of the sta_mcs_map_* is a 16-bit struct built
4692                  * of 2 bits per NSS (1-8), with the values defined in enum
4693                  * ieee80211_he_mcs_support. Need to make sure STA TX and RX
4694                  * capabilities aren't less than the AP's minimum requirements
4695                  * for this HE BSS per SS.
4696                  * It is enough to find one such band that meets the reqs.
4697                  */
4698                 for (nss = 8; nss > 0; nss--) {
4699                         u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
4700                         u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
4701                         u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
4702
4703                         if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
4704                                 continue;
4705
4706                         /*
4707                          * Make sure the HE AP doesn't require MCSs that aren't
4708                          * supported by the client as required by spec
4709                          *
4710                          * P802.11-REVme/D0.3
4711                          * 26.17.1 Basic HE BSS operation
4712                          *
4713                          * An HE STA shall not attempt to join * (MLME-JOIN.request primitive)
4714                          * a BSS, unless it supports (i.e., is able to both transmit and
4715                          * receive using) all of the <HE-MCS, NSS> tuples in the basic
4716                          * HE-MCS and NSS set.
4717                          */
4718                         if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4719                             sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4720                             (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
4721                                 verified = false;
4722                                 break;
4723                         }
4724                 }
4725
4726                 if (verified)
4727                         return true;
4728         }
4729
4730         /* If here, STA doesn't meet AP's HE min requirements */
4731         return false;
4732 }
4733
4734 static u8
4735 ieee80211_get_eht_cap_mcs_nss(const struct ieee80211_sta_he_cap *sta_he_cap,
4736                               const struct ieee80211_sta_eht_cap *sta_eht_cap,
4737                               unsigned int idx, int bw)
4738 {
4739         u8 he_phy_cap0 = sta_he_cap->he_cap_elem.phy_cap_info[0];
4740         u8 eht_phy_cap0 = sta_eht_cap->eht_cap_elem.phy_cap_info[0];
4741
4742         /* handle us being a 20 MHz-only EHT STA - with four values
4743          * for MCS 0-7, 8-9, 10-11, 12-13.
4744          */
4745         if (!(he_phy_cap0 & IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK_ALL))
4746                 return sta_eht_cap->eht_mcs_nss_supp.only_20mhz.rx_tx_max_nss[idx];
4747
4748         /* the others have MCS 0-9 together, rather than separately from 0-7 */
4749         if (idx > 0)
4750                 idx--;
4751
4752         switch (bw) {
4753         case 0:
4754                 return sta_eht_cap->eht_mcs_nss_supp.bw._80.rx_tx_max_nss[idx];
4755         case 1:
4756                 if (!(he_phy_cap0 &
4757                       (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4758                        IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)))
4759                         return 0xff; /* pass check */
4760                 return sta_eht_cap->eht_mcs_nss_supp.bw._160.rx_tx_max_nss[idx];
4761         case 2:
4762                 if (!(eht_phy_cap0 & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ))
4763                         return 0xff; /* pass check */
4764                 return sta_eht_cap->eht_mcs_nss_supp.bw._320.rx_tx_max_nss[idx];
4765         }
4766
4767         WARN_ON(1);
4768         return 0;
4769 }
4770
4771 static bool
4772 ieee80211_verify_sta_eht_mcs_support(struct ieee80211_sub_if_data *sdata,
4773                                      struct ieee80211_supported_band *sband,
4774                                      const struct ieee80211_eht_operation *eht_op)
4775 {
4776         const struct ieee80211_sta_he_cap *sta_he_cap =
4777                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
4778         const struct ieee80211_sta_eht_cap *sta_eht_cap =
4779                 ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
4780         const struct ieee80211_eht_mcs_nss_supp_20mhz_only *req;
4781         unsigned int i;
4782
4783         if (!sta_he_cap || !sta_eht_cap || !eht_op)
4784                 return false;
4785
4786         req = &eht_op->basic_mcs_nss;
4787
4788         for (i = 0; i < ARRAY_SIZE(req->rx_tx_max_nss); i++) {
4789                 u8 req_rx_nss, req_tx_nss;
4790                 unsigned int bw;
4791
4792                 req_rx_nss = u8_get_bits(req->rx_tx_max_nss[i],
4793                                          IEEE80211_EHT_MCS_NSS_RX);
4794                 req_tx_nss = u8_get_bits(req->rx_tx_max_nss[i],
4795                                          IEEE80211_EHT_MCS_NSS_TX);
4796
4797                 for (bw = 0; bw < 3; bw++) {
4798                         u8 have, have_rx_nss, have_tx_nss;
4799
4800                         have = ieee80211_get_eht_cap_mcs_nss(sta_he_cap,
4801                                                              sta_eht_cap,
4802                                                              i, bw);
4803                         have_rx_nss = u8_get_bits(have,
4804                                                   IEEE80211_EHT_MCS_NSS_RX);
4805                         have_tx_nss = u8_get_bits(have,
4806                                                   IEEE80211_EHT_MCS_NSS_TX);
4807
4808                         if (req_rx_nss > have_rx_nss ||
4809                             req_tx_nss > have_tx_nss)
4810                                 return false;
4811                 }
4812         }
4813
4814         return true;
4815 }
4816
4817 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
4818                                   struct ieee80211_link_data *link,
4819                                   struct cfg80211_bss *cbss,
4820                                   ieee80211_conn_flags_t *conn_flags)
4821 {
4822         struct ieee80211_local *local = sdata->local;
4823         const struct ieee80211_ht_cap *ht_cap = NULL;
4824         const struct ieee80211_ht_operation *ht_oper = NULL;
4825         const struct ieee80211_vht_operation *vht_oper = NULL;
4826         const struct ieee80211_he_operation *he_oper = NULL;
4827         const struct ieee80211_eht_operation *eht_oper = NULL;
4828         const struct ieee80211_s1g_oper_ie *s1g_oper = NULL;
4829         struct ieee80211_supported_band *sband;
4830         struct cfg80211_chan_def chandef;
4831         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4832         bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
4833         struct ieee80211_bss *bss = (void *)cbss->priv;
4834         struct ieee80211_elems_parse_params parse_params = {
4835                 .link_id = -1,
4836                 .from_ap = true,
4837         };
4838         struct ieee802_11_elems *elems;
4839         const struct cfg80211_bss_ies *ies;
4840         int ret;
4841         u32 i;
4842         bool have_80mhz;
4843
4844         rcu_read_lock();
4845
4846         ies = rcu_dereference(cbss->ies);
4847         parse_params.start = ies->data;
4848         parse_params.len = ies->len;
4849         elems = ieee802_11_parse_elems_full(&parse_params);
4850         if (!elems) {
4851                 rcu_read_unlock();
4852                 return -ENOMEM;
4853         }
4854
4855         sband = local->hw.wiphy->bands[cbss->channel->band];
4856
4857         *conn_flags &= ~(IEEE80211_CONN_DISABLE_40MHZ |
4858                          IEEE80211_CONN_DISABLE_80P80MHZ |
4859                          IEEE80211_CONN_DISABLE_160MHZ);
4860
4861         /* disable HT/VHT/HE if we don't support them */
4862         if (!sband->ht_cap.ht_supported && !is_6ghz) {
4863                 mlme_dbg(sdata, "HT not supported, disabling HT/VHT/HE/EHT\n");
4864                 *conn_flags |= IEEE80211_CONN_DISABLE_HT;
4865                 *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4866                 *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4867                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4868         }
4869
4870         if (!sband->vht_cap.vht_supported && is_5ghz) {
4871                 mlme_dbg(sdata, "VHT not supported, disabling VHT/HE/EHT\n");
4872                 *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4873                 *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4874                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4875         }
4876
4877         if (!ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif)) {
4878                 mlme_dbg(sdata, "HE not supported, disabling HE and EHT\n");
4879                 *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4880                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4881         }
4882
4883         if (!ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif)) {
4884                 mlme_dbg(sdata, "EHT not supported, disabling EHT\n");
4885                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4886         }
4887
4888         if (!(*conn_flags & IEEE80211_CONN_DISABLE_HT) && !is_6ghz) {
4889                 ht_oper = elems->ht_operation;
4890                 ht_cap = elems->ht_cap_elem;
4891
4892                 if (!ht_cap) {
4893                         *conn_flags |= IEEE80211_CONN_DISABLE_HT;
4894                         ht_oper = NULL;
4895                 }
4896         }
4897
4898         if (!(*conn_flags & IEEE80211_CONN_DISABLE_VHT) && !is_6ghz) {
4899                 vht_oper = elems->vht_operation;
4900                 if (vht_oper && !ht_oper) {
4901                         vht_oper = NULL;
4902                         sdata_info(sdata,
4903                                    "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4904                         *conn_flags |= IEEE80211_CONN_DISABLE_HT;
4905                         *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4906                         *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4907                         *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4908                 }
4909
4910                 if (!elems->vht_cap_elem) {
4911                         *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4912                         vht_oper = NULL;
4913                 }
4914         }
4915
4916         if (!(*conn_flags & IEEE80211_CONN_DISABLE_HE)) {
4917                 he_oper = elems->he_operation;
4918
4919                 if (link && is_6ghz) {
4920                         struct ieee80211_bss_conf *bss_conf;
4921                         u8 j = 0;
4922
4923                         bss_conf = link->conf;
4924
4925                         if (elems->pwr_constr_elem)
4926                                 bss_conf->pwr_reduction = *elems->pwr_constr_elem;
4927
4928                         BUILD_BUG_ON(ARRAY_SIZE(bss_conf->tx_pwr_env) !=
4929                                      ARRAY_SIZE(elems->tx_pwr_env));
4930
4931                         for (i = 0; i < elems->tx_pwr_env_num; i++) {
4932                                 if (elems->tx_pwr_env_len[i] >
4933                                     sizeof(bss_conf->tx_pwr_env[j]))
4934                                         continue;
4935
4936                                 bss_conf->tx_pwr_env_num++;
4937                                 memcpy(&bss_conf->tx_pwr_env[j], elems->tx_pwr_env[i],
4938                                        elems->tx_pwr_env_len[i]);
4939                                 j++;
4940                         }
4941                 }
4942
4943                 if (!ieee80211_verify_peer_he_mcs_support(sdata, ies, he_oper) ||
4944                     !ieee80211_verify_sta_he_mcs_support(sdata, sband, he_oper))
4945                         *conn_flags |= IEEE80211_CONN_DISABLE_HE |
4946                                        IEEE80211_CONN_DISABLE_EHT;
4947         }
4948
4949         /*
4950          * EHT requires HE to be supported as well. Specifically for 6 GHz
4951          * channels, the operation channel information can only be deduced from
4952          * both the 6 GHz operation information (from the HE operation IE) and
4953          * EHT operation.
4954          */
4955         if (!(*conn_flags &
4956                         (IEEE80211_CONN_DISABLE_HE |
4957                          IEEE80211_CONN_DISABLE_EHT)) &&
4958             he_oper) {
4959                 const struct cfg80211_bss_ies *cbss_ies;
4960                 const struct element *eht_ml_elem;
4961                 const u8 *eht_oper_ie;
4962
4963                 cbss_ies = rcu_dereference(cbss->ies);
4964                 eht_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_EHT_OPERATION,
4965                                                    cbss_ies->data, cbss_ies->len);
4966                 if (eht_oper_ie && eht_oper_ie[1] >=
4967                     1 + sizeof(struct ieee80211_eht_operation))
4968                         eht_oper = (void *)(eht_oper_ie + 3);
4969                 else
4970                         eht_oper = NULL;
4971
4972                 if (!ieee80211_verify_sta_eht_mcs_support(sdata, sband, eht_oper))
4973                         *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4974
4975                 eht_ml_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_MULTI_LINK,
4976                                                      cbss_ies->data, cbss_ies->len);
4977
4978                 /* data + 1 / datalen - 1 since it's an extended element */
4979                 if (!(*conn_flags & IEEE80211_CONN_DISABLE_EHT) &&
4980                     eht_ml_elem &&
4981                     ieee80211_mle_type_ok(eht_ml_elem->data + 1,
4982                                           IEEE80211_ML_CONTROL_TYPE_BASIC,
4983                                           eht_ml_elem->datalen - 1)) {
4984                         sdata->vif.cfg.eml_cap =
4985                                 ieee80211_mle_get_eml_cap(eht_ml_elem->data + 1);
4986                         sdata->vif.cfg.eml_med_sync_delay =
4987                                 ieee80211_mle_get_eml_med_sync_delay(eht_ml_elem->data + 1);
4988                 }
4989         }
4990
4991         /* Allow VHT if at least one channel on the sband supports 80 MHz */
4992         have_80mhz = false;
4993         for (i = 0; i < sband->n_channels; i++) {
4994                 if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
4995                                                 IEEE80211_CHAN_NO_80MHZ))
4996                         continue;
4997
4998                 have_80mhz = true;
4999                 break;
5000         }
5001
5002         if (!have_80mhz) {
5003                 sdata_info(sdata, "80 MHz not supported, disabling VHT\n");
5004                 *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
5005         }
5006
5007         if (sband->band == NL80211_BAND_S1GHZ) {
5008                 s1g_oper = elems->s1g_oper;
5009                 if (!s1g_oper)
5010                         sdata_info(sdata,
5011                                    "AP missing S1G operation element?\n");
5012         }
5013
5014         *conn_flags |=
5015                 ieee80211_determine_chantype(sdata, link, *conn_flags,
5016                                              sband,
5017                                              cbss->channel,
5018                                              bss->vht_cap_info,
5019                                              ht_oper, vht_oper,
5020                                              he_oper, eht_oper,
5021                                              s1g_oper,
5022                                              &chandef, false);
5023
5024         if (link)
5025                 link->needed_rx_chains =
5026                         min(ieee80211_max_rx_chains(link, cbss),
5027                             local->rx_chains);
5028
5029         rcu_read_unlock();
5030         /* the element data was RCU protected so no longer valid anyway */
5031         kfree(elems);
5032         elems = NULL;
5033
5034         if (*conn_flags & IEEE80211_CONN_DISABLE_HE && is_6ghz) {
5035                 sdata_info(sdata, "Rejecting non-HE 6/7 GHz connection");
5036                 return -EINVAL;
5037         }
5038
5039         if (!link)
5040                 return 0;
5041
5042         /* will change later if needed */
5043         link->smps_mode = IEEE80211_SMPS_OFF;
5044
5045         mutex_lock(&local->mtx);
5046         /*
5047          * If this fails (possibly due to channel context sharing
5048          * on incompatible channels, e.g. 80+80 and 160 sharing the
5049          * same control channel) try to use a smaller bandwidth.
5050          */
5051         ret = ieee80211_link_use_channel(link, &chandef,
5052                                          IEEE80211_CHANCTX_SHARED);
5053
5054         /* don't downgrade for 5 and 10 MHz channels, though. */
5055         if (chandef.width == NL80211_CHAN_WIDTH_5 ||
5056             chandef.width == NL80211_CHAN_WIDTH_10)
5057                 goto out;
5058
5059         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
5060                 *conn_flags |=
5061                         ieee80211_chandef_downgrade(&chandef);
5062                 ret = ieee80211_link_use_channel(link, &chandef,
5063                                                  IEEE80211_CHANCTX_SHARED);
5064         }
5065  out:
5066         mutex_unlock(&local->mtx);
5067         return ret;
5068 }
5069
5070 static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
5071                                u8 *dtim_count, u8 *dtim_period)
5072 {
5073         const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
5074         const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
5075                                          ies->len);
5076         const struct ieee80211_tim_ie *tim = NULL;
5077         const struct ieee80211_bssid_index *idx;
5078         bool valid = tim_ie && tim_ie[1] >= 2;
5079
5080         if (valid)
5081                 tim = (void *)(tim_ie + 2);
5082
5083         if (dtim_count)
5084                 *dtim_count = valid ? tim->dtim_count : 0;
5085
5086         if (dtim_period)
5087                 *dtim_period = valid ? tim->dtim_period : 0;
5088
5089         /* Check if value is overridden by non-transmitted profile */
5090         if (!idx_ie || idx_ie[1] < 3)
5091                 return valid;
5092
5093         idx = (void *)(idx_ie + 2);
5094
5095         if (dtim_count)
5096                 *dtim_count = idx->dtim_count;
5097
5098         if (dtim_period)
5099                 *dtim_period = idx->dtim_period;
5100
5101         return true;
5102 }
5103
5104 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
5105                                     struct ieee80211_mgmt *mgmt,
5106                                     struct ieee802_11_elems *elems,
5107                                     const u8 *elem_start, unsigned int elem_len)
5108 {
5109         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5110         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
5111         struct ieee80211_local *local = sdata->local;
5112         unsigned int link_id;
5113         struct sta_info *sta;
5114         u64 changed[IEEE80211_MLD_MAX_NUM_LINKS] = {};
5115         u16 valid_links = 0, dormant_links = 0;
5116         int err;
5117
5118         mutex_lock(&sdata->local->sta_mtx);
5119         /*
5120          * station info was already allocated and inserted before
5121          * the association and should be available to us
5122          */
5123         sta = sta_info_get(sdata, assoc_data->ap_addr);
5124         if (WARN_ON(!sta))
5125                 goto out_err;
5126
5127         if (ieee80211_vif_is_mld(&sdata->vif)) {
5128                 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5129                         if (!assoc_data->link[link_id].bss)
5130                                 continue;
5131
5132                         valid_links |= BIT(link_id);
5133                         if (assoc_data->link[link_id].disabled)
5134                                 dormant_links |= BIT(link_id);
5135
5136                         if (link_id != assoc_data->assoc_link_id) {
5137                                 err = ieee80211_sta_allocate_link(sta, link_id);
5138                                 if (err)
5139                                         goto out_err;
5140                         }
5141                 }
5142
5143                 ieee80211_vif_set_links(sdata, valid_links, dormant_links);
5144         }
5145
5146         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5147                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
5148                 struct ieee80211_link_data *link;
5149                 struct link_sta_info *link_sta;
5150
5151                 if (!cbss)
5152                         continue;
5153
5154                 link = sdata_dereference(sdata->link[link_id], sdata);
5155                 if (WARN_ON(!link))
5156                         goto out_err;
5157
5158                 if (ieee80211_vif_is_mld(&sdata->vif))
5159                         link_info(link,
5160                                   "local address %pM, AP link address %pM%s\n",
5161                                   link->conf->addr,
5162                                   assoc_data->link[link_id].bss->bssid,
5163                                   link_id == assoc_data->assoc_link_id ?
5164                                         " (assoc)" : "");
5165
5166                 link_sta = rcu_dereference_protected(sta->link[link_id],
5167                                                      lockdep_is_held(&local->sta_mtx));
5168                 if (WARN_ON(!link_sta))
5169                         goto out_err;
5170
5171                 if (!link->u.mgd.have_beacon) {
5172                         const struct cfg80211_bss_ies *ies;
5173
5174                         rcu_read_lock();
5175                         ies = rcu_dereference(cbss->beacon_ies);
5176                         if (ies)
5177                                 link->u.mgd.have_beacon = true;
5178                         else
5179                                 ies = rcu_dereference(cbss->ies);
5180                         ieee80211_get_dtim(ies,
5181                                            &link->conf->sync_dtim_count,
5182                                            &link->u.mgd.dtim_period);
5183                         link->conf->beacon_int = cbss->beacon_interval;
5184                         rcu_read_unlock();
5185                 }
5186
5187                 link->conf->dtim_period = link->u.mgd.dtim_period ?: 1;
5188
5189                 if (link_id != assoc_data->assoc_link_id) {
5190                         err = ieee80211_prep_channel(sdata, link, cbss,
5191                                                      &link->u.mgd.conn_flags);
5192                         if (err) {
5193                                 link_info(link, "prep_channel failed\n");
5194                                 goto out_err;
5195                         }
5196                 }
5197
5198                 err = ieee80211_mgd_setup_link_sta(link, sta, link_sta,
5199                                                    assoc_data->link[link_id].bss);
5200                 if (err)
5201                         goto out_err;
5202
5203                 if (!ieee80211_assoc_config_link(link, link_sta,
5204                                                  assoc_data->link[link_id].bss,
5205                                                  mgmt, elem_start, elem_len,
5206                                                  &changed[link_id]))
5207                         goto out_err;
5208
5209                 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
5210                         valid_links &= ~BIT(link_id);
5211                         ieee80211_sta_remove_link(sta, link_id);
5212                         continue;
5213                 }
5214
5215                 if (link_id != assoc_data->assoc_link_id) {
5216                         err = ieee80211_sta_activate_link(sta, link_id);
5217                         if (err)
5218                                 goto out_err;
5219                 }
5220         }
5221
5222         /* links might have changed due to rejected ones, set them again */
5223         ieee80211_vif_set_links(sdata, valid_links, dormant_links);
5224
5225         rate_control_rate_init(sta);
5226
5227         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
5228                 set_sta_flag(sta, WLAN_STA_MFP);
5229                 sta->sta.mfp = true;
5230         } else {
5231                 sta->sta.mfp = false;
5232         }
5233
5234         ieee80211_sta_set_max_amsdu_subframes(sta, elems->ext_capab,
5235                                               elems->ext_capab_len);
5236
5237         sta->sta.wme = (elems->wmm_param || elems->s1g_capab) &&
5238                        local->hw.queues >= IEEE80211_NUM_ACS;
5239
5240         err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
5241         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
5242                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
5243         if (err) {
5244                 sdata_info(sdata,
5245                            "failed to move station %pM to desired state\n",
5246                            sta->sta.addr);
5247                 WARN_ON(__sta_info_destroy(sta));
5248                 goto out_err;
5249         }
5250
5251         if (sdata->wdev.use_4addr)
5252                 drv_sta_set_4addr(local, sdata, &sta->sta, true);
5253
5254         mutex_unlock(&sdata->local->sta_mtx);
5255
5256         ieee80211_set_associated(sdata, assoc_data, changed);
5257
5258         /*
5259          * If we're using 4-addr mode, let the AP know that we're
5260          * doing so, so that it can create the STA VLAN on its side
5261          */
5262         if (ifmgd->use_4addr)
5263                 ieee80211_send_4addr_nullfunc(local, sdata);
5264
5265         /*
5266          * Start timer to probe the connection to the AP now.
5267          * Also start the timer that will detect beacon loss.
5268          */
5269         ieee80211_sta_reset_beacon_monitor(sdata);
5270         ieee80211_sta_reset_conn_monitor(sdata);
5271
5272         return true;
5273 out_err:
5274         eth_zero_addr(sdata->vif.cfg.ap_addr);
5275         mutex_unlock(&sdata->local->sta_mtx);
5276         return false;
5277 }
5278
5279 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
5280                                          struct ieee80211_mgmt *mgmt,
5281                                          size_t len)
5282 {
5283         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5284         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
5285         u16 capab_info, status_code, aid;
5286         struct ieee80211_elems_parse_params parse_params = {
5287                 .bss = NULL,
5288                 .link_id = -1,
5289                 .from_ap = true,
5290         };
5291         struct ieee802_11_elems *elems;
5292         int ac;
5293         const u8 *elem_start;
5294         unsigned int elem_len;
5295         bool reassoc;
5296         struct ieee80211_event event = {
5297                 .type = MLME_EVENT,
5298                 .u.mlme.data = ASSOC_EVENT,
5299         };
5300         struct ieee80211_prep_tx_info info = {};
5301         struct cfg80211_rx_assoc_resp resp = {
5302                 .uapsd_queues = -1,
5303         };
5304         u8 ap_mld_addr[ETH_ALEN] __aligned(2);
5305         unsigned int link_id;
5306
5307         sdata_assert_lock(sdata);
5308
5309         if (!assoc_data)
5310                 return;
5311
5312         if (!ether_addr_equal(assoc_data->ap_addr, mgmt->bssid) ||
5313             !ether_addr_equal(assoc_data->ap_addr, mgmt->sa))
5314                 return;
5315
5316         /*
5317          * AssocResp and ReassocResp have identical structure, so process both
5318          * of them in this function.
5319          */
5320
5321         if (len < 24 + 6)
5322                 return;
5323
5324         reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
5325         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
5326         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
5327         if (assoc_data->s1g)
5328                 elem_start = mgmt->u.s1g_assoc_resp.variable;
5329         else
5330                 elem_start = mgmt->u.assoc_resp.variable;
5331
5332         /*
5333          * Note: this may not be perfect, AP might misbehave - if
5334          * anyone needs to rely on perfect complete notification
5335          * with the exact right subtype, then we need to track what
5336          * we actually transmitted.
5337          */
5338         info.subtype = reassoc ? IEEE80211_STYPE_REASSOC_REQ :
5339                                  IEEE80211_STYPE_ASSOC_REQ;
5340
5341         if (assoc_data->fils_kek_len &&
5342             fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
5343                 return;
5344
5345         elem_len = len - (elem_start - (u8 *)mgmt);
5346         parse_params.start = elem_start;
5347         parse_params.len = elem_len;
5348         elems = ieee802_11_parse_elems_full(&parse_params);
5349         if (!elems)
5350                 goto notify_driver;
5351
5352         if (elems->aid_resp)
5353                 aid = le16_to_cpu(elems->aid_resp->aid);
5354         else if (assoc_data->s1g)
5355                 aid = 0; /* TODO */
5356         else
5357                 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
5358
5359         /*
5360          * The 5 MSB of the AID field are reserved
5361          * (802.11-2016 9.4.1.8 AID field)
5362          */
5363         aid &= 0x7ff;
5364
5365         sdata_info(sdata,
5366                    "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
5367                    reassoc ? "Rea" : "A", assoc_data->ap_addr,
5368                    capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
5369
5370         ifmgd->broken_ap = false;
5371
5372         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
5373             elems->timeout_int &&
5374             elems->timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
5375                 u32 tu, ms;
5376
5377                 cfg80211_assoc_comeback(sdata->dev, assoc_data->ap_addr,
5378                                         le32_to_cpu(elems->timeout_int->value));
5379
5380                 tu = le32_to_cpu(elems->timeout_int->value);
5381                 ms = tu * 1024 / 1000;
5382                 sdata_info(sdata,
5383                            "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
5384                            assoc_data->ap_addr, tu, ms);
5385                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
5386                 assoc_data->timeout_started = true;
5387                 if (ms > IEEE80211_ASSOC_TIMEOUT)
5388                         run_again(sdata, assoc_data->timeout);
5389                 goto notify_driver;
5390         }
5391
5392         if (status_code != WLAN_STATUS_SUCCESS) {
5393                 sdata_info(sdata, "%pM denied association (code=%d)\n",
5394                            assoc_data->ap_addr, status_code);
5395                 event.u.mlme.status = MLME_DENIED;
5396                 event.u.mlme.reason = status_code;
5397                 drv_event_callback(sdata->local, sdata, &event);
5398         } else {
5399                 if (aid == 0 || aid > IEEE80211_MAX_AID) {
5400                         sdata_info(sdata,
5401                                    "invalid AID value %d (out of range), turn off PS\n",
5402                                    aid);
5403                         aid = 0;
5404                         ifmgd->broken_ap = true;
5405                 }
5406
5407                 if (ieee80211_vif_is_mld(&sdata->vif)) {
5408                         if (!elems->ml_basic) {
5409                                 sdata_info(sdata,
5410                                            "MLO association with %pM but no multi-link element in response!\n",
5411                                            assoc_data->ap_addr);
5412                                 goto abandon_assoc;
5413                         }
5414
5415                         if (le16_get_bits(elems->ml_basic->control,
5416                                           IEEE80211_ML_CONTROL_TYPE) !=
5417                                         IEEE80211_ML_CONTROL_TYPE_BASIC) {
5418                                 sdata_info(sdata,
5419                                            "bad multi-link element (control=0x%x)\n",
5420                                            le16_to_cpu(elems->ml_basic->control));
5421                                 goto abandon_assoc;
5422                         } else {
5423                                 struct ieee80211_mle_basic_common_info *common;
5424
5425                                 common = (void *)elems->ml_basic->variable;
5426
5427                                 if (memcmp(assoc_data->ap_addr,
5428                                            common->mld_mac_addr, ETH_ALEN)) {
5429                                         sdata_info(sdata,
5430                                                    "AP MLD MAC address mismatch: got %pM expected %pM\n",
5431                                                    common->mld_mac_addr,
5432                                                    assoc_data->ap_addr);
5433                                         goto abandon_assoc;
5434                                 }
5435                         }
5436                 }
5437
5438                 sdata->vif.cfg.aid = aid;
5439
5440                 if (!ieee80211_assoc_success(sdata, mgmt, elems,
5441                                              elem_start, elem_len)) {
5442                         /* oops -- internal error -- send timeout for now */
5443                         ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
5444                         goto notify_driver;
5445                 }
5446                 event.u.mlme.status = MLME_SUCCESS;
5447                 drv_event_callback(sdata->local, sdata, &event);
5448                 sdata_info(sdata, "associated\n");
5449
5450                 info.success = 1;
5451         }
5452
5453         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5454                 struct ieee80211_link_data *link;
5455
5456                 if (!assoc_data->link[link_id].bss)
5457                         continue;
5458
5459                 resp.links[link_id].bss = assoc_data->link[link_id].bss;
5460                 ether_addr_copy(resp.links[link_id].addr,
5461                                 assoc_data->link[link_id].addr);
5462                 resp.links[link_id].status = assoc_data->link[link_id].status;
5463
5464                 link = sdata_dereference(sdata->link[link_id], sdata);
5465                 if (!link)
5466                         continue;
5467
5468                 /* get uapsd queues configuration - same for all links */
5469                 resp.uapsd_queues = 0;
5470                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5471                         if (link->tx_conf[ac].uapsd)
5472                                 resp.uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
5473         }
5474
5475         if (ieee80211_vif_is_mld(&sdata->vif)) {
5476                 ether_addr_copy(ap_mld_addr, sdata->vif.cfg.ap_addr);
5477                 resp.ap_mld_addr = ap_mld_addr;
5478         }
5479
5480         ieee80211_destroy_assoc_data(sdata,
5481                                      status_code == WLAN_STATUS_SUCCESS ?
5482                                         ASSOC_SUCCESS :
5483                                         ASSOC_REJECTED);
5484
5485         resp.buf = (u8 *)mgmt;
5486         resp.len = len;
5487         resp.req_ies = ifmgd->assoc_req_ies;
5488         resp.req_ies_len = ifmgd->assoc_req_ies_len;
5489         cfg80211_rx_assoc_resp(sdata->dev, &resp);
5490 notify_driver:
5491         drv_mgd_complete_tx(sdata->local, sdata, &info);
5492         kfree(elems);
5493         return;
5494 abandon_assoc:
5495         ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
5496         goto notify_driver;
5497 }
5498
5499 static void ieee80211_rx_bss_info(struct ieee80211_link_data *link,
5500                                   struct ieee80211_mgmt *mgmt, size_t len,
5501                                   struct ieee80211_rx_status *rx_status)
5502 {
5503         struct ieee80211_sub_if_data *sdata = link->sdata;
5504         struct ieee80211_local *local = sdata->local;
5505         struct ieee80211_bss *bss;
5506         struct ieee80211_channel *channel;
5507
5508         sdata_assert_lock(sdata);
5509
5510         channel = ieee80211_get_channel_khz(local->hw.wiphy,
5511                                         ieee80211_rx_status_to_khz(rx_status));
5512         if (!channel)
5513                 return;
5514
5515         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
5516         if (bss) {
5517                 link->conf->beacon_rate = bss->beacon_rate;
5518                 ieee80211_rx_bss_put(local, bss);
5519         }
5520 }
5521
5522
5523 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_link_data *link,
5524                                          struct sk_buff *skb)
5525 {
5526         struct ieee80211_sub_if_data *sdata = link->sdata;
5527         struct ieee80211_mgmt *mgmt = (void *)skb->data;
5528         struct ieee80211_if_managed *ifmgd;
5529         struct ieee80211_rx_status *rx_status = (void *) skb->cb;
5530         struct ieee80211_channel *channel;
5531         size_t baselen, len = skb->len;
5532
5533         ifmgd = &sdata->u.mgd;
5534
5535         sdata_assert_lock(sdata);
5536
5537         /*
5538          * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
5539          * "If a 6 GHz AP receives a Probe Request frame  and responds with
5540          * a Probe Response frame [..], the Address 1 field of the Probe
5541          * Response frame shall be set to the broadcast address [..]"
5542          * So, on 6GHz band we should also accept broadcast responses.
5543          */
5544         channel = ieee80211_get_channel(sdata->local->hw.wiphy,
5545                                         rx_status->freq);
5546         if (!channel)
5547                 return;
5548
5549         if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
5550             (channel->band != NL80211_BAND_6GHZ ||
5551              !is_broadcast_ether_addr(mgmt->da)))
5552                 return; /* ignore ProbeResp to foreign address */
5553
5554         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
5555         if (baselen > len)
5556                 return;
5557
5558         ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5559
5560         if (ifmgd->associated &&
5561             ether_addr_equal(mgmt->bssid, link->u.mgd.bssid))
5562                 ieee80211_reset_ap_probe(sdata);
5563 }
5564
5565 /*
5566  * This is the canonical list of information elements we care about,
5567  * the filter code also gives us all changes to the Microsoft OUI
5568  * (00:50:F2) vendor IE which is used for WMM which we need to track,
5569  * as well as the DTPC IE (part of the Cisco OUI) used for signaling
5570  * changes to requested client power.
5571  *
5572  * We implement beacon filtering in software since that means we can
5573  * avoid processing the frame here and in cfg80211, and userspace
5574  * will not be able to tell whether the hardware supports it or not.
5575  *
5576  * XXX: This list needs to be dynamic -- userspace needs to be able to
5577  *      add items it requires. It also needs to be able to tell us to
5578  *      look out for other vendor IEs.
5579  */
5580 static const u64 care_about_ies =
5581         (1ULL << WLAN_EID_COUNTRY) |
5582         (1ULL << WLAN_EID_ERP_INFO) |
5583         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
5584         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
5585         (1ULL << WLAN_EID_HT_CAPABILITY) |
5586         (1ULL << WLAN_EID_HT_OPERATION) |
5587         (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
5588
5589 static void ieee80211_handle_beacon_sig(struct ieee80211_link_data *link,
5590                                         struct ieee80211_if_managed *ifmgd,
5591                                         struct ieee80211_bss_conf *bss_conf,
5592                                         struct ieee80211_local *local,
5593                                         struct ieee80211_rx_status *rx_status)
5594 {
5595         struct ieee80211_sub_if_data *sdata = link->sdata;
5596
5597         /* Track average RSSI from the Beacon frames of the current AP */
5598
5599         if (!link->u.mgd.tracking_signal_avg) {
5600                 link->u.mgd.tracking_signal_avg = true;
5601                 ewma_beacon_signal_init(&link->u.mgd.ave_beacon_signal);
5602                 link->u.mgd.last_cqm_event_signal = 0;
5603                 link->u.mgd.count_beacon_signal = 1;
5604                 link->u.mgd.last_ave_beacon_signal = 0;
5605         } else {
5606                 link->u.mgd.count_beacon_signal++;
5607         }
5608
5609         ewma_beacon_signal_add(&link->u.mgd.ave_beacon_signal,
5610                                -rx_status->signal);
5611
5612         if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
5613             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5614                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5615                 int last_sig = link->u.mgd.last_ave_beacon_signal;
5616                 struct ieee80211_event event = {
5617                         .type = RSSI_EVENT,
5618                 };
5619
5620                 /*
5621                  * if signal crosses either of the boundaries, invoke callback
5622                  * with appropriate parameters
5623                  */
5624                 if (sig > ifmgd->rssi_max_thold &&
5625                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
5626                         link->u.mgd.last_ave_beacon_signal = sig;
5627                         event.u.rssi.data = RSSI_EVENT_HIGH;
5628                         drv_event_callback(local, sdata, &event);
5629                 } else if (sig < ifmgd->rssi_min_thold &&
5630                            (last_sig >= ifmgd->rssi_max_thold ||
5631                            last_sig == 0)) {
5632                         link->u.mgd.last_ave_beacon_signal = sig;
5633                         event.u.rssi.data = RSSI_EVENT_LOW;
5634                         drv_event_callback(local, sdata, &event);
5635                 }
5636         }
5637
5638         if (bss_conf->cqm_rssi_thold &&
5639             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
5640             !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
5641                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5642                 int last_event = link->u.mgd.last_cqm_event_signal;
5643                 int thold = bss_conf->cqm_rssi_thold;
5644                 int hyst = bss_conf->cqm_rssi_hyst;
5645
5646                 if (sig < thold &&
5647                     (last_event == 0 || sig < last_event - hyst)) {
5648                         link->u.mgd.last_cqm_event_signal = sig;
5649                         ieee80211_cqm_rssi_notify(
5650                                 &sdata->vif,
5651                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5652                                 sig, GFP_KERNEL);
5653                 } else if (sig > thold &&
5654                            (last_event == 0 || sig > last_event + hyst)) {
5655                         link->u.mgd.last_cqm_event_signal = sig;
5656                         ieee80211_cqm_rssi_notify(
5657                                 &sdata->vif,
5658                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5659                                 sig, GFP_KERNEL);
5660                 }
5661         }
5662
5663         if (bss_conf->cqm_rssi_low &&
5664             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5665                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5666                 int last_event = link->u.mgd.last_cqm_event_signal;
5667                 int low = bss_conf->cqm_rssi_low;
5668                 int high = bss_conf->cqm_rssi_high;
5669
5670                 if (sig < low &&
5671                     (last_event == 0 || last_event >= low)) {
5672                         link->u.mgd.last_cqm_event_signal = sig;
5673                         ieee80211_cqm_rssi_notify(
5674                                 &sdata->vif,
5675                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5676                                 sig, GFP_KERNEL);
5677                 } else if (sig > high &&
5678                            (last_event == 0 || last_event <= high)) {
5679                         link->u.mgd.last_cqm_event_signal = sig;
5680                         ieee80211_cqm_rssi_notify(
5681                                 &sdata->vif,
5682                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5683                                 sig, GFP_KERNEL);
5684                 }
5685         }
5686 }
5687
5688 static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
5689                                     struct cfg80211_bss *bss)
5690 {
5691         if (ether_addr_equal(tx_bssid, bss->bssid))
5692                 return true;
5693         if (!bss->transmitted_bss)
5694                 return false;
5695         return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
5696 }
5697
5698 static bool ieee80211_config_puncturing(struct ieee80211_link_data *link,
5699                                         const struct ieee80211_eht_operation *eht_oper,
5700                                         u64 *changed)
5701 {
5702         u16 bitmap = 0, extracted;
5703
5704         if ((eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
5705             (eht_oper->params &
5706              IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
5707                 const struct ieee80211_eht_operation_info *info =
5708                         (void *)eht_oper->optional;
5709                 const u8 *disable_subchannel_bitmap = info->optional;
5710
5711                 bitmap = get_unaligned_le16(disable_subchannel_bitmap);
5712         }
5713
5714         extracted = ieee80211_extract_dis_subch_bmap(eht_oper,
5715                                                      &link->conf->chandef,
5716                                                      bitmap);
5717
5718         /* accept if there are no changes */
5719         if (!(*changed & BSS_CHANGED_BANDWIDTH) &&
5720             extracted == link->conf->eht_puncturing)
5721                 return true;
5722
5723         if (!cfg80211_valid_disable_subchannel_bitmap(&bitmap,
5724                                                       &link->conf->chandef)) {
5725                 link_info(link,
5726                           "Got an invalid disable subchannel bitmap from AP %pM: bitmap = 0x%x, bw = 0x%x. disconnect\n",
5727                           link->u.mgd.bssid,
5728                           bitmap,
5729                           link->conf->chandef.width);
5730                 return false;
5731         }
5732
5733         ieee80211_handle_puncturing_bitmap(link, eht_oper, bitmap, changed);
5734         return true;
5735 }
5736
5737 static void ieee80211_ml_reconf_work(struct wiphy *wiphy,
5738                                      struct wiphy_work *work)
5739 {
5740         struct ieee80211_sub_if_data *sdata =
5741                 container_of(work, struct ieee80211_sub_if_data,
5742                              u.mgd.ml_reconf_work.work);
5743         u16 new_valid_links, new_active_links, new_dormant_links;
5744         int ret;
5745
5746         sdata_lock(sdata);
5747         if (!sdata->u.mgd.removed_links) {
5748                 sdata_unlock(sdata);
5749                 return;
5750         }
5751
5752         sdata_info(sdata,
5753                    "MLO Reconfiguration: work: valid=0x%x, removed=0x%x\n",
5754                    sdata->vif.valid_links, sdata->u.mgd.removed_links);
5755
5756         new_valid_links = sdata->vif.valid_links & ~sdata->u.mgd.removed_links;
5757         if (new_valid_links == sdata->vif.valid_links) {
5758                 sdata_unlock(sdata);
5759                 return;
5760         }
5761
5762         if (!new_valid_links ||
5763             !(new_valid_links & ~sdata->vif.dormant_links)) {
5764                 sdata_info(sdata, "No valid links after reconfiguration\n");
5765                 ret = -EINVAL;
5766                 goto out;
5767         }
5768
5769         new_active_links = sdata->vif.active_links & ~sdata->u.mgd.removed_links;
5770         if (new_active_links != sdata->vif.active_links) {
5771                 if (!new_active_links)
5772                         new_active_links =
5773                                 BIT(ffs(new_valid_links &
5774                                         ~sdata->vif.dormant_links) - 1);
5775
5776                 ret = __ieee80211_set_active_links(&sdata->vif,
5777                                                    new_active_links);
5778                 if (ret) {
5779                         sdata_info(sdata,
5780                                    "Failed setting active links\n");
5781                         goto out;
5782                 }
5783         }
5784
5785         new_dormant_links = sdata->vif.dormant_links & ~sdata->u.mgd.removed_links;
5786
5787         ret = ieee80211_vif_set_links(sdata, new_valid_links,
5788                                       new_dormant_links);
5789         if (ret)
5790                 sdata_info(sdata, "Failed setting valid links\n");
5791
5792 out:
5793         if (!ret)
5794                 cfg80211_links_removed(sdata->dev, sdata->u.mgd.removed_links);
5795         else
5796                 ___ieee80211_disconnect(sdata);
5797
5798         sdata->u.mgd.removed_links = 0;
5799
5800         sdata_unlock(sdata);
5801 }
5802
5803 static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,
5804                                          struct ieee802_11_elems *elems)
5805 {
5806         const struct ieee80211_multi_link_elem *ml;
5807         const struct element *sub;
5808         size_t ml_len;
5809         unsigned long removed_links = 0;
5810         u16 link_removal_timeout[IEEE80211_MLD_MAX_NUM_LINKS] = {};
5811         u8 link_id;
5812         u32 delay;
5813
5814         if (!ieee80211_vif_is_mld(&sdata->vif) || !elems->ml_reconf)
5815                 return;
5816
5817         ml_len = cfg80211_defragment_element(elems->ml_reconf_elem,
5818                                              elems->ie_start,
5819                                              elems->total_len,
5820                                              elems->scratch_pos,
5821                                              elems->scratch + elems->scratch_len -
5822                                              elems->scratch_pos,
5823                                              WLAN_EID_FRAGMENT);
5824
5825         elems->ml_reconf = (const void *)elems->scratch_pos;
5826         elems->ml_reconf_len = ml_len;
5827         ml = elems->ml_reconf;
5828
5829         /* Directly parse the sub elements as the common information doesn't
5830          * hold any useful information.
5831          */
5832         for_each_mle_subelement(sub, (u8 *)ml, ml_len) {
5833                 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
5834                 u8 *pos = prof->variable;
5835                 u16 control;
5836
5837                 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
5838                         continue;
5839
5840                 if (!ieee80211_mle_reconf_sta_prof_size_ok(sub->data,
5841                                                            sub->datalen))
5842                         return;
5843
5844                 control = le16_to_cpu(prof->control);
5845                 link_id = control & IEEE80211_MLE_STA_RECONF_CONTROL_LINK_ID;
5846
5847                 removed_links |= BIT(link_id);
5848
5849                 /* the MAC address should not be included, but handle it */
5850                 if (control &
5851                     IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT)
5852                         pos += 6;
5853
5854                 /* According to Draft P802.11be_D3.0, the control should
5855                  * include the AP Removal Timer present. If the AP Removal Timer
5856                  * is not present assume immediate removal.
5857                  */
5858                 if (control &
5859                     IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT)
5860                         link_removal_timeout[link_id] = le16_to_cpu(*(__le16 *)pos);
5861         }
5862
5863         removed_links &= sdata->vif.valid_links;
5864         if (!removed_links) {
5865                 /* In case the removal was cancelled, abort it */
5866                 if (sdata->u.mgd.removed_links) {
5867                         sdata->u.mgd.removed_links = 0;
5868                         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
5869                                                   &sdata->u.mgd.ml_reconf_work);
5870                 }
5871                 return;
5872         }
5873
5874         delay = 0;
5875         for_each_set_bit(link_id, &removed_links, IEEE80211_MLD_MAX_NUM_LINKS) {
5876                 struct ieee80211_bss_conf *link_conf =
5877                         sdata_dereference(sdata->vif.link_conf[link_id], sdata);
5878                 u32 link_delay;
5879
5880                 if (!link_conf) {
5881                         removed_links &= ~BIT(link_id);
5882                         continue;
5883                 }
5884
5885                 link_delay = link_conf->beacon_int *
5886                         link_removal_timeout[link_id];
5887
5888                 if (!delay)
5889                         delay = link_delay;
5890                 else
5891                         delay = min(delay, link_delay);
5892         }
5893
5894         sdata->u.mgd.removed_links = removed_links;
5895         wiphy_delayed_work_queue(sdata->local->hw.wiphy,
5896                                  &sdata->u.mgd.ml_reconf_work,
5897                                  TU_TO_JIFFIES(delay));
5898 }
5899
5900 static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
5901                                      struct ieee80211_hdr *hdr, size_t len,
5902                                      struct ieee80211_rx_status *rx_status)
5903 {
5904         struct ieee80211_sub_if_data *sdata = link->sdata;
5905         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5906         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
5907         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
5908         struct ieee80211_mgmt *mgmt = (void *) hdr;
5909         size_t baselen;
5910         struct ieee802_11_elems *elems;
5911         struct ieee80211_local *local = sdata->local;
5912         struct ieee80211_chanctx_conf *chanctx_conf;
5913         struct ieee80211_supported_band *sband;
5914         struct ieee80211_channel *chan;
5915         struct link_sta_info *link_sta;
5916         struct sta_info *sta;
5917         u64 changed = 0;
5918         bool erp_valid;
5919         u8 erp_value = 0;
5920         u32 ncrc = 0;
5921         u8 *bssid, *variable = mgmt->u.beacon.variable;
5922         u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
5923         struct ieee80211_elems_parse_params parse_params = {
5924                 .link_id = -1,
5925                 .from_ap = true,
5926         };
5927
5928         sdata_assert_lock(sdata);
5929
5930         /* Process beacon from the current BSS */
5931         bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
5932         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
5933                 struct ieee80211_ext *ext = (void *) mgmt;
5934
5935                 if (ieee80211_is_s1g_short_beacon(ext->frame_control))
5936                         variable = ext->u.s1g_short_beacon.variable;
5937                 else
5938                         variable = ext->u.s1g_beacon.variable;
5939         }
5940
5941         baselen = (u8 *) variable - (u8 *) mgmt;
5942         if (baselen > len)
5943                 return;
5944
5945         parse_params.start = variable;
5946         parse_params.len = len - baselen;
5947
5948         rcu_read_lock();
5949         chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
5950         if (!chanctx_conf) {
5951                 rcu_read_unlock();
5952                 return;
5953         }
5954
5955         if (ieee80211_rx_status_to_khz(rx_status) !=
5956             ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
5957                 rcu_read_unlock();
5958                 return;
5959         }
5960         chan = chanctx_conf->def.chan;
5961         rcu_read_unlock();
5962
5963         if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
5964             !WARN_ON(ieee80211_vif_is_mld(&sdata->vif)) &&
5965             ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) {
5966                 parse_params.bss = ifmgd->assoc_data->link[0].bss;
5967                 elems = ieee802_11_parse_elems_full(&parse_params);
5968                 if (!elems)
5969                         return;
5970
5971                 ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5972
5973                 if (elems->dtim_period)
5974                         link->u.mgd.dtim_period = elems->dtim_period;
5975                 link->u.mgd.have_beacon = true;
5976                 ifmgd->assoc_data->need_beacon = false;
5977                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5978                         link->conf->sync_tsf =
5979                                 le64_to_cpu(mgmt->u.beacon.timestamp);
5980                         link->conf->sync_device_ts =
5981                                 rx_status->device_timestamp;
5982                         link->conf->sync_dtim_count = elems->dtim_count;
5983                 }
5984
5985                 if (elems->mbssid_config_ie)
5986                         bss_conf->profile_periodicity =
5987                                 elems->mbssid_config_ie->profile_periodicity;
5988                 else
5989                         bss_conf->profile_periodicity = 0;
5990
5991                 if (elems->ext_capab_len >= 11 &&
5992                     (elems->ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
5993                         bss_conf->ema_ap = true;
5994                 else
5995                         bss_conf->ema_ap = false;
5996
5997                 /* continue assoc process */
5998                 ifmgd->assoc_data->timeout = jiffies;
5999                 ifmgd->assoc_data->timeout_started = true;
6000                 run_again(sdata, ifmgd->assoc_data->timeout);
6001                 kfree(elems);
6002                 return;
6003         }
6004
6005         if (!ifmgd->associated ||
6006             !ieee80211_rx_our_beacon(bssid, link->u.mgd.bss))
6007                 return;
6008         bssid = link->u.mgd.bssid;
6009
6010         if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
6011                 ieee80211_handle_beacon_sig(link, ifmgd, bss_conf,
6012                                             local, rx_status);
6013
6014         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
6015                 mlme_dbg_ratelimited(sdata,
6016                                      "cancelling AP probe due to a received beacon\n");
6017                 ieee80211_reset_ap_probe(sdata);
6018         }
6019
6020         /*
6021          * Push the beacon loss detection into the future since
6022          * we are processing a beacon from the AP just now.
6023          */
6024         ieee80211_sta_reset_beacon_monitor(sdata);
6025
6026         /* TODO: CRC urrently not calculated on S1G Beacon Compatibility
6027          * element (which carries the beacon interval). Don't forget to add a
6028          * bit to care_about_ies[] above if mac80211 is interested in a
6029          * changing S1G element.
6030          */
6031         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
6032                 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
6033         parse_params.bss = link->u.mgd.bss;
6034         parse_params.filter = care_about_ies;
6035         parse_params.crc = ncrc;
6036         elems = ieee802_11_parse_elems_full(&parse_params);
6037         if (!elems)
6038                 return;
6039         ncrc = elems->crc;
6040
6041         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
6042             ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid)) {
6043                 if (local->hw.conf.dynamic_ps_timeout > 0) {
6044                         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
6045                                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
6046                                 ieee80211_hw_config(local,
6047                                                     IEEE80211_CONF_CHANGE_PS);
6048                         }
6049                         ieee80211_send_nullfunc(local, sdata, false);
6050                 } else if (!local->pspolling && sdata->u.mgd.powersave) {
6051                         local->pspolling = true;
6052
6053                         /*
6054                          * Here is assumed that the driver will be
6055                          * able to send ps-poll frame and receive a
6056                          * response even though power save mode is
6057                          * enabled, but some drivers might require
6058                          * to disable power save here. This needs
6059                          * to be investigated.
6060                          */
6061                         ieee80211_send_pspoll(local, sdata);
6062                 }
6063         }
6064
6065         if (sdata->vif.p2p ||
6066             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
6067                 struct ieee80211_p2p_noa_attr noa = {};
6068                 int ret;
6069
6070                 ret = cfg80211_get_p2p_attr(variable,
6071                                             len - baselen,
6072                                             IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
6073                                             (u8 *) &noa, sizeof(noa));
6074                 if (ret >= 2) {
6075                         if (link->u.mgd.p2p_noa_index != noa.index) {
6076                                 /* valid noa_attr and index changed */
6077                                 link->u.mgd.p2p_noa_index = noa.index;
6078                                 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
6079                                 changed |= BSS_CHANGED_P2P_PS;
6080                                 /*
6081                                  * make sure we update all information, the CRC
6082                                  * mechanism doesn't look at P2P attributes.
6083                                  */
6084                                 link->u.mgd.beacon_crc_valid = false;
6085                         }
6086                 } else if (link->u.mgd.p2p_noa_index != -1) {
6087                         /* noa_attr not found and we had valid noa_attr before */
6088                         link->u.mgd.p2p_noa_index = -1;
6089                         memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
6090                         changed |= BSS_CHANGED_P2P_PS;
6091                         link->u.mgd.beacon_crc_valid = false;
6092                 }
6093         }
6094
6095         if (link->u.mgd.csa_waiting_bcn)
6096                 ieee80211_chswitch_post_beacon(link);
6097
6098         /*
6099          * Update beacon timing and dtim count on every beacon appearance. This
6100          * will allow the driver to use the most updated values. Do it before
6101          * comparing this one with last received beacon.
6102          * IMPORTANT: These parameters would possibly be out of sync by the time
6103          * the driver will use them. The synchronized view is currently
6104          * guaranteed only in certain callbacks.
6105          */
6106         if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
6107             !ieee80211_is_s1g_beacon(hdr->frame_control)) {
6108                 link->conf->sync_tsf =
6109                         le64_to_cpu(mgmt->u.beacon.timestamp);
6110                 link->conf->sync_device_ts =
6111                         rx_status->device_timestamp;
6112                 link->conf->sync_dtim_count = elems->dtim_count;
6113         }
6114
6115         if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) ||
6116             ieee80211_is_s1g_short_beacon(mgmt->frame_control))
6117                 goto free;
6118         link->u.mgd.beacon_crc = ncrc;
6119         link->u.mgd.beacon_crc_valid = true;
6120
6121         ieee80211_rx_bss_info(link, mgmt, len, rx_status);
6122
6123         ieee80211_sta_process_chanswitch(link, rx_status->mactime,
6124                                          rx_status->device_timestamp,
6125                                          elems, true);
6126
6127         if (!link->u.mgd.disable_wmm_tracking &&
6128             ieee80211_sta_wmm_params(local, link, elems->wmm_param,
6129                                      elems->wmm_param_len,
6130                                      elems->mu_edca_param_set))
6131                 changed |= BSS_CHANGED_QOS;
6132
6133         /*
6134          * If we haven't had a beacon before, tell the driver about the
6135          * DTIM period (and beacon timing if desired) now.
6136          */
6137         if (!link->u.mgd.have_beacon) {
6138                 /* a few bogus AP send dtim_period = 0 or no TIM IE */
6139                 bss_conf->dtim_period = elems->dtim_period ?: 1;
6140
6141                 changed |= BSS_CHANGED_BEACON_INFO;
6142                 link->u.mgd.have_beacon = true;
6143
6144                 mutex_lock(&local->iflist_mtx);
6145                 ieee80211_recalc_ps(local);
6146                 mutex_unlock(&local->iflist_mtx);
6147
6148                 ieee80211_recalc_ps_vif(sdata);
6149         }
6150
6151         if (elems->erp_info) {
6152                 erp_valid = true;
6153                 erp_value = elems->erp_info[0];
6154         } else {
6155                 erp_valid = false;
6156         }
6157
6158         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
6159                 changed |= ieee80211_handle_bss_capability(link,
6160                                 le16_to_cpu(mgmt->u.beacon.capab_info),
6161                                 erp_valid, erp_value);
6162
6163         mutex_lock(&local->sta_mtx);
6164         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
6165         if (WARN_ON(!sta)) {
6166                 mutex_unlock(&local->sta_mtx);
6167                 goto free;
6168         }
6169         link_sta = rcu_dereference_protected(sta->link[link->link_id],
6170                                              lockdep_is_held(&local->sta_mtx));
6171         if (WARN_ON(!link_sta)) {
6172                 mutex_unlock(&local->sta_mtx);
6173                 goto free;
6174         }
6175
6176         if (WARN_ON(!link->conf->chandef.chan))
6177                 goto free;
6178
6179         sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
6180
6181         changed |= ieee80211_recalc_twt_req(sdata, sband, link, link_sta, elems);
6182
6183         if (ieee80211_config_bw(link, elems->ht_cap_elem,
6184                                 elems->vht_cap_elem, elems->ht_operation,
6185                                 elems->vht_operation, elems->he_operation,
6186                                 elems->eht_operation,
6187                                 elems->s1g_oper, bssid, &changed)) {
6188                 mutex_unlock(&local->sta_mtx);
6189                 sdata_info(sdata,
6190                            "failed to follow AP %pM bandwidth change, disconnect\n",
6191                            bssid);
6192                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
6193                                        WLAN_REASON_DEAUTH_LEAVING,
6194                                        true, deauth_buf);
6195                 ieee80211_report_disconnect(sdata, deauth_buf,
6196                                             sizeof(deauth_buf), true,
6197                                             WLAN_REASON_DEAUTH_LEAVING,
6198                                             false);
6199                 goto free;
6200         }
6201
6202         if (elems->opmode_notif)
6203                 ieee80211_vht_handle_opmode(sdata, link_sta,
6204                                             *elems->opmode_notif,
6205                                             rx_status->band);
6206         mutex_unlock(&local->sta_mtx);
6207
6208         changed |= ieee80211_handle_pwr_constr(link, chan, mgmt,
6209                                                elems->country_elem,
6210                                                elems->country_elem_len,
6211                                                elems->pwr_constr_elem,
6212                                                elems->cisco_dtpc_elem);
6213
6214         if (elems->eht_operation &&
6215             !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
6216                 if (!ieee80211_config_puncturing(link, elems->eht_operation,
6217                                                  &changed)) {
6218                         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
6219                                                WLAN_REASON_DEAUTH_LEAVING,
6220                                                true, deauth_buf);
6221                         ieee80211_report_disconnect(sdata, deauth_buf,
6222                                                     sizeof(deauth_buf), true,
6223                                                     WLAN_REASON_DEAUTH_LEAVING,
6224                                                     false);
6225                         goto free;
6226                 }
6227         }
6228
6229         ieee80211_ml_reconfiguration(sdata, elems);
6230
6231         ieee80211_link_info_change_notify(sdata, link, changed);
6232 free:
6233         kfree(elems);
6234 }
6235
6236 void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
6237                                  struct sk_buff *skb)
6238 {
6239         struct ieee80211_link_data *link = &sdata->deflink;
6240         struct ieee80211_rx_status *rx_status;
6241         struct ieee80211_hdr *hdr;
6242         u16 fc;
6243
6244         rx_status = (struct ieee80211_rx_status *) skb->cb;
6245         hdr = (struct ieee80211_hdr *) skb->data;
6246         fc = le16_to_cpu(hdr->frame_control);
6247
6248         sdata_lock(sdata);
6249         switch (fc & IEEE80211_FCTL_STYPE) {
6250         case IEEE80211_STYPE_S1G_BEACON:
6251                 ieee80211_rx_mgmt_beacon(link, hdr, skb->len, rx_status);
6252                 break;
6253         }
6254         sdata_unlock(sdata);
6255 }
6256
6257 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
6258                                   struct sk_buff *skb)
6259 {
6260         struct ieee80211_link_data *link = &sdata->deflink;
6261         struct ieee80211_rx_status *rx_status;
6262         struct ieee80211_mgmt *mgmt;
6263         u16 fc;
6264         int ies_len;
6265
6266         rx_status = (struct ieee80211_rx_status *) skb->cb;
6267         mgmt = (struct ieee80211_mgmt *) skb->data;
6268         fc = le16_to_cpu(mgmt->frame_control);
6269
6270         sdata_lock(sdata);
6271
6272         if (rx_status->link_valid) {
6273                 link = sdata_dereference(sdata->link[rx_status->link_id],
6274                                          sdata);
6275                 if (!link)
6276                         goto out;
6277         }
6278
6279         switch (fc & IEEE80211_FCTL_STYPE) {
6280         case IEEE80211_STYPE_BEACON:
6281                 ieee80211_rx_mgmt_beacon(link, (void *)mgmt,
6282                                          skb->len, rx_status);
6283                 break;
6284         case IEEE80211_STYPE_PROBE_RESP:
6285                 ieee80211_rx_mgmt_probe_resp(link, skb);
6286                 break;
6287         case IEEE80211_STYPE_AUTH:
6288                 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
6289                 break;
6290         case IEEE80211_STYPE_DEAUTH:
6291                 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
6292                 break;
6293         case IEEE80211_STYPE_DISASSOC:
6294                 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
6295                 break;
6296         case IEEE80211_STYPE_ASSOC_RESP:
6297         case IEEE80211_STYPE_REASSOC_RESP:
6298                 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
6299                 break;
6300         case IEEE80211_STYPE_ACTION:
6301                 if (!sdata->u.mgd.associated ||
6302                     !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
6303                         break;
6304
6305                 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
6306                         struct ieee802_11_elems *elems;
6307
6308                         ies_len = skb->len -
6309                                   offsetof(struct ieee80211_mgmt,
6310                                            u.action.u.chan_switch.variable);
6311
6312                         if (ies_len < 0)
6313                                 break;
6314
6315                         /* CSA IE cannot be overridden, no need for BSSID */
6316                         elems = ieee802_11_parse_elems(
6317                                         mgmt->u.action.u.chan_switch.variable,
6318                                         ies_len, true, NULL);
6319
6320                         if (elems && !elems->parse_error)
6321                                 ieee80211_sta_process_chanswitch(link,
6322                                                                  rx_status->mactime,
6323                                                                  rx_status->device_timestamp,
6324                                                                  elems, false);
6325                         kfree(elems);
6326                 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
6327                         struct ieee802_11_elems *elems;
6328
6329                         ies_len = skb->len -
6330                                   offsetof(struct ieee80211_mgmt,
6331                                            u.action.u.ext_chan_switch.variable);
6332
6333                         if (ies_len < 0)
6334                                 break;
6335
6336                         /*
6337                          * extended CSA IE can't be overridden, no need for
6338                          * BSSID
6339                          */
6340                         elems = ieee802_11_parse_elems(
6341                                         mgmt->u.action.u.ext_chan_switch.variable,
6342                                         ies_len, true, NULL);
6343
6344                         if (elems && !elems->parse_error) {
6345                                 /* for the handling code pretend it was an IE */
6346                                 elems->ext_chansw_ie =
6347                                         &mgmt->u.action.u.ext_chan_switch.data;
6348
6349                                 ieee80211_sta_process_chanswitch(link,
6350                                                                  rx_status->mactime,
6351                                                                  rx_status->device_timestamp,
6352                                                                  elems, false);
6353                         }
6354
6355                         kfree(elems);
6356                 }
6357                 break;
6358         }
6359 out:
6360         sdata_unlock(sdata);
6361 }
6362
6363 static void ieee80211_sta_timer(struct timer_list *t)
6364 {
6365         struct ieee80211_sub_if_data *sdata =
6366                 from_timer(sdata, t, u.mgd.timer);
6367
6368         wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
6369 }
6370
6371 void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
6372                                    u8 reason, bool tx)
6373 {
6374         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6375
6376         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
6377                                tx, frame_buf);
6378
6379         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
6380                                     reason, false);
6381 }
6382
6383 static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
6384 {
6385         struct ieee80211_local *local = sdata->local;
6386         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6387         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
6388         u32 tx_flags = 0;
6389         u16 trans = 1;
6390         u16 status = 0;
6391         struct ieee80211_prep_tx_info info = {
6392                 .subtype = IEEE80211_STYPE_AUTH,
6393         };
6394
6395         sdata_assert_lock(sdata);
6396
6397         if (WARN_ON_ONCE(!auth_data))
6398                 return -EINVAL;
6399
6400         auth_data->tries++;
6401
6402         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
6403                 sdata_info(sdata, "authentication with %pM timed out\n",
6404                            auth_data->ap_addr);
6405
6406                 /*
6407                  * Most likely AP is not in the range so remove the
6408                  * bss struct for that AP.
6409                  */
6410                 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
6411
6412                 return -ETIMEDOUT;
6413         }
6414
6415         if (auth_data->algorithm == WLAN_AUTH_SAE)
6416                 info.duration = jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);
6417
6418         drv_mgd_prepare_tx(local, sdata, &info);
6419
6420         sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
6421                    auth_data->ap_addr, auth_data->tries,
6422                    IEEE80211_AUTH_MAX_TRIES);
6423
6424         auth_data->expected_transaction = 2;
6425
6426         if (auth_data->algorithm == WLAN_AUTH_SAE) {
6427                 trans = auth_data->sae_trans;
6428                 status = auth_data->sae_status;
6429                 auth_data->expected_transaction = trans;
6430         }
6431
6432         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
6433                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
6434                            IEEE80211_TX_INTFL_MLME_CONN_TX;
6435
6436         ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
6437                             auth_data->data, auth_data->data_len,
6438                             auth_data->ap_addr, auth_data->ap_addr,
6439                             NULL, 0, 0, tx_flags);
6440
6441         if (tx_flags == 0) {
6442                 if (auth_data->algorithm == WLAN_AUTH_SAE)
6443                         auth_data->timeout = jiffies +
6444                                 IEEE80211_AUTH_TIMEOUT_SAE;
6445                 else
6446                         auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
6447         } else {
6448                 auth_data->timeout =
6449                         round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
6450         }
6451
6452         auth_data->timeout_started = true;
6453         run_again(sdata, auth_data->timeout);
6454
6455         return 0;
6456 }
6457
6458 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
6459 {
6460         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
6461         struct ieee80211_local *local = sdata->local;
6462         int ret;
6463
6464         sdata_assert_lock(sdata);
6465
6466         assoc_data->tries++;
6467         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
6468                 sdata_info(sdata, "association with %pM timed out\n",
6469                            assoc_data->ap_addr);
6470
6471                 /*
6472                  * Most likely AP is not in the range so remove the
6473                  * bss struct for that AP.
6474                  */
6475                 cfg80211_unlink_bss(local->hw.wiphy,
6476                                     assoc_data->link[assoc_data->assoc_link_id].bss);
6477
6478                 return -ETIMEDOUT;
6479         }
6480
6481         sdata_info(sdata, "associate with %pM (try %d/%d)\n",
6482                    assoc_data->ap_addr, assoc_data->tries,
6483                    IEEE80211_ASSOC_MAX_TRIES);
6484         ret = ieee80211_send_assoc(sdata);
6485         if (ret)
6486                 return ret;
6487
6488         if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
6489                 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
6490                 assoc_data->timeout_started = true;
6491                 run_again(sdata, assoc_data->timeout);
6492         } else {
6493                 assoc_data->timeout =
6494                         round_jiffies_up(jiffies +
6495                                          IEEE80211_ASSOC_TIMEOUT_LONG);
6496                 assoc_data->timeout_started = true;
6497                 run_again(sdata, assoc_data->timeout);
6498         }
6499
6500         return 0;
6501 }
6502
6503 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
6504                                   __le16 fc, bool acked)
6505 {
6506         struct ieee80211_local *local = sdata->local;
6507
6508         sdata->u.mgd.status_fc = fc;
6509         sdata->u.mgd.status_acked = acked;
6510         sdata->u.mgd.status_received = true;
6511
6512         wiphy_work_queue(local->hw.wiphy, &sdata->work);
6513 }
6514
6515 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
6516 {
6517         struct ieee80211_local *local = sdata->local;
6518         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6519
6520         sdata_lock(sdata);
6521
6522         if (ifmgd->status_received) {
6523                 __le16 fc = ifmgd->status_fc;
6524                 bool status_acked = ifmgd->status_acked;
6525
6526                 ifmgd->status_received = false;
6527                 if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
6528                         if (status_acked) {
6529                                 if (ifmgd->auth_data->algorithm ==
6530                                     WLAN_AUTH_SAE)
6531                                         ifmgd->auth_data->timeout =
6532                                                 jiffies +
6533                                                 IEEE80211_AUTH_TIMEOUT_SAE;
6534                                 else
6535                                         ifmgd->auth_data->timeout =
6536                                                 jiffies +
6537                                                 IEEE80211_AUTH_TIMEOUT_SHORT;
6538                                 run_again(sdata, ifmgd->auth_data->timeout);
6539                         } else {
6540                                 ifmgd->auth_data->timeout = jiffies - 1;
6541                         }
6542                         ifmgd->auth_data->timeout_started = true;
6543                 } else if (ifmgd->assoc_data &&
6544                            (ieee80211_is_assoc_req(fc) ||
6545                             ieee80211_is_reassoc_req(fc))) {
6546                         if (status_acked) {
6547                                 ifmgd->assoc_data->timeout =
6548                                         jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
6549                                 run_again(sdata, ifmgd->assoc_data->timeout);
6550                         } else {
6551                                 ifmgd->assoc_data->timeout = jiffies - 1;
6552                         }
6553                         ifmgd->assoc_data->timeout_started = true;
6554                 }
6555         }
6556
6557         if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
6558             time_after(jiffies, ifmgd->auth_data->timeout)) {
6559                 if (ifmgd->auth_data->done || ifmgd->auth_data->waiting) {
6560                         /*
6561                          * ok ... we waited for assoc or continuation but
6562                          * userspace didn't do it, so kill the auth data
6563                          */
6564                         ieee80211_destroy_auth_data(sdata, false);
6565                 } else if (ieee80211_auth(sdata)) {
6566                         u8 ap_addr[ETH_ALEN];
6567                         struct ieee80211_event event = {
6568                                 .type = MLME_EVENT,
6569                                 .u.mlme.data = AUTH_EVENT,
6570                                 .u.mlme.status = MLME_TIMEOUT,
6571                         };
6572
6573                         memcpy(ap_addr, ifmgd->auth_data->ap_addr, ETH_ALEN);
6574
6575                         ieee80211_destroy_auth_data(sdata, false);
6576
6577                         cfg80211_auth_timeout(sdata->dev, ap_addr);
6578                         drv_event_callback(sdata->local, sdata, &event);
6579                 }
6580         } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
6581                 run_again(sdata, ifmgd->auth_data->timeout);
6582
6583         if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
6584             time_after(jiffies, ifmgd->assoc_data->timeout)) {
6585                 if ((ifmgd->assoc_data->need_beacon &&
6586                      !sdata->deflink.u.mgd.have_beacon) ||
6587                     ieee80211_do_assoc(sdata)) {
6588                         struct ieee80211_event event = {
6589                                 .type = MLME_EVENT,
6590                                 .u.mlme.data = ASSOC_EVENT,
6591                                 .u.mlme.status = MLME_TIMEOUT,
6592                         };
6593
6594                         ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
6595                         drv_event_callback(sdata->local, sdata, &event);
6596                 }
6597         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
6598                 run_again(sdata, ifmgd->assoc_data->timeout);
6599
6600         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
6601             ifmgd->associated) {
6602                 u8 *bssid = sdata->deflink.u.mgd.bssid;
6603                 int max_tries;
6604
6605                 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
6606                         max_tries = max_nullfunc_tries;
6607                 else
6608                         max_tries = max_probe_tries;
6609
6610                 /* ACK received for nullfunc probing frame */
6611                 if (!ifmgd->probe_send_count)
6612                         ieee80211_reset_ap_probe(sdata);
6613                 else if (ifmgd->nullfunc_failed) {
6614                         if (ifmgd->probe_send_count < max_tries) {
6615                                 mlme_dbg(sdata,
6616                                          "No ack for nullfunc frame to AP %pM, try %d/%i\n",
6617                                          bssid, ifmgd->probe_send_count,
6618                                          max_tries);
6619                                 ieee80211_mgd_probe_ap_send(sdata);
6620                         } else {
6621                                 mlme_dbg(sdata,
6622                                          "No ack for nullfunc frame to AP %pM, disconnecting.\n",
6623                                          bssid);
6624                                 ieee80211_sta_connection_lost(sdata,
6625                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
6626                                         false);
6627                         }
6628                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
6629                         run_again(sdata, ifmgd->probe_timeout);
6630                 else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
6631                         mlme_dbg(sdata,
6632                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
6633                                  bssid, probe_wait_ms);
6634                         ieee80211_sta_connection_lost(sdata,
6635                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
6636                 } else if (ifmgd->probe_send_count < max_tries) {
6637                         mlme_dbg(sdata,
6638                                  "No probe response from AP %pM after %dms, try %d/%i\n",
6639                                  bssid, probe_wait_ms,
6640                                  ifmgd->probe_send_count, max_tries);
6641                         ieee80211_mgd_probe_ap_send(sdata);
6642                 } else {
6643                         /*
6644                          * We actually lost the connection ... or did we?
6645                          * Let's make sure!
6646                          */
6647                         mlme_dbg(sdata,
6648                                  "No probe response from AP %pM after %dms, disconnecting.\n",
6649                                  bssid, probe_wait_ms);
6650
6651                         ieee80211_sta_connection_lost(sdata,
6652                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
6653                 }
6654         }
6655
6656         sdata_unlock(sdata);
6657 }
6658
6659 static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
6660 {
6661         struct ieee80211_sub_if_data *sdata =
6662                 from_timer(sdata, t, u.mgd.bcn_mon_timer);
6663
6664         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
6665                 return;
6666
6667         if (sdata->vif.bss_conf.csa_active &&
6668             !sdata->deflink.u.mgd.csa_waiting_bcn)
6669                 return;
6670
6671         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
6672                 return;
6673
6674         sdata->u.mgd.connection_loss = false;
6675         wiphy_work_queue(sdata->local->hw.wiphy,
6676                          &sdata->u.mgd.beacon_connection_loss_work);
6677 }
6678
6679 static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
6680 {
6681         struct ieee80211_sub_if_data *sdata =
6682                 from_timer(sdata, t, u.mgd.conn_mon_timer);
6683         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6684         struct ieee80211_local *local = sdata->local;
6685         struct sta_info *sta;
6686         unsigned long timeout;
6687
6688         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
6689                 return;
6690
6691         if (sdata->vif.bss_conf.csa_active &&
6692             !sdata->deflink.u.mgd.csa_waiting_bcn)
6693                 return;
6694
6695         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
6696         if (!sta)
6697                 return;
6698
6699         timeout = sta->deflink.status_stats.last_ack;
6700         if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx))
6701                 timeout = sta->deflink.rx_stats.last_rx;
6702         timeout += IEEE80211_CONNECTION_IDLE_TIME;
6703
6704         /* If timeout is after now, then update timer to fire at
6705          * the later date, but do not actually probe at this time.
6706          */
6707         if (time_is_after_jiffies(timeout)) {
6708                 mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
6709                 return;
6710         }
6711
6712         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
6713 }
6714
6715 static void ieee80211_sta_monitor_work(struct work_struct *work)
6716 {
6717         struct ieee80211_sub_if_data *sdata =
6718                 container_of(work, struct ieee80211_sub_if_data,
6719                              u.mgd.monitor_work);
6720
6721         ieee80211_mgd_probe_ap(sdata, false);
6722 }
6723
6724 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
6725 {
6726         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
6727                 __ieee80211_stop_poll(sdata);
6728
6729                 /* let's probe the connection once */
6730                 if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
6731                         ieee80211_queue_work(&sdata->local->hw,
6732                                              &sdata->u.mgd.monitor_work);
6733         }
6734 }
6735
6736 #ifdef CONFIG_PM
6737 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
6738 {
6739         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6740         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6741
6742         sdata_lock(sdata);
6743
6744         if (ifmgd->auth_data || ifmgd->assoc_data) {
6745                 const u8 *ap_addr = ifmgd->auth_data ?
6746                                 ifmgd->auth_data->ap_addr :
6747                                 ifmgd->assoc_data->ap_addr;
6748
6749                 /*
6750                  * If we are trying to authenticate / associate while suspending,
6751                  * cfg80211 won't know and won't actually abort those attempts,
6752                  * thus we need to do that ourselves.
6753                  */
6754                 ieee80211_send_deauth_disassoc(sdata, ap_addr, ap_addr,
6755                                                IEEE80211_STYPE_DEAUTH,
6756                                                WLAN_REASON_DEAUTH_LEAVING,
6757                                                false, frame_buf);
6758                 if (ifmgd->assoc_data)
6759                         ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
6760                 if (ifmgd->auth_data)
6761                         ieee80211_destroy_auth_data(sdata, false);
6762                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
6763                                       IEEE80211_DEAUTH_FRAME_LEN,
6764                                       false);
6765         }
6766
6767         /* This is a bit of a hack - we should find a better and more generic
6768          * solution to this. Normally when suspending, cfg80211 will in fact
6769          * deauthenticate. However, it doesn't (and cannot) stop an ongoing
6770          * auth (not so important) or assoc (this is the problem) process.
6771          *
6772          * As a consequence, it can happen that we are in the process of both
6773          * associating and suspending, and receive an association response
6774          * after cfg80211 has checked if it needs to disconnect, but before
6775          * we actually set the flag to drop incoming frames. This will then
6776          * cause the workqueue flush to process the association response in
6777          * the suspend, resulting in a successful association just before it
6778          * tries to remove the interface from the driver, which now though
6779          * has a channel context assigned ... this results in issues.
6780          *
6781          * To work around this (for now) simply deauth here again if we're
6782          * now connected.
6783          */
6784         if (ifmgd->associated && !sdata->local->wowlan) {
6785                 u8 bssid[ETH_ALEN];
6786                 struct cfg80211_deauth_request req = {
6787                         .reason_code = WLAN_REASON_DEAUTH_LEAVING,
6788                         .bssid = bssid,
6789                 };
6790
6791                 memcpy(bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
6792                 ieee80211_mgd_deauth(sdata, &req);
6793         }
6794
6795         sdata_unlock(sdata);
6796 }
6797 #endif
6798
6799 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
6800 {
6801         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6802
6803         sdata_lock(sdata);
6804         if (!ifmgd->associated) {
6805                 sdata_unlock(sdata);
6806                 return;
6807         }
6808
6809         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
6810                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
6811                 mlme_dbg(sdata, "driver requested disconnect after resume\n");
6812                 ieee80211_sta_connection_lost(sdata,
6813                                               WLAN_REASON_UNSPECIFIED,
6814                                               true);
6815                 sdata_unlock(sdata);
6816                 return;
6817         }
6818
6819         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_HW_RESTART) {
6820                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_HW_RESTART;
6821                 mlme_dbg(sdata, "driver requested disconnect after hardware restart\n");
6822                 ieee80211_sta_connection_lost(sdata,
6823                                               WLAN_REASON_UNSPECIFIED,
6824                                               true);
6825                 sdata_unlock(sdata);
6826                 return;
6827         }
6828
6829         sdata_unlock(sdata);
6830 }
6831
6832 static void ieee80211_request_smps_mgd_work(struct wiphy *wiphy,
6833                                             struct wiphy_work *work)
6834 {
6835         struct ieee80211_link_data *link =
6836                 container_of(work, struct ieee80211_link_data,
6837                              u.mgd.request_smps_work);
6838
6839         sdata_lock(link->sdata);
6840         __ieee80211_request_smps_mgd(link->sdata, link,
6841                                      link->u.mgd.driver_smps_mode);
6842         sdata_unlock(link->sdata);
6843 }
6844
6845 /* interface setup */
6846 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
6847 {
6848         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6849
6850         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
6851         wiphy_work_init(&ifmgd->beacon_connection_loss_work,
6852                         ieee80211_beacon_connection_loss_work);
6853         wiphy_work_init(&ifmgd->csa_connection_drop_work,
6854                         ieee80211_csa_connection_drop_work);
6855         INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
6856                           ieee80211_tdls_peer_del_work);
6857         wiphy_delayed_work_init(&ifmgd->ml_reconf_work,
6858                                 ieee80211_ml_reconf_work);
6859         timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
6860         timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
6861         timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
6862         INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
6863                           ieee80211_sta_handle_tspec_ac_params_wk);
6864
6865         ifmgd->flags = 0;
6866         ifmgd->powersave = sdata->wdev.ps;
6867         ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
6868         ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
6869         /* Setup TDLS data */
6870         spin_lock_init(&ifmgd->teardown_lock);
6871         ifmgd->teardown_skb = NULL;
6872         ifmgd->orig_teardown_skb = NULL;
6873 }
6874
6875 void ieee80211_mgd_setup_link(struct ieee80211_link_data *link)
6876 {
6877         struct ieee80211_sub_if_data *sdata = link->sdata;
6878         struct ieee80211_local *local = sdata->local;
6879         unsigned int link_id = link->link_id;
6880
6881         link->u.mgd.p2p_noa_index = -1;
6882         link->u.mgd.conn_flags = 0;
6883         link->conf->bssid = link->u.mgd.bssid;
6884
6885         wiphy_work_init(&link->u.mgd.request_smps_work,
6886                         ieee80211_request_smps_mgd_work);
6887         if (local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
6888                 link->u.mgd.req_smps = IEEE80211_SMPS_AUTOMATIC;
6889         else
6890                 link->u.mgd.req_smps = IEEE80211_SMPS_OFF;
6891
6892         wiphy_delayed_work_init(&link->u.mgd.chswitch_work,
6893                                 ieee80211_chswitch_work);
6894
6895         if (sdata->u.mgd.assoc_data)
6896                 ether_addr_copy(link->conf->addr,
6897                                 sdata->u.mgd.assoc_data->link[link_id].addr);
6898         else if (!is_valid_ether_addr(link->conf->addr))
6899                 eth_random_addr(link->conf->addr);
6900 }
6901
6902 /* scan finished notification */
6903 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
6904 {
6905         struct ieee80211_sub_if_data *sdata;
6906
6907         /* Restart STA timers */
6908         rcu_read_lock();
6909         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
6910                 if (ieee80211_sdata_running(sdata))
6911                         ieee80211_restart_sta_timer(sdata);
6912         }
6913         rcu_read_unlock();
6914 }
6915
6916 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
6917                                      struct cfg80211_bss *cbss, s8 link_id,
6918                                      const u8 *ap_mld_addr, bool assoc,
6919                                      bool override)
6920 {
6921         struct ieee80211_local *local = sdata->local;
6922         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6923         struct ieee80211_bss *bss = (void *)cbss->priv;
6924         struct sta_info *new_sta = NULL;
6925         struct ieee80211_link_data *link;
6926         bool have_sta = false;
6927         bool mlo;
6928         int err;
6929
6930         if (link_id >= 0) {
6931                 mlo = true;
6932                 if (WARN_ON(!ap_mld_addr))
6933                         return -EINVAL;
6934                 err = ieee80211_vif_set_links(sdata, BIT(link_id), 0);
6935         } else {
6936                 if (WARN_ON(ap_mld_addr))
6937                         return -EINVAL;
6938                 ap_mld_addr = cbss->bssid;
6939                 err = ieee80211_vif_set_links(sdata, 0, 0);
6940                 link_id = 0;
6941                 mlo = false;
6942         }
6943
6944         if (err)
6945                 return err;
6946
6947         link = sdata_dereference(sdata->link[link_id], sdata);
6948         if (WARN_ON(!link)) {
6949                 err = -ENOLINK;
6950                 goto out_err;
6951         }
6952
6953         if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) {
6954                 err = -EINVAL;
6955                 goto out_err;
6956         }
6957
6958         /* If a reconfig is happening, bail out */
6959         if (local->in_reconfig) {
6960                 err = -EBUSY;
6961                 goto out_err;
6962         }
6963
6964         if (assoc) {
6965                 rcu_read_lock();
6966                 have_sta = sta_info_get(sdata, ap_mld_addr);
6967                 rcu_read_unlock();
6968         }
6969
6970         if (!have_sta) {
6971                 if (mlo)
6972                         new_sta = sta_info_alloc_with_link(sdata, ap_mld_addr,
6973                                                            link_id, cbss->bssid,
6974                                                            GFP_KERNEL);
6975                 else
6976                         new_sta = sta_info_alloc(sdata, ap_mld_addr, GFP_KERNEL);
6977
6978                 if (!new_sta) {
6979                         err = -ENOMEM;
6980                         goto out_err;
6981                 }
6982
6983                 new_sta->sta.mlo = mlo;
6984         }
6985
6986         /*
6987          * Set up the information for the new channel before setting the
6988          * new channel. We can't - completely race-free - change the basic
6989          * rates bitmap and the channel (sband) that it refers to, but if
6990          * we set it up before we at least avoid calling into the driver's
6991          * bss_info_changed() method with invalid information (since we do
6992          * call that from changing the channel - only for IDLE and perhaps
6993          * some others, but ...).
6994          *
6995          * So to avoid that, just set up all the new information before the
6996          * channel, but tell the driver to apply it only afterwards, since
6997          * it might need the new channel for that.
6998          */
6999         if (new_sta) {
7000                 const struct cfg80211_bss_ies *ies;
7001                 struct link_sta_info *link_sta;
7002
7003                 rcu_read_lock();
7004                 link_sta = rcu_dereference(new_sta->link[link_id]);
7005                 if (WARN_ON(!link_sta)) {
7006                         rcu_read_unlock();
7007                         sta_info_free(local, new_sta);
7008                         err = -EINVAL;
7009                         goto out_err;
7010                 }
7011
7012                 err = ieee80211_mgd_setup_link_sta(link, new_sta,
7013                                                    link_sta, cbss);
7014                 if (err) {
7015                         rcu_read_unlock();
7016                         sta_info_free(local, new_sta);
7017                         goto out_err;
7018                 }
7019
7020                 memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
7021
7022                 /* set timing information */
7023                 link->conf->beacon_int = cbss->beacon_interval;
7024                 ies = rcu_dereference(cbss->beacon_ies);
7025                 if (ies) {
7026                         link->conf->sync_tsf = ies->tsf;
7027                         link->conf->sync_device_ts =
7028                                 bss->device_ts_beacon;
7029
7030                         ieee80211_get_dtim(ies,
7031                                            &link->conf->sync_dtim_count,
7032                                            NULL);
7033                 } else if (!ieee80211_hw_check(&sdata->local->hw,
7034                                                TIMING_BEACON_ONLY)) {
7035                         ies = rcu_dereference(cbss->proberesp_ies);
7036                         /* must be non-NULL since beacon IEs were NULL */
7037                         link->conf->sync_tsf = ies->tsf;
7038                         link->conf->sync_device_ts =
7039                                 bss->device_ts_presp;
7040                         link->conf->sync_dtim_count = 0;
7041                 } else {
7042                         link->conf->sync_tsf = 0;
7043                         link->conf->sync_device_ts = 0;
7044                         link->conf->sync_dtim_count = 0;
7045                 }
7046                 rcu_read_unlock();
7047         }
7048
7049         if (new_sta || override) {
7050                 err = ieee80211_prep_channel(sdata, link, cbss,
7051                                              &link->u.mgd.conn_flags);
7052                 if (err) {
7053                         if (new_sta)
7054                                 sta_info_free(local, new_sta);
7055                         goto out_err;
7056                 }
7057         }
7058
7059         if (new_sta) {
7060                 /*
7061                  * tell driver about BSSID, basic rates and timing
7062                  * this was set up above, before setting the channel
7063                  */
7064                 ieee80211_link_info_change_notify(sdata, link,
7065                                                   BSS_CHANGED_BSSID |
7066                                                   BSS_CHANGED_BASIC_RATES |
7067                                                   BSS_CHANGED_BEACON_INT);
7068
7069                 if (assoc)
7070                         sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
7071
7072                 err = sta_info_insert(new_sta);
7073                 new_sta = NULL;
7074                 if (err) {
7075                         sdata_info(sdata,
7076                                    "failed to insert STA entry for the AP (error %d)\n",
7077                                    err);
7078                         goto out_err;
7079                 }
7080         } else
7081                 WARN_ON_ONCE(!ether_addr_equal(link->u.mgd.bssid, cbss->bssid));
7082
7083         /* Cancel scan to ensure that nothing interferes with connection */
7084         if (local->scanning)
7085                 ieee80211_scan_cancel(local);
7086
7087         return 0;
7088
7089 out_err:
7090         ieee80211_link_release_channel(&sdata->deflink);
7091         ieee80211_vif_set_links(sdata, 0, 0);
7092         return err;
7093 }
7094
7095 /* config hooks */
7096 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
7097                        struct cfg80211_auth_request *req)
7098 {
7099         struct ieee80211_local *local = sdata->local;
7100         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7101         struct ieee80211_mgd_auth_data *auth_data;
7102         u16 auth_alg;
7103         int err;
7104         bool cont_auth;
7105
7106         /* prepare auth data structure */
7107
7108         switch (req->auth_type) {
7109         case NL80211_AUTHTYPE_OPEN_SYSTEM:
7110                 auth_alg = WLAN_AUTH_OPEN;
7111                 break;
7112         case NL80211_AUTHTYPE_SHARED_KEY:
7113                 if (fips_enabled)
7114                         return -EOPNOTSUPP;
7115                 auth_alg = WLAN_AUTH_SHARED_KEY;
7116                 break;
7117         case NL80211_AUTHTYPE_FT:
7118                 auth_alg = WLAN_AUTH_FT;
7119                 break;
7120         case NL80211_AUTHTYPE_NETWORK_EAP:
7121                 auth_alg = WLAN_AUTH_LEAP;
7122                 break;
7123         case NL80211_AUTHTYPE_SAE:
7124                 auth_alg = WLAN_AUTH_SAE;
7125                 break;
7126         case NL80211_AUTHTYPE_FILS_SK:
7127                 auth_alg = WLAN_AUTH_FILS_SK;
7128                 break;
7129         case NL80211_AUTHTYPE_FILS_SK_PFS:
7130                 auth_alg = WLAN_AUTH_FILS_SK_PFS;
7131                 break;
7132         case NL80211_AUTHTYPE_FILS_PK:
7133                 auth_alg = WLAN_AUTH_FILS_PK;
7134                 break;
7135         default:
7136                 return -EOPNOTSUPP;
7137         }
7138
7139         if (ifmgd->assoc_data)
7140                 return -EBUSY;
7141
7142         auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
7143                             req->ie_len, GFP_KERNEL);
7144         if (!auth_data)
7145                 return -ENOMEM;
7146
7147         memcpy(auth_data->ap_addr,
7148                req->ap_mld_addr ?: req->bss->bssid,
7149                ETH_ALEN);
7150         auth_data->bss = req->bss;
7151         auth_data->link_id = req->link_id;
7152
7153         if (req->auth_data_len >= 4) {
7154                 if (req->auth_type == NL80211_AUTHTYPE_SAE) {
7155                         __le16 *pos = (__le16 *) req->auth_data;
7156
7157                         auth_data->sae_trans = le16_to_cpu(pos[0]);
7158                         auth_data->sae_status = le16_to_cpu(pos[1]);
7159                 }
7160                 memcpy(auth_data->data, req->auth_data + 4,
7161                        req->auth_data_len - 4);
7162                 auth_data->data_len += req->auth_data_len - 4;
7163         }
7164
7165         /* Check if continuing authentication or trying to authenticate with the
7166          * same BSS that we were in the process of authenticating with and avoid
7167          * removal and re-addition of the STA entry in
7168          * ieee80211_prep_connection().
7169          */
7170         cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss &&
7171                     ifmgd->auth_data->link_id == req->link_id;
7172
7173         if (req->ie && req->ie_len) {
7174                 memcpy(&auth_data->data[auth_data->data_len],
7175                        req->ie, req->ie_len);
7176                 auth_data->data_len += req->ie_len;
7177         }
7178
7179         if (req->key && req->key_len) {
7180                 auth_data->key_len = req->key_len;
7181                 auth_data->key_idx = req->key_idx;
7182                 memcpy(auth_data->key, req->key, req->key_len);
7183         }
7184
7185         auth_data->algorithm = auth_alg;
7186
7187         /* try to authenticate/probe */
7188
7189         if (ifmgd->auth_data) {
7190                 if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
7191                         auth_data->peer_confirmed =
7192                                 ifmgd->auth_data->peer_confirmed;
7193                 }
7194                 ieee80211_destroy_auth_data(sdata, cont_auth);
7195         }
7196
7197         /* prep auth_data so we don't go into idle on disassoc */
7198         ifmgd->auth_data = auth_data;
7199
7200         /* If this is continuation of an ongoing SAE authentication exchange
7201          * (i.e., request to send SAE Confirm) and the peer has already
7202          * confirmed, mark authentication completed since we are about to send
7203          * out SAE Confirm.
7204          */
7205         if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
7206             auth_data->peer_confirmed && auth_data->sae_trans == 2)
7207                 ieee80211_mark_sta_auth(sdata);
7208
7209         if (ifmgd->associated) {
7210                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7211
7212                 sdata_info(sdata,
7213                            "disconnect from AP %pM for new auth to %pM\n",
7214                            sdata->vif.cfg.ap_addr, auth_data->ap_addr);
7215                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7216                                        WLAN_REASON_UNSPECIFIED,
7217                                        false, frame_buf);
7218
7219                 ieee80211_report_disconnect(sdata, frame_buf,
7220                                             sizeof(frame_buf), true,
7221                                             WLAN_REASON_UNSPECIFIED,
7222                                             false);
7223         }
7224
7225         sdata_info(sdata, "authenticate with %pM\n", auth_data->ap_addr);
7226
7227         /* needed for transmitting the auth frame(s) properly */
7228         memcpy(sdata->vif.cfg.ap_addr, auth_data->ap_addr, ETH_ALEN);
7229
7230         err = ieee80211_prep_connection(sdata, req->bss, req->link_id,
7231                                         req->ap_mld_addr, cont_auth, false);
7232         if (err)
7233                 goto err_clear;
7234
7235         err = ieee80211_auth(sdata);
7236         if (err) {
7237                 sta_info_destroy_addr(sdata, auth_data->ap_addr);
7238                 goto err_clear;
7239         }
7240
7241         /* hold our own reference */
7242         cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
7243         return 0;
7244
7245  err_clear:
7246         if (!ieee80211_vif_is_mld(&sdata->vif)) {
7247                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
7248                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
7249                                                   BSS_CHANGED_BSSID);
7250                 mutex_lock(&sdata->local->mtx);
7251                 ieee80211_link_release_channel(&sdata->deflink);
7252                 mutex_unlock(&sdata->local->mtx);
7253         }
7254         ifmgd->auth_data = NULL;
7255         kfree(auth_data);
7256         return err;
7257 }
7258
7259 static ieee80211_conn_flags_t
7260 ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
7261                            struct ieee80211_mgd_assoc_data *assoc_data,
7262                            struct cfg80211_assoc_request *req,
7263                            ieee80211_conn_flags_t conn_flags,
7264                            unsigned int link_id)
7265 {
7266         struct ieee80211_local *local = sdata->local;
7267         const struct cfg80211_bss_ies *beacon_ies;
7268         struct ieee80211_supported_band *sband;
7269         const struct element *ht_elem, *vht_elem;
7270         struct ieee80211_link_data *link;
7271         struct cfg80211_bss *cbss;
7272         struct ieee80211_bss *bss;
7273         bool is_5ghz, is_6ghz;
7274
7275         cbss = assoc_data->link[link_id].bss;
7276         if (WARN_ON(!cbss))
7277                 return 0;
7278
7279         bss = (void *)cbss->priv;
7280
7281         sband = local->hw.wiphy->bands[cbss->channel->band];
7282         if (WARN_ON(!sband))
7283                 return 0;
7284
7285         link = sdata_dereference(sdata->link[link_id], sdata);
7286         if (WARN_ON(!link))
7287                 return 0;
7288
7289         is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
7290         is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
7291
7292         /* for MLO connections assume advertising all rates is OK */
7293         if (!req->ap_mld_addr) {
7294                 assoc_data->supp_rates = bss->supp_rates;
7295                 assoc_data->supp_rates_len = bss->supp_rates_len;
7296         }
7297
7298         /* copy and link elems for the STA profile */
7299         if (req->links[link_id].elems_len) {
7300                 memcpy(assoc_data->ie_pos, req->links[link_id].elems,
7301                        req->links[link_id].elems_len);
7302                 assoc_data->link[link_id].elems = assoc_data->ie_pos;
7303                 assoc_data->link[link_id].elems_len = req->links[link_id].elems_len;
7304                 assoc_data->ie_pos += req->links[link_id].elems_len;
7305         }
7306
7307         rcu_read_lock();
7308         ht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_OPERATION);
7309         if (ht_elem && ht_elem->datalen >= sizeof(struct ieee80211_ht_operation))
7310                 assoc_data->link[link_id].ap_ht_param =
7311                         ((struct ieee80211_ht_operation *)(ht_elem->data))->ht_param;
7312         else if (!is_6ghz)
7313                 conn_flags |= IEEE80211_CONN_DISABLE_HT;
7314         vht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
7315         if (vht_elem && vht_elem->datalen >= sizeof(struct ieee80211_vht_cap)) {
7316                 memcpy(&assoc_data->link[link_id].ap_vht_cap, vht_elem->data,
7317                        sizeof(struct ieee80211_vht_cap));
7318         } else if (is_5ghz) {
7319                 link_info(link,
7320                           "VHT capa missing/short, disabling VHT/HE/EHT\n");
7321                 conn_flags |= IEEE80211_CONN_DISABLE_VHT |
7322                               IEEE80211_CONN_DISABLE_HE |
7323                               IEEE80211_CONN_DISABLE_EHT;
7324         }
7325         rcu_read_unlock();
7326
7327         link->u.mgd.beacon_crc_valid = false;
7328         link->u.mgd.dtim_period = 0;
7329         link->u.mgd.have_beacon = false;
7330
7331         /* override HT/VHT configuration only if the AP and we support it */
7332         if (!(conn_flags & IEEE80211_CONN_DISABLE_HT)) {
7333                 struct ieee80211_sta_ht_cap sta_ht_cap;
7334
7335                 memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
7336                 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
7337         }
7338
7339         link->conf->eht_puncturing = 0;
7340
7341         rcu_read_lock();
7342         beacon_ies = rcu_dereference(cbss->beacon_ies);
7343         if (beacon_ies) {
7344                 const struct ieee80211_eht_operation *eht_oper;
7345                 const struct element *elem;
7346                 u8 dtim_count = 0;
7347
7348                 ieee80211_get_dtim(beacon_ies, &dtim_count,
7349                                    &link->u.mgd.dtim_period);
7350
7351                 sdata->deflink.u.mgd.have_beacon = true;
7352
7353                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
7354                         link->conf->sync_tsf = beacon_ies->tsf;
7355                         link->conf->sync_device_ts = bss->device_ts_beacon;
7356                         link->conf->sync_dtim_count = dtim_count;
7357                 }
7358
7359                 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
7360                                               beacon_ies->data, beacon_ies->len);
7361                 if (elem && elem->datalen >= 3)
7362                         link->conf->profile_periodicity = elem->data[2];
7363                 else
7364                         link->conf->profile_periodicity = 0;
7365
7366                 elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
7367                                           beacon_ies->data, beacon_ies->len);
7368                 if (elem && elem->datalen >= 11 &&
7369                     (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
7370                         link->conf->ema_ap = true;
7371                 else
7372                         link->conf->ema_ap = false;
7373
7374                 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION,
7375                                               beacon_ies->data, beacon_ies->len);
7376                 eht_oper = (const void *)(elem->data + 1);
7377
7378                 if (elem &&
7379                     ieee80211_eht_oper_size_ok((const void *)(elem->data + 1),
7380                                                elem->datalen - 1) &&
7381                     (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
7382                     (eht_oper->params & IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
7383                         const struct ieee80211_eht_operation_info *info =
7384                                 (void *)eht_oper->optional;
7385                         const u8 *disable_subchannel_bitmap = info->optional;
7386                         u16 bitmap;
7387
7388                         bitmap = get_unaligned_le16(disable_subchannel_bitmap);
7389                         if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
7390                                                                      &link->conf->chandef))
7391                                 ieee80211_handle_puncturing_bitmap(link,
7392                                                                    eht_oper,
7393                                                                    bitmap,
7394                                                                    NULL);
7395                         else
7396                                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7397                 }
7398         }
7399         rcu_read_unlock();
7400
7401         if (bss->corrupt_data) {
7402                 char *corrupt_type = "data";
7403
7404                 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
7405                         if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
7406                                 corrupt_type = "beacon and probe response";
7407                         else
7408                                 corrupt_type = "beacon";
7409                 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) {
7410                         corrupt_type = "probe response";
7411                 }
7412                 sdata_info(sdata, "associating to AP %pM with corrupt %s\n",
7413                            cbss->bssid, corrupt_type);
7414         }
7415
7416         if (link->u.mgd.req_smps == IEEE80211_SMPS_AUTOMATIC) {
7417                 if (sdata->u.mgd.powersave)
7418                         link->smps_mode = IEEE80211_SMPS_DYNAMIC;
7419                 else
7420                         link->smps_mode = IEEE80211_SMPS_OFF;
7421         } else {
7422                 link->smps_mode = link->u.mgd.req_smps;
7423         }
7424
7425         return conn_flags;
7426 }
7427
7428 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
7429                         struct cfg80211_assoc_request *req)
7430 {
7431         unsigned int assoc_link_id = req->link_id < 0 ? 0 : req->link_id;
7432         struct ieee80211_local *local = sdata->local;
7433         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7434         struct ieee80211_mgd_assoc_data *assoc_data;
7435         const struct element *ssid_elem;
7436         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
7437         ieee80211_conn_flags_t conn_flags = 0;
7438         struct ieee80211_link_data *link;
7439         struct cfg80211_bss *cbss;
7440         struct ieee80211_bss *bss;
7441         bool override;
7442         int i, err;
7443         size_t size = sizeof(*assoc_data) + req->ie_len;
7444
7445         for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++)
7446                 size += req->links[i].elems_len;
7447
7448         /* FIXME: no support for 4-addr MLO yet */
7449         if (sdata->u.mgd.use_4addr && req->link_id >= 0)
7450                 return -EOPNOTSUPP;
7451
7452         assoc_data = kzalloc(size, GFP_KERNEL);
7453         if (!assoc_data)
7454                 return -ENOMEM;
7455
7456         cbss = req->link_id < 0 ? req->bss : req->links[req->link_id].bss;
7457
7458         rcu_read_lock();
7459         ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
7460         if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) {
7461                 rcu_read_unlock();
7462                 kfree(assoc_data);
7463                 return -EINVAL;
7464         }
7465         memcpy(assoc_data->ssid, ssid_elem->data, ssid_elem->datalen);
7466         assoc_data->ssid_len = ssid_elem->datalen;
7467         memcpy(vif_cfg->ssid, assoc_data->ssid, assoc_data->ssid_len);
7468         vif_cfg->ssid_len = assoc_data->ssid_len;
7469         rcu_read_unlock();
7470
7471         if (req->ap_mld_addr) {
7472                 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7473                         if (!req->links[i].bss)
7474                                 continue;
7475                         link = sdata_dereference(sdata->link[i], sdata);
7476                         if (link)
7477                                 ether_addr_copy(assoc_data->link[i].addr,
7478                                                 link->conf->addr);
7479                         else
7480                                 eth_random_addr(assoc_data->link[i].addr);
7481                 }
7482         } else {
7483                 memcpy(assoc_data->link[0].addr, sdata->vif.addr, ETH_ALEN);
7484         }
7485
7486         assoc_data->s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
7487
7488         memcpy(assoc_data->ap_addr,
7489                req->ap_mld_addr ?: req->bss->bssid,
7490                ETH_ALEN);
7491
7492         if (ifmgd->associated) {
7493                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7494
7495                 sdata_info(sdata,
7496                            "disconnect from AP %pM for new assoc to %pM\n",
7497                            sdata->vif.cfg.ap_addr, assoc_data->ap_addr);
7498                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7499                                        WLAN_REASON_UNSPECIFIED,
7500                                        false, frame_buf);
7501
7502                 ieee80211_report_disconnect(sdata, frame_buf,
7503                                             sizeof(frame_buf), true,
7504                                             WLAN_REASON_UNSPECIFIED,
7505                                             false);
7506         }
7507
7508         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
7509                 err = -EBUSY;
7510                 goto err_free;
7511         }
7512
7513         if (ifmgd->assoc_data) {
7514                 err = -EBUSY;
7515                 goto err_free;
7516         }
7517
7518         if (ifmgd->auth_data) {
7519                 bool match;
7520
7521                 /* keep sta info, bssid if matching */
7522                 match = ether_addr_equal(ifmgd->auth_data->ap_addr,
7523                                          assoc_data->ap_addr) &&
7524                         ifmgd->auth_data->link_id == req->link_id;
7525                 ieee80211_destroy_auth_data(sdata, match);
7526         }
7527
7528         /* prepare assoc data */
7529
7530         bss = (void *)cbss->priv;
7531         assoc_data->wmm = bss->wmm_used &&
7532                           (local->hw.queues >= IEEE80211_NUM_ACS);
7533
7534         /*
7535          * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
7536          * We still associate in non-HT mode (11a/b/g) if any one of these
7537          * ciphers is configured as pairwise.
7538          * We can set this to true for non-11n hardware, that'll be checked
7539          * separately along with the peer capabilities.
7540          */
7541         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
7542                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
7543                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
7544                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
7545                         conn_flags |= IEEE80211_CONN_DISABLE_HT;
7546                         conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7547                         conn_flags |= IEEE80211_CONN_DISABLE_HE;
7548                         conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7549                         netdev_info(sdata->dev,
7550                                     "disabling HT/VHT/HE due to WEP/TKIP use\n");
7551                 }
7552         }
7553
7554         /* also disable HT/VHT/HE/EHT if the AP doesn't use WMM */
7555         if (!bss->wmm_used) {
7556                 conn_flags |= IEEE80211_CONN_DISABLE_HT;
7557                 conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7558                 conn_flags |= IEEE80211_CONN_DISABLE_HE;
7559                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7560                 netdev_info(sdata->dev,
7561                             "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
7562         }
7563
7564         if (req->flags & ASSOC_REQ_DISABLE_HT) {
7565                 mlme_dbg(sdata, "HT disabled by flag, disabling HT/VHT/HE\n");
7566                 conn_flags |= IEEE80211_CONN_DISABLE_HT;
7567                 conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7568                 conn_flags |= IEEE80211_CONN_DISABLE_HE;
7569                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7570         }
7571
7572         if (req->flags & ASSOC_REQ_DISABLE_VHT) {
7573                 mlme_dbg(sdata, "VHT disabled by flag, disabling VHT\n");
7574                 conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7575         }
7576
7577         if (req->flags & ASSOC_REQ_DISABLE_HE) {
7578                 mlme_dbg(sdata, "HE disabled by flag, disabling HE/EHT\n");
7579                 conn_flags |= IEEE80211_CONN_DISABLE_HE;
7580                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7581         }
7582
7583         if (req->flags & ASSOC_REQ_DISABLE_EHT)
7584                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7585
7586         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
7587         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
7588                sizeof(ifmgd->ht_capa_mask));
7589
7590         memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
7591         memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
7592                sizeof(ifmgd->vht_capa_mask));
7593
7594         memcpy(&ifmgd->s1g_capa, &req->s1g_capa, sizeof(ifmgd->s1g_capa));
7595         memcpy(&ifmgd->s1g_capa_mask, &req->s1g_capa_mask,
7596                sizeof(ifmgd->s1g_capa_mask));
7597
7598         if (req->ie && req->ie_len) {
7599                 memcpy(assoc_data->ie, req->ie, req->ie_len);
7600                 assoc_data->ie_len = req->ie_len;
7601                 assoc_data->ie_pos = assoc_data->ie + assoc_data->ie_len;
7602         } else {
7603                 assoc_data->ie_pos = assoc_data->ie;
7604         }
7605
7606         if (req->fils_kek) {
7607                 /* should already be checked in cfg80211 - so warn */
7608                 if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
7609                         err = -EINVAL;
7610                         goto err_free;
7611                 }
7612                 memcpy(assoc_data->fils_kek, req->fils_kek,
7613                        req->fils_kek_len);
7614                 assoc_data->fils_kek_len = req->fils_kek_len;
7615         }
7616
7617         if (req->fils_nonces)
7618                 memcpy(assoc_data->fils_nonces, req->fils_nonces,
7619                        2 * FILS_NONCE_LEN);
7620
7621         /* default timeout */
7622         assoc_data->timeout = jiffies;
7623         assoc_data->timeout_started = true;
7624
7625         assoc_data->assoc_link_id = assoc_link_id;
7626
7627         if (req->ap_mld_addr) {
7628                 for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
7629                         assoc_data->link[i].conn_flags = conn_flags;
7630                         assoc_data->link[i].bss = req->links[i].bss;
7631                         assoc_data->link[i].disabled = req->links[i].disabled;
7632                 }
7633
7634                 /* if there was no authentication, set up the link */
7635                 err = ieee80211_vif_set_links(sdata, BIT(assoc_link_id), 0);
7636                 if (err)
7637                         goto err_clear;
7638         } else {
7639                 assoc_data->link[0].conn_flags = conn_flags;
7640                 assoc_data->link[0].bss = cbss;
7641         }
7642
7643         link = sdata_dereference(sdata->link[assoc_link_id], sdata);
7644         if (WARN_ON(!link)) {
7645                 err = -EINVAL;
7646                 goto err_clear;
7647         }
7648
7649         /* keep old conn_flags from ieee80211_prep_channel() from auth */
7650         conn_flags |= link->u.mgd.conn_flags;
7651         conn_flags |= ieee80211_setup_assoc_link(sdata, assoc_data, req,
7652                                                  conn_flags, assoc_link_id);
7653         override = link->u.mgd.conn_flags != conn_flags;
7654         link->u.mgd.conn_flags |= conn_flags;
7655
7656         if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
7657                  ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
7658              "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
7659                 sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
7660
7661         if (bss->wmm_used && bss->uapsd_supported &&
7662             (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
7663                 assoc_data->uapsd = true;
7664                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
7665         } else {
7666                 assoc_data->uapsd = false;
7667                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
7668         }
7669
7670         if (req->prev_bssid)
7671                 memcpy(assoc_data->prev_ap_addr, req->prev_bssid, ETH_ALEN);
7672
7673         if (req->use_mfp) {
7674                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
7675                 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
7676         } else {
7677                 ifmgd->mfp = IEEE80211_MFP_DISABLED;
7678                 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
7679         }
7680
7681         if (req->flags & ASSOC_REQ_USE_RRM)
7682                 ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
7683         else
7684                 ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
7685
7686         if (req->crypto.control_port)
7687                 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
7688         else
7689                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
7690
7691         sdata->control_port_protocol = req->crypto.control_port_ethertype;
7692         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
7693         sdata->control_port_over_nl80211 =
7694                                         req->crypto.control_port_over_nl80211;
7695         sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
7696
7697         /* kick off associate process */
7698         ifmgd->assoc_data = assoc_data;
7699
7700         for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
7701                 if (!assoc_data->link[i].bss)
7702                         continue;
7703                 if (i == assoc_data->assoc_link_id)
7704                         continue;
7705                 /* only calculate the flags, hence link == NULL */
7706                 err = ieee80211_prep_channel(sdata, NULL, assoc_data->link[i].bss,
7707                                              &assoc_data->link[i].conn_flags);
7708                 if (err)
7709                         goto err_clear;
7710         }
7711
7712         /* needed for transmitting the assoc frames properly */
7713         memcpy(sdata->vif.cfg.ap_addr, assoc_data->ap_addr, ETH_ALEN);
7714
7715         err = ieee80211_prep_connection(sdata, cbss, req->link_id,
7716                                         req->ap_mld_addr, true, override);
7717         if (err)
7718                 goto err_clear;
7719
7720         assoc_data->link[assoc_data->assoc_link_id].conn_flags =
7721                 link->u.mgd.conn_flags;
7722
7723         if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC)) {
7724                 const struct cfg80211_bss_ies *beacon_ies;
7725
7726                 rcu_read_lock();
7727                 beacon_ies = rcu_dereference(req->bss->beacon_ies);
7728
7729                 if (beacon_ies) {
7730                         /*
7731                          * Wait up to one beacon interval ...
7732                          * should this be more if we miss one?
7733                          */
7734                         sdata_info(sdata, "waiting for beacon from %pM\n",
7735                                    link->u.mgd.bssid);
7736                         assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
7737                         assoc_data->timeout_started = true;
7738                         assoc_data->need_beacon = true;
7739                 }
7740                 rcu_read_unlock();
7741         }
7742
7743         run_again(sdata, assoc_data->timeout);
7744
7745         return 0;
7746  err_clear:
7747         eth_zero_addr(sdata->deflink.u.mgd.bssid);
7748         ieee80211_link_info_change_notify(sdata, &sdata->deflink,
7749                                           BSS_CHANGED_BSSID);
7750         ifmgd->assoc_data = NULL;
7751  err_free:
7752         kfree(assoc_data);
7753         return err;
7754 }
7755
7756 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
7757                          struct cfg80211_deauth_request *req)
7758 {
7759         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7760         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7761         bool tx = !req->local_state_change;
7762         struct ieee80211_prep_tx_info info = {
7763                 .subtype = IEEE80211_STYPE_DEAUTH,
7764         };
7765
7766         if (ifmgd->auth_data &&
7767             ether_addr_equal(ifmgd->auth_data->ap_addr, req->bssid)) {
7768                 sdata_info(sdata,
7769                            "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
7770                            req->bssid, req->reason_code,
7771                            ieee80211_get_reason_code_string(req->reason_code));
7772
7773                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
7774                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
7775                                                IEEE80211_STYPE_DEAUTH,
7776                                                req->reason_code, tx,
7777                                                frame_buf);
7778                 ieee80211_destroy_auth_data(sdata, false);
7779                 ieee80211_report_disconnect(sdata, frame_buf,
7780                                             sizeof(frame_buf), true,
7781                                             req->reason_code, false);
7782                 drv_mgd_complete_tx(sdata->local, sdata, &info);
7783                 return 0;
7784         }
7785
7786         if (ifmgd->assoc_data &&
7787             ether_addr_equal(ifmgd->assoc_data->ap_addr, req->bssid)) {
7788                 sdata_info(sdata,
7789                            "aborting association with %pM by local choice (Reason: %u=%s)\n",
7790                            req->bssid, req->reason_code,
7791                            ieee80211_get_reason_code_string(req->reason_code));
7792
7793                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
7794                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
7795                                                IEEE80211_STYPE_DEAUTH,
7796                                                req->reason_code, tx,
7797                                                frame_buf);
7798                 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
7799                 ieee80211_report_disconnect(sdata, frame_buf,
7800                                             sizeof(frame_buf), true,
7801                                             req->reason_code, false);
7802                 return 0;
7803         }
7804
7805         if (ifmgd->associated &&
7806             ether_addr_equal(sdata->vif.cfg.ap_addr, req->bssid)) {
7807                 sdata_info(sdata,
7808                            "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
7809                            req->bssid, req->reason_code,
7810                            ieee80211_get_reason_code_string(req->reason_code));
7811
7812                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7813                                        req->reason_code, tx, frame_buf);
7814                 ieee80211_report_disconnect(sdata, frame_buf,
7815                                             sizeof(frame_buf), true,
7816                                             req->reason_code, false);
7817                 drv_mgd_complete_tx(sdata->local, sdata, &info);
7818                 return 0;
7819         }
7820
7821         return -ENOTCONN;
7822 }
7823
7824 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
7825                            struct cfg80211_disassoc_request *req)
7826 {
7827         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7828
7829         if (!sdata->u.mgd.associated ||
7830             memcmp(sdata->vif.cfg.ap_addr, req->ap_addr, ETH_ALEN))
7831                 return -ENOTCONN;
7832
7833         sdata_info(sdata,
7834                    "disassociating from %pM by local choice (Reason: %u=%s)\n",
7835                    req->ap_addr, req->reason_code,
7836                    ieee80211_get_reason_code_string(req->reason_code));
7837
7838         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
7839                                req->reason_code, !req->local_state_change,
7840                                frame_buf);
7841
7842         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
7843                                     req->reason_code, false);
7844
7845         return 0;
7846 }
7847
7848 void ieee80211_mgd_stop_link(struct ieee80211_link_data *link)
7849 {
7850         wiphy_work_cancel(link->sdata->local->hw.wiphy,
7851                           &link->u.mgd.request_smps_work);
7852         wiphy_delayed_work_cancel(link->sdata->local->hw.wiphy,
7853                                   &link->u.mgd.chswitch_work);
7854 }
7855
7856 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
7857 {
7858         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7859
7860         /*
7861          * Make sure some work items will not run after this,
7862          * they will not do anything but might not have been
7863          * cancelled when disconnecting.
7864          */
7865         cancel_work_sync(&ifmgd->monitor_work);
7866         wiphy_work_cancel(sdata->local->hw.wiphy,
7867                           &ifmgd->beacon_connection_loss_work);
7868         wiphy_work_cancel(sdata->local->hw.wiphy,
7869                           &ifmgd->csa_connection_drop_work);
7870         cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
7871         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
7872                                   &ifmgd->ml_reconf_work);
7873
7874         sdata_lock(sdata);
7875         if (ifmgd->assoc_data)
7876                 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
7877         if (ifmgd->auth_data)
7878                 ieee80211_destroy_auth_data(sdata, false);
7879         spin_lock_bh(&ifmgd->teardown_lock);
7880         if (ifmgd->teardown_skb) {
7881                 kfree_skb(ifmgd->teardown_skb);
7882                 ifmgd->teardown_skb = NULL;
7883                 ifmgd->orig_teardown_skb = NULL;
7884         }
7885         kfree(ifmgd->assoc_req_ies);
7886         ifmgd->assoc_req_ies = NULL;
7887         ifmgd->assoc_req_ies_len = 0;
7888         spin_unlock_bh(&ifmgd->teardown_lock);
7889         del_timer_sync(&ifmgd->timer);
7890         sdata_unlock(sdata);
7891 }
7892
7893 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
7894                                enum nl80211_cqm_rssi_threshold_event rssi_event,
7895                                s32 rssi_level,
7896                                gfp_t gfp)
7897 {
7898         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7899
7900         trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
7901
7902         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
7903 }
7904 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
7905
7906 void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
7907 {
7908         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7909
7910         trace_api_cqm_beacon_loss_notify(sdata->local, sdata);
7911
7912         cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
7913 }
7914 EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);
7915
7916 static void _ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data *sdata,
7917                                             int rssi_min_thold,
7918                                             int rssi_max_thold)
7919 {
7920         trace_api_enable_rssi_reports(sdata, rssi_min_thold, rssi_max_thold);
7921
7922         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
7923                 return;
7924
7925         /*
7926          * Scale up threshold values before storing it, as the RSSI averaging
7927          * algorithm uses a scaled up value as well. Change this scaling
7928          * factor if the RSSI averaging algorithm changes.
7929          */
7930         sdata->u.mgd.rssi_min_thold = rssi_min_thold*16;
7931         sdata->u.mgd.rssi_max_thold = rssi_max_thold*16;
7932 }
7933
7934 void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
7935                                     int rssi_min_thold,
7936                                     int rssi_max_thold)
7937 {
7938         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7939
7940         WARN_ON(rssi_min_thold == rssi_max_thold ||
7941                 rssi_min_thold > rssi_max_thold);
7942
7943         _ieee80211_enable_rssi_reports(sdata, rssi_min_thold,
7944                                        rssi_max_thold);
7945 }
7946 EXPORT_SYMBOL(ieee80211_enable_rssi_reports);
7947
7948 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
7949 {
7950         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7951
7952         _ieee80211_enable_rssi_reports(sdata, 0, 0);
7953 }
7954 EXPORT_SYMBOL(ieee80211_disable_rssi_reports);