net/mac80211/mlme.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * BSS client mode implementation
   4  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
   5  * Copyright 2004, Instant802 Networks, Inc.
   6  * Copyright 2005, Devicescape Software, Inc.
   7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   9  * Copyright 2013-2014  Intel Mobile Communications GmbH
  10  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
  11  * Copyright (C) 2018 - 2021 Intel Corporation
  12  */
  13
  14 #include <linux/delay.h>
  15 #include <linux/fips.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/etherdevice.h>
  20 #include <linux/moduleparam.h>
  21 #include <linux/rtnetlink.h>
  22 #include <linux/crc32.h>
  23 #include <linux/slab.h>
  24 #include <linux/export.h>
  25 #include <net/mac80211.h>
  26 #include <asm/unaligned.h>
  27
  28 #include "ieee80211_i.h"
  29 #include "driver-ops.h"
  30 #include "rate.h"
  31 #include "led.h"
  32 #include "fils_aead.h"
  33
  34 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
  35 #define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
  36 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
  37 #define IEEE80211_AUTH_TIMEOUT_SAE      (HZ * 2)
  38 #define IEEE80211_AUTH_MAX_TRIES        3
  39 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
  40 #define IEEE80211_AUTH_WAIT_SAE_RETRY   (HZ * 2)
  41 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
  42 #define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
  43 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
  44 #define IEEE80211_ASSOC_MAX_TRIES       3
  45
  46 static int max_nullfunc_tries = 2;
  47 module_param(max_nullfunc_tries, int, 0644);
  48 MODULE_PARM_DESC(max_nullfunc_tries,
  49                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
  50
  51 static int max_probe_tries = 5;
  52 module_param(max_probe_tries, int, 0644);
  53 MODULE_PARM_DESC(max_probe_tries,
  54                  "Maximum probe tries before disconnecting (reason 4).");
  55
  56 /*
  57  * Beacon loss timeout is calculated as N frames times the
  58  * advertised beacon interval.  This may need to be somewhat
  59  * higher than what hardware might detect to account for
  60  * delays in the host processing frames. But since we also
  61  * probe on beacon miss before declaring the connection lost
  62  * default to what we want.
  63  */
  64 static int beacon_loss_count = 7;
  65 module_param(beacon_loss_count, int, 0644);
  66 MODULE_PARM_DESC(beacon_loss_count,
  67                  "Number of beacon intervals before we decide beacon was lost.");
  68
  69 /*
  70  * Time the connection can be idle before we probe
  71  * it to see if we can still talk to the AP.
  72  */
  73 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
  74 /*
  75  * Time we wait for a probe response after sending
  76  * a probe request because of beacon loss or for
  77  * checking the connection still works.
  78  */
  79 static int probe_wait_ms = 500;
  80 module_param(probe_wait_ms, int, 0644);
  81 MODULE_PARM_DESC(probe_wait_ms,
  82                  "Maximum time(ms) to wait for probe response"
  83                  " before disconnecting (reason 4).");
  84
  85 /*
  86  * How many Beacon frames need to have been used in average signal strength
  87  * before starting to indicate signal change events.
  88  */
  89 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
  90
  91 /*
  92  * We can have multiple work items (and connection probing)
  93  * scheduling this timer, but we need to take care to only
  94  * reschedule it when it should fire _earlier_ than it was
  95  * asked for before, or if it's not pending right now. This
  96  * function ensures that. Note that it then is required to
  97  * run this function for all timeouts after the first one
  98  * has happened -- the work that runs from this timer will
  99  * do that.
 100  */
 101 static void run_again(struct ieee80211_sub_if_data *sdata,
 102                       unsigned long timeout)
 103 {
 104         sdata_assert_lock(sdata);
 105
 106         if (!timer_pending(&sdata->u.mgd.timer) ||
 107             time_before(timeout, sdata->u.mgd.timer.expires))
 108                 mod_timer(&sdata->u.mgd.timer, timeout);
 109 }
 110
 111 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 112 {
 113         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
 114                 return;
 115
 116         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 117                 return;
 118
 119         mod_timer(&sdata->u.mgd.bcn_mon_timer,
 120                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 121 }
 122
 123 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 124 {
 125         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 126
 127         if (unlikely(!ifmgd->associated))
 128                 return;
 129
 130         if (ifmgd->probe_send_count)
 131                 ifmgd->probe_send_count = 0;
 132
 133         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 134                 return;
 135
 136         mod_timer(&ifmgd->conn_mon_timer,
 137                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 138 }
 139
 140 static int ecw2cw(int ecw)
 141 {
 142         return (1 << ecw) - 1;
 143 }
 144
 145 static u32
 146 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 147                              struct ieee80211_supported_band *sband,
 148                              struct ieee80211_channel *channel,
 149                              u32 vht_cap_info,
 150                              const struct ieee80211_ht_operation *ht_oper,
 151                              const struct ieee80211_vht_operation *vht_oper,
 152                              const struct ieee80211_he_operation *he_oper,
 153                              const struct ieee80211_s1g_oper_ie *s1g_oper,
 154                              struct cfg80211_chan_def *chandef, bool tracking)
 155 {
 156         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 157         struct cfg80211_chan_def vht_chandef;
 158         struct ieee80211_sta_ht_cap sta_ht_cap;
 159         u32 ht_cfreq, ret;
 160
 161         memset(chandef, 0, sizeof(struct cfg80211_chan_def));
 162         chandef->chan = channel;
 163         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
 164         chandef->center_freq1 = channel->center_freq;
 165         chandef->freq1_offset = channel->freq_offset;
 166
 167         if (channel->band == NL80211_BAND_6GHZ) {
 168                 if (!ieee80211_chandef_he_6ghz_oper(sdata, he_oper, chandef))
 169                         ret = IEEE80211_STA_DISABLE_HT |
 170                               IEEE80211_STA_DISABLE_VHT |
 171                               IEEE80211_STA_DISABLE_HE;
 172                 else
 173                         ret = 0;
 174                 vht_chandef = *chandef;
 175                 goto out;
 176         } else if (sband->band == NL80211_BAND_S1GHZ) {
 177                 if (!ieee80211_chandef_s1g_oper(s1g_oper, chandef)) {
 178                         sdata_info(sdata,
 179                                    "Missing S1G Operation Element? Trying operating == primary\n");
 180                         chandef->width = ieee80211_s1g_channel_width(channel);
 181                 }
 182
 183                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_40MHZ |
 184                       IEEE80211_STA_DISABLE_VHT |
 185                       IEEE80211_STA_DISABLE_80P80MHZ |
 186                       IEEE80211_STA_DISABLE_160MHZ;
 187                 goto out;
 188         }
 189
 190         memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
 191         ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
 192
 193         if (!ht_oper || !sta_ht_cap.ht_supported) {
 194                 ret = IEEE80211_STA_DISABLE_HT |
 195                       IEEE80211_STA_DISABLE_VHT |
 196                       IEEE80211_STA_DISABLE_HE;
 197                 goto out;
 198         }
 199
 200         chandef->width = NL80211_CHAN_WIDTH_20;
 201
 202         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
 203                                                   channel->band);
 204         /* check that channel matches the right operating channel */
 205         if (!tracking && channel->center_freq != ht_cfreq) {
 206                 /*
 207                  * It's possible that some APs are confused here;
 208                  * Netgear WNDR3700 sometimes reports 4 higher than
 209                  * the actual channel in association responses, but
 210                  * since we look at probe response/beacon data here
 211                  * it should be OK.
 212                  */
 213                 sdata_info(sdata,
 214                            "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
 215                            channel->center_freq, ht_cfreq,
 216                            ht_oper->primary_chan, channel->band);
 217                 ret = IEEE80211_STA_DISABLE_HT |
 218                       IEEE80211_STA_DISABLE_VHT |
 219                       IEEE80211_STA_DISABLE_HE;
 220                 goto out;
 221         }
 222
 223         /* check 40 MHz support, if we have it */
 224         if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
 225                 ieee80211_chandef_ht_oper(ht_oper, chandef);
 226         } else {
 227                 /* 40 MHz (and 80 MHz) must be supported for VHT */
 228                 ret = IEEE80211_STA_DISABLE_VHT;
 229                 /* also mark 40 MHz disabled */
 230                 ret |= IEEE80211_STA_DISABLE_40MHZ;
 231                 goto out;
 232         }
 233
 234         if (!vht_oper || !sband->vht_cap.vht_supported) {
 235                 ret = IEEE80211_STA_DISABLE_VHT;
 236                 goto out;
 237         }
 238
 239         vht_chandef = *chandef;
 240         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && he_oper &&
 241             (le32_to_cpu(he_oper->he_oper_params) &
 242              IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
 243                 struct ieee80211_vht_operation he_oper_vht_cap;
 244
 245                 /*
 246                  * Set only first 3 bytes (other 2 aren't used in
 247                  * ieee80211_chandef_vht_oper() anyway)
 248                  */
 249                 memcpy(&he_oper_vht_cap, he_oper->optional, 3);
 250                 he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);
 251
 252                 if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
 253                                                 &he_oper_vht_cap, ht_oper,
 254                                                 &vht_chandef)) {
 255                         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
 256                                 sdata_info(sdata,
 257                                            "HE AP VHT information is invalid, disable HE\n");
 258                         ret = IEEE80211_STA_DISABLE_HE;
 259                         goto out;
 260                 }
 261         } else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
 262                                                vht_cap_info,
 263                                                vht_oper, ht_oper,
 264                                                &vht_chandef)) {
 265                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 266                         sdata_info(sdata,
 267                                    "AP VHT information is invalid, disable VHT\n");
 268                 ret = IEEE80211_STA_DISABLE_VHT;
 269                 goto out;
 270         }
 271
 272         if (!cfg80211_chandef_valid(&vht_chandef)) {
 273                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 274                         sdata_info(sdata,
 275                                    "AP VHT information is invalid, disable VHT\n");
 276                 ret = IEEE80211_STA_DISABLE_VHT;
 277                 goto out;
 278         }
 279
 280         if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
 281                 ret = 0;
 282                 goto out;
 283         }
 284
 285         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
 286                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 287                         sdata_info(sdata,
 288                                    "AP VHT information doesn't match HT, disable VHT\n");
 289                 ret = IEEE80211_STA_DISABLE_VHT;
 290                 goto out;
 291         }
 292
 293         *chandef = vht_chandef;
 294
 295         ret = 0;
 296
 297 out:
 298         /*
 299          * When tracking the current AP, don't do any further checks if the
 300          * new chandef is identical to the one we're currently using for the
 301          * connection. This keeps us from playing ping-pong with regulatory,
 302          * without it the following can happen (for example):
 303          *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
 304          *  - AP advertises regdom US
 305          *  - CRDA loads regdom US with 80 MHz prohibited (old database)
 306          *  - the code below detects an unsupported channel, downgrades, and
 307          *    we disconnect from the AP in the caller
 308          *  - disconnect causes CRDA to reload world regdomain and the game
 309          *    starts anew.
 310          * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
 311          *
 312          * It seems possible that there are still scenarios with CSA or real
 313          * bandwidth changes where a this could happen, but those cases are
 314          * less common and wouldn't completely prevent using the AP.
 315          */
 316         if (tracking &&
 317             cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
 318                 return ret;
 319
 320         /* don't print the message below for VHT mismatch if VHT is disabled */
 321         if (ret & IEEE80211_STA_DISABLE_VHT)
 322                 vht_chandef = *chandef;
 323
 324         /*
 325          * Ignore the DISABLED flag when we're already connected and only
 326          * tracking the APs beacon for bandwidth changes - otherwise we
 327          * might get disconnected here if we connect to an AP, update our
 328          * regulatory information based on the AP's country IE and the
 329          * information we have is wrong/outdated and disables the channel
 330          * that we're actually using for the connection to the AP.
 331          */
 332         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
 333                                         tracking ? 0 :
 334                                                    IEEE80211_CHAN_DISABLED)) {
 335                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
 336                         ret = IEEE80211_STA_DISABLE_HT |
 337                               IEEE80211_STA_DISABLE_VHT |
 338                               IEEE80211_STA_DISABLE_HE;
 339                         break;
 340                 }
 341
 342                 ret |= ieee80211_chandef_downgrade(chandef);
 343         }
 344
 345         if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
 346                                                  IEEE80211_CHAN_NO_HE))
 347                 ret |= IEEE80211_STA_DISABLE_HE;
 348
 349         if (chandef->width != vht_chandef.width && !tracking)
 350                 sdata_info(sdata,
 351                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 352
 353         WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
 354         return ret;
 355 }
 356
 357 static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
 358                                struct sta_info *sta,
 359                                const struct ieee80211_ht_cap *ht_cap,
 360                                const struct ieee80211_vht_cap *vht_cap,
 361                                const struct ieee80211_ht_operation *ht_oper,
 362                                const struct ieee80211_vht_operation *vht_oper,
 363                                const struct ieee80211_he_operation *he_oper,
 364                                const struct ieee80211_s1g_oper_ie *s1g_oper,
 365                                const u8 *bssid, u32 *changed)
 366 {
 367         struct ieee80211_local *local = sdata->local;
 368         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 369         struct ieee80211_channel *chan = sdata->vif.bss_conf.chandef.chan;
 370         struct ieee80211_supported_band *sband =
 371                 local->hw.wiphy->bands[chan->band];
 372         struct cfg80211_chan_def chandef;
 373         u16 ht_opmode;
 374         u32 flags;
 375         u32 vht_cap_info = 0;
 376         int ret;
 377
 378         /* if HT was/is disabled, don't track any bandwidth changes */
 379         if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
 380                 return 0;
 381
 382         /* don't check VHT if we associated as non-VHT station */
 383         if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
 384                 vht_oper = NULL;
 385
 386         /* don't check HE if we associated as non-HE station */
 387         if (ifmgd->flags & IEEE80211_STA_DISABLE_HE ||
 388             !ieee80211_get_he_iftype_cap(sband,
 389                                          ieee80211_vif_type_p2p(&sdata->vif)))
 390
 391                 he_oper = NULL;
 392
 393         if (WARN_ON_ONCE(!sta))
 394                 return -EINVAL;
 395
 396         /*
 397          * if bss configuration changed store the new one -
 398          * this may be applicable even if channel is identical
 399          */
 400         ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 401         if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
 402                 *changed |= BSS_CHANGED_HT;
 403                 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
 404         }
 405
 406         if (vht_cap)
 407                 vht_cap_info = le32_to_cpu(vht_cap->vht_cap_info);
 408
 409         /* calculate new channel (type) based on HT/VHT/HE operation IEs */
 410         flags = ieee80211_determine_chantype(sdata, sband, chan, vht_cap_info,
 411                                              ht_oper, vht_oper, he_oper,
 412                                              s1g_oper, &chandef, true);
 413
 414         /*
 415          * Downgrade the new channel if we associated with restricted
 416          * capabilities. For example, if we associated as a 20 MHz STA
 417          * to a 40 MHz AP (due to regulatory, capabilities or config
 418          * reasons) then switching to a 40 MHz channel now won't do us
 419          * any good -- we couldn't use it with the AP.
 420          */
 421         if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
 422             chandef.width == NL80211_CHAN_WIDTH_80P80)
 423                 flags |= ieee80211_chandef_downgrade(&chandef);
 424         if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
 425             chandef.width == NL80211_CHAN_WIDTH_160)
 426                 flags |= ieee80211_chandef_downgrade(&chandef);
 427         if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
 428             chandef.width > NL80211_CHAN_WIDTH_20)
 429                 flags |= ieee80211_chandef_downgrade(&chandef);
 430
 431         if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
 432                 return 0;
 433
 434         sdata_info(sdata,
 435                    "AP %pM changed bandwidth, new config is %d.%03d MHz, "
 436                    "width %d (%d.%03d/%d MHz)\n",
 437                    ifmgd->bssid, chandef.chan->center_freq,
 438                    chandef.chan->freq_offset, chandef.width,
 439                    chandef.center_freq1, chandef.freq1_offset,
 440                    chandef.center_freq2);
 441
 442         if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
 443                                       IEEE80211_STA_DISABLE_VHT |
 444                                       IEEE80211_STA_DISABLE_HE |
 445                                       IEEE80211_STA_DISABLE_40MHZ |
 446                                       IEEE80211_STA_DISABLE_80P80MHZ |
 447                                       IEEE80211_STA_DISABLE_160MHZ)) ||
 448             !cfg80211_chandef_valid(&chandef)) {
 449                 sdata_info(sdata,
 450                            "AP %pM changed caps/bw in a way we can't support (0x%x/0x%x) - disconnect\n",
 451                            ifmgd->bssid, flags, ifmgd->flags);
 452                 return -EINVAL;
 453         }
 454
 455         ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
 456
 457         if (ret) {
 458                 sdata_info(sdata,
 459                            "AP %pM changed bandwidth to incompatible one - disconnect\n",
 460                            ifmgd->bssid);
 461                 return ret;
 462         }
 463
 464         return 0;
 465 }
 466
 467 /* frame sending functions */
 468
 469 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 470                                 struct sk_buff *skb, u8 ap_ht_param,
 471                                 struct ieee80211_supported_band *sband,
 472                                 struct ieee80211_channel *channel,
 473                                 enum ieee80211_smps_mode smps)
 474 {
 475         u8 *pos;
 476         u32 flags = channel->flags;
 477         u16 cap;
 478         struct ieee80211_sta_ht_cap ht_cap;
 479
 480         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 481
 482         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
 483         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 484
 485         /* determine capability flags */
 486         cap = ht_cap.cap;
 487
 488         switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 489         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 490                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
 491                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 492                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 493                 }
 494                 break;
 495         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 496                 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
 497                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 498                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 499                 }
 500                 break;
 501         }
 502
 503         /*
 504          * If 40 MHz was disabled associate as though we weren't
 505          * capable of 40 MHz -- some broken APs will never fall
 506          * back to trying to transmit in 20 MHz.
 507          */
 508         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
 509                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 510                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 511         }
 512
 513         /* set SM PS mode properly */
 514         cap &= ~IEEE80211_HT_CAP_SM_PS;
 515         switch (smps) {
 516         case IEEE80211_SMPS_AUTOMATIC:
 517         case IEEE80211_SMPS_NUM_MODES:
 518                 WARN_ON(1);
 519                 fallthrough;
 520         case IEEE80211_SMPS_OFF:
 521                 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
 522                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 523                 break;
 524         case IEEE80211_SMPS_STATIC:
 525                 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
 526                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 527                 break;
 528         case IEEE80211_SMPS_DYNAMIC:
 529                 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
 530                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 531                 break;
 532         }
 533
 534         /* reserve and fill IE */
 535         pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
 536         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 537 }
 538
 539 /* This function determines vht capability flags for the association
 540  * and builds the IE.
 541  * Note - the function may set the owner of the MU-MIMO capability
 542  */
 543 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
 544                                  struct sk_buff *skb,
 545                                  struct ieee80211_supported_band *sband,
 546                                  struct ieee80211_vht_cap *ap_vht_cap)
 547 {
 548         struct ieee80211_local *local = sdata->local;
 549         u8 *pos;
 550         u32 cap;
 551         struct ieee80211_sta_vht_cap vht_cap;
 552         u32 mask, ap_bf_sts, our_bf_sts;
 553
 554         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 555
 556         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
 557         ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
 558
 559         /* determine capability flags */
 560         cap = vht_cap.cap;
 561
 562         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
 563                 u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 564
 565                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 566                 if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
 567                     bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
 568                         cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
 569         }
 570
 571         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
 572                 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
 573                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 574         }
 575
 576         /*
 577          * Some APs apparently get confused if our capabilities are better
 578          * than theirs, so restrict what we advertise in the assoc request.
 579          */
 580         if (!(ap_vht_cap->vht_cap_info &
 581                         cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
 582                 cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
 583                          IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 584         else if (!(ap_vht_cap->vht_cap_info &
 585                         cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
 586                 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 587
 588         /*
 589          * If some other vif is using the MU-MIMO capability we cannot associate
 590          * using MU-MIMO - this will lead to contradictions in the group-id
 591          * mechanism.
 592          * Ownership is defined since association request, in order to avoid
 593          * simultaneous associations with MU-MIMO.
 594          */
 595         if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
 596                 bool disable_mu_mimo = false;
 597                 struct ieee80211_sub_if_data *other;
 598
 599                 list_for_each_entry_rcu(other, &local->interfaces, list) {
 600                         if (other->vif.mu_mimo_owner) {
 601                                 disable_mu_mimo = true;
 602                                 break;
 603                         }
 604                 }
 605                 if (disable_mu_mimo)
 606                         cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 607                 else
 608                         sdata->vif.mu_mimo_owner = true;
 609         }
 610
 611         mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
 612
 613         ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
 614         our_bf_sts = cap & mask;
 615
 616         if (ap_bf_sts < our_bf_sts) {
 617                 cap &= ~mask;
 618                 cap |= ap_bf_sts;
 619         }
 620
 621         /* reserve and fill IE */
 622         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
 623         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
 624 }
 625
 626 /* This function determines HE capability flags for the association
 627  * and builds the IE.
 628  */
 629 static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
 630                                 struct sk_buff *skb,
 631                                 struct ieee80211_supported_band *sband)
 632 {
 633         u8 *pos, *pre_he_pos;
 634         const struct ieee80211_sta_he_cap *he_cap = NULL;
 635         struct ieee80211_chanctx_conf *chanctx_conf;
 636         u8 he_cap_size;
 637         bool reg_cap = false;
 638
 639         rcu_read_lock();
 640         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 641         if (!WARN_ON_ONCE(!chanctx_conf))
 642                 reg_cap = cfg80211_chandef_usable(sdata->wdev.wiphy,
 643                                                   &chanctx_conf->def,
 644                                                   IEEE80211_CHAN_NO_HE);
 645
 646         rcu_read_unlock();
 647
 648         he_cap = ieee80211_get_he_iftype_cap(sband,
 649                                              ieee80211_vif_type_p2p(&sdata->vif));
 650         if (!he_cap || !chanctx_conf || !reg_cap)
 651                 return;
 652
 653         /* get a max size estimate */
 654         he_cap_size =
 655                 2 + 1 + sizeof(he_cap->he_cap_elem) +
 656                 ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
 657                 ieee80211_he_ppe_size(he_cap->ppe_thres[0],
 658                                       he_cap->he_cap_elem.phy_cap_info);
 659         pos = skb_put(skb, he_cap_size);
 660         pre_he_pos = pos;
 661         pos = ieee80211_ie_build_he_cap(sdata->u.mgd.flags,
 662                                         pos, he_cap, pos + he_cap_size);
 663         /* trim excess if any */
 664         skb_trim(skb, skb->len - (pre_he_pos + he_cap_size - pos));
 665
 666         ieee80211_ie_build_he_6ghz_cap(sdata, skb);
 667 }
 668
 669 static int ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 670 {
 671         struct ieee80211_local *local = sdata->local;
 672         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 673         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
 674         struct sk_buff *skb;
 675         struct ieee80211_mgmt *mgmt;
 676         u8 *pos, qos_info, *ie_start;
 677         size_t offset = 0, noffset;
 678         int i, count, rates_len, supp_rates_len, shift;
 679         u16 capab;
 680         struct ieee80211_supported_band *sband;
 681         struct ieee80211_chanctx_conf *chanctx_conf;
 682         struct ieee80211_channel *chan;
 683         u32 rates = 0;
 684         __le16 listen_int;
 685         struct element *ext_capa = NULL;
 686         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
 687         const struct ieee80211_sband_iftype_data *iftd;
 688         struct ieee80211_prep_tx_info info = {};
 689         int ret;
 690
 691         /* we know it's writable, cast away the const */
 692         if (assoc_data->ie_len)
 693                 ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
 694                                                       assoc_data->ie,
 695                                                       assoc_data->ie_len);
 696
 697         sdata_assert_lock(sdata);
 698
 699         rcu_read_lock();
 700         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 701         if (WARN_ON(!chanctx_conf)) {
 702                 rcu_read_unlock();
 703                 return -EINVAL;
 704         }
 705         chan = chanctx_conf->def.chan;
 706         rcu_read_unlock();
 707         sband = local->hw.wiphy->bands[chan->band];
 708         shift = ieee80211_vif_get_shift(&sdata->vif);
 709
 710         if (assoc_data->supp_rates_len) {
 711                 /*
 712                  * Get all rates supported by the device and the AP as
 713                  * some APs don't like getting a superset of their rates
 714                  * in the association request (e.g. D-Link DAP 1353 in
 715                  * b-only mode)...
 716                  */
 717                 rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
 718                                                      assoc_data->supp_rates,
 719                                                      assoc_data->supp_rates_len,
 720                                                      &rates);
 721         } else {
 722                 /*
 723                  * In case AP not provide any supported rates information
 724                  * before association, we send information element(s) with
 725                  * all rates that we support.
 726                  */
 727                 rates_len = 0;
 728                 for (i = 0; i < sband->n_bitrates; i++) {
 729                         rates |= BIT(i);
 730                         rates_len++;
 731                 }
 732         }
 733
 734         iftd = ieee80211_get_sband_iftype_data(sband, iftype);
 735
 736         skb = alloc_skb(local->hw.extra_tx_headroom +
 737                         sizeof(*mgmt) + /* bit too much but doesn't matter */
 738                         2 + assoc_data->ssid_len + /* SSID */
 739                         4 + rates_len + /* (extended) rates */
 740                         4 + /* power capability */
 741                         2 + 2 * sband->n_channels + /* supported channels */
 742                         2 + sizeof(struct ieee80211_ht_cap) + /* HT */
 743                         2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
 744                         2 + 1 + sizeof(struct ieee80211_he_cap_elem) + /* HE */
 745                                 sizeof(struct ieee80211_he_mcs_nss_supp) +
 746                                 IEEE80211_HE_PPE_THRES_MAX_LEN +
 747                         2 + 1 + sizeof(struct ieee80211_he_6ghz_capa) +
 748                         assoc_data->ie_len + /* extra IEs */
 749                         (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
 750                         9 + /* WMM */
 751                         (iftd ? iftd->vendor_elems.len : 0),
 752                         GFP_KERNEL);
 753         if (!skb)
 754                 return -ENOMEM;
 755
 756         skb_reserve(skb, local->hw.extra_tx_headroom);
 757
 758         capab = WLAN_CAPABILITY_ESS;
 759
 760         if (sband->band == NL80211_BAND_2GHZ) {
 761                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 762                 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 763         }
 764
 765         if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
 766                 capab |= WLAN_CAPABILITY_PRIVACY;
 767
 768         if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
 769             ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
 770                 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 771
 772         if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
 773                 capab |= WLAN_CAPABILITY_RADIO_MEASURE;
 774
 775         mgmt = skb_put_zero(skb, 24);
 776         memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
 777         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
 778         memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
 779
 780         listen_int = cpu_to_le16(sband->band == NL80211_BAND_S1GHZ ?
 781                         ieee80211_encode_usf(local->hw.conf.listen_interval) :
 782                         local->hw.conf.listen_interval);
 783         if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
 784                 skb_put(skb, 10);
 785                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 786                                                   IEEE80211_STYPE_REASSOC_REQ);
 787                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 788                 mgmt->u.reassoc_req.listen_interval = listen_int;
 789                 memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
 790                        ETH_ALEN);
 791                 info.subtype = IEEE80211_STYPE_REASSOC_REQ;
 792         } else {
 793                 skb_put(skb, 4);
 794                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 795                                                   IEEE80211_STYPE_ASSOC_REQ);
 796                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 797                 mgmt->u.assoc_req.listen_interval = listen_int;
 798                 info.subtype = IEEE80211_STYPE_ASSOC_REQ;
 799         }
 800
 801         /* SSID */
 802         pos = skb_put(skb, 2 + assoc_data->ssid_len);
 803         ie_start = pos;
 804         *pos++ = WLAN_EID_SSID;
 805         *pos++ = assoc_data->ssid_len;
 806         memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
 807
 808         if (sband->band == NL80211_BAND_S1GHZ)
 809                 goto skip_rates;
 810
 811         /* add all rates which were marked to be used above */
 812         supp_rates_len = rates_len;
 813         if (supp_rates_len > 8)
 814                 supp_rates_len = 8;
 815
 816         pos = skb_put(skb, supp_rates_len + 2);
 817         *pos++ = WLAN_EID_SUPP_RATES;
 818         *pos++ = supp_rates_len;
 819
 820         count = 0;
 821         for (i = 0; i < sband->n_bitrates; i++) {
 822                 if (BIT(i) & rates) {
 823                         int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 824                                                 5 * (1 << shift));
 825                         *pos++ = (u8) rate;
 826                         if (++count == 8)
 827                                 break;
 828                 }
 829         }
 830
 831         if (rates_len > count) {
 832                 pos = skb_put(skb, rates_len - count + 2);
 833                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 834                 *pos++ = rates_len - count;
 835
 836                 for (i++; i < sband->n_bitrates; i++) {
 837                         if (BIT(i) & rates) {
 838                                 int rate;
 839                                 rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 840                                                     5 * (1 << shift));
 841                                 *pos++ = (u8) rate;
 842                         }
 843                 }
 844         }
 845
 846 skip_rates:
 847         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
 848             capab & WLAN_CAPABILITY_RADIO_MEASURE) {
 849                 pos = skb_put(skb, 4);
 850                 *pos++ = WLAN_EID_PWR_CAPABILITY;
 851                 *pos++ = 2;
 852                 *pos++ = 0; /* min tx power */
 853                  /* max tx power */
 854                 *pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
 855         }
 856
 857         /*
 858          * Per spec, we shouldn't include the list of channels if we advertise
 859          * support for extended channel switching, but we've always done that;
 860          * (for now?) apply this restriction only on the (new) 6 GHz band.
 861          */
 862         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
 863             (sband->band != NL80211_BAND_6GHZ ||
 864              !ext_capa || ext_capa->datalen < 1 ||
 865              !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
 866                 /* TODO: get this in reg domain format */
 867                 pos = skb_put(skb, 2 * sband->n_channels + 2);
 868                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
 869                 *pos++ = 2 * sband->n_channels;
 870                 for (i = 0; i < sband->n_channels; i++) {
 871                         *pos++ = ieee80211_frequency_to_channel(
 872                                         sband->channels[i].center_freq);
 873                         *pos++ = 1; /* one channel in the subband*/
 874                 }
 875         }
 876
 877         /* Set MBSSID support for HE AP if needed */
 878         if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
 879             !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && assoc_data->ie_len &&
 880             ext_capa && ext_capa->datalen >= 3)
 881                 ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
 882
 883         /* if present, add any custom IEs that go before HT */
 884         if (assoc_data->ie_len) {
 885                 static const u8 before_ht[] = {
 886                         WLAN_EID_SSID,
 887                         WLAN_EID_SUPP_RATES,
 888                         WLAN_EID_EXT_SUPP_RATES,
 889                         WLAN_EID_PWR_CAPABILITY,
 890                         WLAN_EID_SUPPORTED_CHANNELS,
 891                         WLAN_EID_RSN,
 892                         WLAN_EID_QOS_CAPA,
 893                         WLAN_EID_RRM_ENABLED_CAPABILITIES,
 894                         WLAN_EID_MOBILITY_DOMAIN,
 895                         WLAN_EID_FAST_BSS_TRANSITION,   /* reassoc only */
 896                         WLAN_EID_RIC_DATA,              /* reassoc only */
 897                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 898                 };
 899                 static const u8 after_ric[] = {
 900                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 901                         WLAN_EID_HT_CAPABILITY,
 902                         WLAN_EID_BSS_COEX_2040,
 903                         /* luckily this is almost always there */
 904                         WLAN_EID_EXT_CAPABILITY,
 905                         WLAN_EID_QOS_TRAFFIC_CAPA,
 906                         WLAN_EID_TIM_BCAST_REQ,
 907                         WLAN_EID_INTERWORKING,
 908                         /* 60 GHz (Multi-band, DMG, MMS) can't happen */
 909                         WLAN_EID_VHT_CAPABILITY,
 910                         WLAN_EID_OPMODE_NOTIF,
 911                 };
 912
 913                 noffset = ieee80211_ie_split_ric(assoc_data->ie,
 914                                                  assoc_data->ie_len,
 915                                                  before_ht,
 916                                                  ARRAY_SIZE(before_ht),
 917                                                  after_ric,
 918                                                  ARRAY_SIZE(after_ric),
 919                                                  offset);
 920                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
 921                 offset = noffset;
 922         }
 923
 924         if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
 925                          !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
 926                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
 927
 928         if (sband->band != NL80211_BAND_6GHZ &&
 929             !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
 930                 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
 931                                     sband, chan, sdata->smps_mode);
 932
 933         /* if present, add any custom IEs that go before VHT */
 934         if (assoc_data->ie_len) {
 935                 static const u8 before_vht[] = {
 936                         /*
 937                          * no need to list the ones split off before HT
 938                          * or generated here
 939                          */
 940                         WLAN_EID_BSS_COEX_2040,
 941                         WLAN_EID_EXT_CAPABILITY,
 942                         WLAN_EID_QOS_TRAFFIC_CAPA,
 943                         WLAN_EID_TIM_BCAST_REQ,
 944                         WLAN_EID_INTERWORKING,
 945                         /* 60 GHz (Multi-band, DMG, MMS) can't happen */
 946                 };
 947
 948                 /* RIC already taken above, so no need to handle here anymore */
 949                 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
 950                                              before_vht, ARRAY_SIZE(before_vht),
 951                                              offset);
 952                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
 953                 offset = noffset;
 954         }
 955
 956         /* if present, add any custom IEs that go before HE */
 957         if (assoc_data->ie_len) {
 958                 static const u8 before_he[] = {
 959                         /*
 960                          * no need to list the ones split off before VHT
 961                          * or generated here
 962                          */
 963                         WLAN_EID_OPMODE_NOTIF,
 964                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
 965                         /* 11ai elements */
 966                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
 967                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
 968                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
 969                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
 970                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
 971                         /* TODO: add 11ah/11aj/11ak elements */
 972                 };
 973
 974                 /* RIC already taken above, so no need to handle here anymore */
 975                 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
 976                                              before_he, ARRAY_SIZE(before_he),
 977                                              offset);
 978                 pos = skb_put(skb, noffset - offset);
 979                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
 980                 offset = noffset;
 981         }
 982
 983         if (sband->band != NL80211_BAND_6GHZ &&
 984             !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 985                 ieee80211_add_vht_ie(sdata, skb, sband,
 986                                      &assoc_data->ap_vht_cap);
 987
 988         /*
 989          * If AP doesn't support HT, mark HE as disabled.
 990          * If on the 5GHz band, make sure it supports VHT.
 991          */
 992         if (ifmgd->flags & IEEE80211_STA_DISABLE_HT ||
 993             (sband->band == NL80211_BAND_5GHZ &&
 994              ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 995                 ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
 996
 997         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
 998                 ieee80211_add_he_ie(sdata, skb, sband);
 999
1000         /* if present, add any custom non-vendor IEs that go after HE */
1001         if (assoc_data->ie_len) {
1002                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
1003                                                     assoc_data->ie_len,
1004                                                     offset);
1005                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1006                 offset = noffset;
1007         }
1008
1009         if (assoc_data->wmm) {
1010                 if (assoc_data->uapsd) {
1011                         qos_info = ifmgd->uapsd_queues;
1012                         qos_info |= (ifmgd->uapsd_max_sp_len <<
1013                                      IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
1014                 } else {
1015                         qos_info = 0;
1016                 }
1017
1018                 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
1019         }
1020
1021         if (sband->band == NL80211_BAND_S1GHZ) {
1022                 ieee80211_add_aid_request_ie(sdata, skb);
1023                 ieee80211_add_s1g_capab_ie(sdata, &sband->s1g_cap, skb);
1024         }
1025
1026         if (iftd && iftd->vendor_elems.data && iftd->vendor_elems.len)
1027                 skb_put_data(skb, iftd->vendor_elems.data, iftd->vendor_elems.len);
1028
1029         /* add any remaining custom (i.e. vendor specific here) IEs */
1030         if (assoc_data->ie_len) {
1031                 noffset = assoc_data->ie_len;
1032                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1033         }
1034
1035         if (assoc_data->fils_kek_len) {
1036                 ret = fils_encrypt_assoc_req(skb, assoc_data);
1037                 if (ret < 0) {
1038                         dev_kfree_skb(skb);
1039                         return ret;
1040                 }
1041         }
1042
1043         pos = skb_tail_pointer(skb);
1044         kfree(ifmgd->assoc_req_ies);
1045         ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
1046         if (!ifmgd->assoc_req_ies) {
1047                 dev_kfree_skb(skb);
1048                 return -ENOMEM;
1049         }
1050
1051         ifmgd->assoc_req_ies_len = pos - ie_start;
1052
1053         drv_mgd_prepare_tx(local, sdata, &info);
1054
1055         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1056         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1057                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
1058                                                 IEEE80211_TX_INTFL_MLME_CONN_TX;
1059         ieee80211_tx_skb(sdata, skb);
1060
1061         return 0;
1062 }
1063
1064 void ieee80211_send_pspoll(struct ieee80211_local *local,
1065                            struct ieee80211_sub_if_data *sdata)
1066 {
1067         struct ieee80211_pspoll *pspoll;
1068         struct sk_buff *skb;
1069
1070         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
1071         if (!skb)
1072                 return;
1073
1074         pspoll = (struct ieee80211_pspoll *) skb->data;
1075         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1076
1077         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1078         ieee80211_tx_skb(sdata, skb);
1079 }
1080
1081 void ieee80211_send_nullfunc(struct ieee80211_local *local,
1082                              struct ieee80211_sub_if_data *sdata,
1083                              bool powersave)
1084 {
1085         struct sk_buff *skb;
1086         struct ieee80211_hdr_3addr *nullfunc;
1087         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1088
1089         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
1090                 !ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
1091         if (!skb)
1092                 return;
1093
1094         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1095         if (powersave)
1096                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1097
1098         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1099                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1100
1101         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1102                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1103
1104         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1105                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1106
1107         ieee80211_tx_skb(sdata, skb);
1108 }
1109
1110 void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
1111                                    struct ieee80211_sub_if_data *sdata)
1112 {
1113         struct sk_buff *skb;
1114         struct ieee80211_hdr *nullfunc;
1115         __le16 fc;
1116
1117         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1118                 return;
1119
1120         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1121         if (!skb)
1122                 return;
1123
1124         skb_reserve(skb, local->hw.extra_tx_headroom);
1125
1126         nullfunc = skb_put_zero(skb, 30);
1127         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
1128                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
1129         nullfunc->frame_control = fc;
1130         memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
1131         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1132         memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
1133         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
1134
1135         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1136         ieee80211_tx_skb(sdata, skb);
1137 }
1138
1139 /* spectrum management related things */
1140 static void ieee80211_chswitch_work(struct work_struct *work)
1141 {
1142         struct ieee80211_sub_if_data *sdata =
1143                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
1144         struct ieee80211_local *local = sdata->local;
1145         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1146         int ret;
1147
1148         if (!ieee80211_sdata_running(sdata))
1149                 return;
1150
1151         sdata_lock(sdata);
1152         mutex_lock(&local->mtx);
1153         mutex_lock(&local->chanctx_mtx);
1154
1155         if (!ifmgd->associated)
1156                 goto out;
1157
1158         if (!sdata->vif.csa_active)
1159                 goto out;
1160
1161         /*
1162          * using reservation isn't immediate as it may be deferred until later
1163          * with multi-vif. once reservation is complete it will re-schedule the
1164          * work with no reserved_chanctx so verify chandef to check if it
1165          * completed successfully
1166          */
1167
1168         if (sdata->reserved_chanctx) {
1169                 /*
1170                  * with multi-vif csa driver may call ieee80211_csa_finish()
1171                  * many times while waiting for other interfaces to use their
1172                  * reservations
1173                  */
1174                 if (sdata->reserved_ready)
1175                         goto out;
1176
1177                 ret = ieee80211_vif_use_reserved_context(sdata);
1178                 if (ret) {
1179                         sdata_info(sdata,
1180                                    "failed to use reserved channel context, disconnecting (err=%d)\n",
1181                                    ret);
1182                         ieee80211_queue_work(&sdata->local->hw,
1183                                              &ifmgd->csa_connection_drop_work);
1184                         goto out;
1185                 }
1186
1187                 goto out;
1188         }
1189
1190         if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
1191                                         &sdata->csa_chandef)) {
1192                 sdata_info(sdata,
1193                            "failed to finalize channel switch, disconnecting\n");
1194                 ieee80211_queue_work(&sdata->local->hw,
1195                                      &ifmgd->csa_connection_drop_work);
1196                 goto out;
1197         }
1198
1199         ifmgd->csa_waiting_bcn = true;
1200
1201         ieee80211_sta_reset_beacon_monitor(sdata);
1202         ieee80211_sta_reset_conn_monitor(sdata);
1203
1204 out:
1205         mutex_unlock(&local->chanctx_mtx);
1206         mutex_unlock(&local->mtx);
1207         sdata_unlock(sdata);
1208 }
1209
1210 static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
1211 {
1212         struct ieee80211_local *local = sdata->local;
1213         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1214         int ret;
1215
1216         sdata_assert_lock(sdata);
1217
1218         WARN_ON(!sdata->vif.csa_active);
1219
1220         if (sdata->csa_block_tx) {
1221                 ieee80211_wake_vif_queues(local, sdata,
1222                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1223                 sdata->csa_block_tx = false;
1224         }
1225
1226         sdata->vif.csa_active = false;
1227         ifmgd->csa_waiting_bcn = false;
1228         /*
1229          * If the CSA IE is still present on the beacon after the switch,
1230          * we need to consider it as a new CSA (possibly to self).
1231          */
1232         ifmgd->beacon_crc_valid = false;
1233
1234         ret = drv_post_channel_switch(sdata);
1235         if (ret) {
1236                 sdata_info(sdata,
1237                            "driver post channel switch failed, disconnecting\n");
1238                 ieee80211_queue_work(&local->hw,
1239                                      &ifmgd->csa_connection_drop_work);
1240                 return;
1241         }
1242
1243         cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1244 }
1245
1246 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1247 {
1248         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1249         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1250
1251         trace_api_chswitch_done(sdata, success);
1252         if (!success) {
1253                 sdata_info(sdata,
1254                            "driver channel switch failed, disconnecting\n");
1255                 ieee80211_queue_work(&sdata->local->hw,
1256                                      &ifmgd->csa_connection_drop_work);
1257         } else {
1258                 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1259         }
1260 }
1261 EXPORT_SYMBOL(ieee80211_chswitch_done);
1262
1263 static void ieee80211_chswitch_timer(struct timer_list *t)
1264 {
1265         struct ieee80211_sub_if_data *sdata =
1266                 from_timer(sdata, t, u.mgd.chswitch_timer);
1267
1268         ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1269 }
1270
1271 static void
1272 ieee80211_sta_abort_chanswitch(struct ieee80211_sub_if_data *sdata)
1273 {
1274         struct ieee80211_local *local = sdata->local;
1275
1276         if (!local->ops->abort_channel_switch)
1277                 return;
1278
1279         mutex_lock(&local->mtx);
1280
1281         mutex_lock(&local->chanctx_mtx);
1282         ieee80211_vif_unreserve_chanctx(sdata);
1283         mutex_unlock(&local->chanctx_mtx);
1284
1285         if (sdata->csa_block_tx)
1286                 ieee80211_wake_vif_queues(local, sdata,
1287                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1288
1289         sdata->csa_block_tx = false;
1290         sdata->vif.csa_active = false;
1291
1292         mutex_unlock(&local->mtx);
1293
1294         drv_abort_channel_switch(sdata);
1295 }
1296
1297 static void
1298 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1299                                  u64 timestamp, u32 device_timestamp,
1300                                  struct ieee802_11_elems *elems,
1301                                  bool beacon)
1302 {
1303         struct ieee80211_local *local = sdata->local;
1304         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1305         struct cfg80211_bss *cbss = ifmgd->associated;
1306         struct ieee80211_chanctx_conf *conf;
1307         struct ieee80211_chanctx *chanctx;
1308         enum nl80211_band current_band;
1309         struct ieee80211_csa_ie csa_ie;
1310         struct ieee80211_channel_switch ch_switch;
1311         struct ieee80211_bss *bss;
1312         int res;
1313
1314         sdata_assert_lock(sdata);
1315
1316         if (!cbss)
1317                 return;
1318
1319         if (local->scanning)
1320                 return;
1321
1322         current_band = cbss->channel->band;
1323         bss = (void *)cbss->priv;
1324         res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1325                                            bss->vht_cap_info,
1326                                            ifmgd->flags,
1327                                            ifmgd->associated->bssid, &csa_ie);
1328
1329         if (!res) {
1330                 ch_switch.timestamp = timestamp;
1331                 ch_switch.device_timestamp = device_timestamp;
1332                 ch_switch.block_tx = csa_ie.mode;
1333                 ch_switch.chandef = csa_ie.chandef;
1334                 ch_switch.count = csa_ie.count;
1335                 ch_switch.delay = csa_ie.max_switch_time;
1336         }
1337
1338         if (res < 0)
1339                 goto lock_and_drop_connection;
1340
1341         if (beacon && sdata->vif.csa_active && !ifmgd->csa_waiting_bcn) {
1342                 if (res)
1343                         ieee80211_sta_abort_chanswitch(sdata);
1344                 else
1345                         drv_channel_switch_rx_beacon(sdata, &ch_switch);
1346                 return;
1347         } else if (sdata->vif.csa_active || res) {
1348                 /* disregard subsequent announcements if already processing */
1349                 return;
1350         }
1351
1352         if (sdata->vif.bss_conf.chandef.chan->band !=
1353             csa_ie.chandef.chan->band) {
1354                 sdata_info(sdata,
1355                            "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1356                            ifmgd->associated->bssid,
1357                            csa_ie.chandef.chan->center_freq,
1358                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1359                            csa_ie.chandef.center_freq2);
1360                 goto lock_and_drop_connection;
1361         }
1362
1363         if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1364                                      IEEE80211_CHAN_DISABLED)) {
1365                 sdata_info(sdata,
1366                            "AP %pM switches to unsupported channel "
1367                            "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
1368                            "disconnecting\n",
1369                            ifmgd->associated->bssid,
1370                            csa_ie.chandef.chan->center_freq,
1371                            csa_ie.chandef.chan->freq_offset,
1372                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1373                            csa_ie.chandef.freq1_offset,
1374                            csa_ie.chandef.center_freq2);
1375                 goto lock_and_drop_connection;
1376         }
1377
1378         if (cfg80211_chandef_identical(&csa_ie.chandef,
1379                                        &sdata->vif.bss_conf.chandef) &&
1380             (!csa_ie.mode || !beacon)) {
1381                 if (ifmgd->csa_ignored_same_chan)
1382                         return;
1383                 sdata_info(sdata,
1384                            "AP %pM tries to chanswitch to same channel, ignore\n",
1385                            ifmgd->associated->bssid);
1386                 ifmgd->csa_ignored_same_chan = true;
1387                 return;
1388         }
1389
1390         /*
1391          * Drop all TDLS peers - either we disconnect or move to a different
1392          * channel from this point on. There's no telling what our peer will do.
1393          * The TDLS WIDER_BW scenario is also problematic, as peers might now
1394          * have an incompatible wider chandef.
1395          */
1396         ieee80211_teardown_tdls_peers(sdata);
1397
1398         mutex_lock(&local->mtx);
1399         mutex_lock(&local->chanctx_mtx);
1400         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
1401                                          lockdep_is_held(&local->chanctx_mtx));
1402         if (!conf) {
1403                 sdata_info(sdata,
1404                            "no channel context assigned to vif?, disconnecting\n");
1405                 goto drop_connection;
1406         }
1407
1408         chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1409
1410         if (local->use_chanctx &&
1411             !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1412                 sdata_info(sdata,
1413                            "driver doesn't support chan-switch with channel contexts\n");
1414                 goto drop_connection;
1415         }
1416
1417         if (drv_pre_channel_switch(sdata, &ch_switch)) {
1418                 sdata_info(sdata,
1419                            "preparing for channel switch failed, disconnecting\n");
1420                 goto drop_connection;
1421         }
1422
1423         res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
1424                                             chanctx->mode, false);
1425         if (res) {
1426                 sdata_info(sdata,
1427                            "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1428                            res);
1429                 goto drop_connection;
1430         }
1431         mutex_unlock(&local->chanctx_mtx);
1432
1433         sdata->vif.csa_active = true;
1434         sdata->csa_chandef = csa_ie.chandef;
1435         sdata->csa_block_tx = csa_ie.mode;
1436         ifmgd->csa_ignored_same_chan = false;
1437         ifmgd->beacon_crc_valid = false;
1438
1439         if (sdata->csa_block_tx)
1440                 ieee80211_stop_vif_queues(local, sdata,
1441                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1442         mutex_unlock(&local->mtx);
1443
1444         cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
1445                                           csa_ie.count, csa_ie.mode);
1446
1447         if (local->ops->channel_switch) {
1448                 /* use driver's channel switch callback */
1449                 drv_channel_switch(local, sdata, &ch_switch);
1450                 return;
1451         }
1452
1453         /* channel switch handled in software */
1454         if (csa_ie.count <= 1)
1455                 ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1456         else
1457                 mod_timer(&ifmgd->chswitch_timer,
1458                           TU_TO_EXP_TIME((csa_ie.count - 1) *
1459                                          cbss->beacon_interval));
1460         return;
1461  lock_and_drop_connection:
1462         mutex_lock(&local->mtx);
1463         mutex_lock(&local->chanctx_mtx);
1464  drop_connection:
1465         /*
1466          * This is just so that the disconnect flow will know that
1467          * we were trying to switch channel and failed. In case the
1468          * mode is 1 (we are not allowed to Tx), we will know not to
1469          * send a deauthentication frame. Those two fields will be
1470          * reset when the disconnection worker runs.
1471          */
1472         sdata->vif.csa_active = true;
1473         sdata->csa_block_tx = csa_ie.mode;
1474
1475         ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
1476         mutex_unlock(&local->chanctx_mtx);
1477         mutex_unlock(&local->mtx);
1478 }
1479
1480 static bool
1481 ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
1482                                  struct ieee80211_channel *channel,
1483                                  const u8 *country_ie, u8 country_ie_len,
1484                                  const u8 *pwr_constr_elem,
1485                                  int *chan_pwr, int *pwr_reduction)
1486 {
1487         struct ieee80211_country_ie_triplet *triplet;
1488         int chan = ieee80211_frequency_to_channel(channel->center_freq);
1489         int i, chan_increment;
1490         bool have_chan_pwr = false;
1491
1492         /* Invalid IE */
1493         if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1494                 return false;
1495
1496         triplet = (void *)(country_ie + 3);
1497         country_ie_len -= 3;
1498
1499         switch (channel->band) {
1500         default:
1501                 WARN_ON_ONCE(1);
1502                 fallthrough;
1503         case NL80211_BAND_2GHZ:
1504         case NL80211_BAND_60GHZ:
1505                 chan_increment = 1;
1506                 break;
1507         case NL80211_BAND_5GHZ:
1508                 chan_increment = 4;
1509                 break;
1510         case NL80211_BAND_6GHZ:
1511                 /*
1512                  * In the 6 GHz band, the "maximum transmit power level"
1513                  * field in the triplets is reserved, and thus will be
1514                  * zero and we shouldn't use it to control TX power.
1515                  * The actual TX power will be given in the transmit
1516                  * power envelope element instead.
1517                  */
1518                 return false;
1519         }
1520
1521         /* find channel */
1522         while (country_ie_len >= 3) {
1523                 u8 first_channel = triplet->chans.first_channel;
1524
1525                 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
1526                         goto next;
1527
1528                 for (i = 0; i < triplet->chans.num_channels; i++) {
1529                         if (first_channel + i * chan_increment == chan) {
1530                                 have_chan_pwr = true;
1531                                 *chan_pwr = triplet->chans.max_power;
1532                                 break;
1533                         }
1534                 }
1535                 if (have_chan_pwr)
1536                         break;
1537
1538  next:
1539                 triplet++;
1540                 country_ie_len -= 3;
1541         }
1542
1543         if (have_chan_pwr && pwr_constr_elem)
1544                 *pwr_reduction = *pwr_constr_elem;
1545         else
1546                 *pwr_reduction = 0;
1547
1548         return have_chan_pwr;
1549 }
1550
1551 static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
1552                                       struct ieee80211_channel *channel,
1553                                       const u8 *cisco_dtpc_ie,
1554                                       int *pwr_level)
1555 {
1556         /* From practical testing, the first data byte of the DTPC element
1557          * seems to contain the requested dBm level, and the CLI on Cisco
1558          * APs clearly state the range is -127 to 127 dBm, which indicates
1559          * a signed byte, although it seemingly never actually goes negative.
1560          * The other byte seems to always be zero.
1561          */
1562         *pwr_level = (__s8)cisco_dtpc_ie[4];
1563 }
1564
1565 static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
1566                                        struct ieee80211_channel *channel,
1567                                        struct ieee80211_mgmt *mgmt,
1568                                        const u8 *country_ie, u8 country_ie_len,
1569                                        const u8 *pwr_constr_ie,
1570                                        const u8 *cisco_dtpc_ie)
1571 {
1572         bool has_80211h_pwr = false, has_cisco_pwr = false;
1573         int chan_pwr = 0, pwr_reduction_80211h = 0;
1574         int pwr_level_cisco, pwr_level_80211h;
1575         int new_ap_level;
1576         __le16 capab = mgmt->u.probe_resp.capab_info;
1577
1578         if (ieee80211_is_s1g_beacon(mgmt->frame_control))
1579                 return 0;       /* TODO */
1580
1581         if (country_ie &&
1582             (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
1583              capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1584                 has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
1585                         sdata, channel, country_ie, country_ie_len,
1586                         pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1587                 pwr_level_80211h =
1588                         max_t(int, 0, chan_pwr - pwr_reduction_80211h);
1589         }
1590
1591         if (cisco_dtpc_ie) {
1592                 ieee80211_find_cisco_dtpc(
1593                         sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
1594                 has_cisco_pwr = true;
1595         }
1596
1597         if (!has_80211h_pwr && !has_cisco_pwr)
1598                 return 0;
1599
1600         /* If we have both 802.11h and Cisco DTPC, apply both limits
1601          * by picking the smallest of the two power levels advertised.
1602          */
1603         if (has_80211h_pwr &&
1604             (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1605                 new_ap_level = pwr_level_80211h;
1606
1607                 if (sdata->ap_power_level == new_ap_level)
1608                         return 0;
1609
1610                 sdata_dbg(sdata,
1611                           "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
1612                           pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
1613                           sdata->u.mgd.bssid);
1614         } else {  /* has_cisco_pwr is always true here. */
1615                 new_ap_level = pwr_level_cisco;
1616
1617                 if (sdata->ap_power_level == new_ap_level)
1618                         return 0;
1619
1620                 sdata_dbg(sdata,
1621                           "Limiting TX power to %d dBm as advertised by %pM\n",
1622                           pwr_level_cisco, sdata->u.mgd.bssid);
1623         }
1624
1625         sdata->ap_power_level = new_ap_level;
1626         if (__ieee80211_recalc_txpower(sdata))
1627                 return BSS_CHANGED_TXPOWER;
1628         return 0;
1629 }
1630
1631 /* powersave */
1632 static void ieee80211_enable_ps(struct ieee80211_local *local,
1633                                 struct ieee80211_sub_if_data *sdata)
1634 {
1635         struct ieee80211_conf *conf = &local->hw.conf;
1636
1637         /*
1638          * If we are scanning right now then the parameters will
1639          * take effect when scan finishes.
1640          */
1641         if (local->scanning)
1642                 return;
1643
1644         if (conf->dynamic_ps_timeout > 0 &&
1645             !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1646                 mod_timer(&local->dynamic_ps_timer, jiffies +
1647                           msecs_to_jiffies(conf->dynamic_ps_timeout));
1648         } else {
1649                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1650                         ieee80211_send_nullfunc(local, sdata, true);
1651
1652                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1653                     ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1654                         return;
1655
1656                 conf->flags |= IEEE80211_CONF_PS;
1657                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1658         }
1659 }
1660
1661 static void ieee80211_change_ps(struct ieee80211_local *local)
1662 {
1663         struct ieee80211_conf *conf = &local->hw.conf;
1664
1665         if (local->ps_sdata) {
1666                 ieee80211_enable_ps(local, local->ps_sdata);
1667         } else if (conf->flags & IEEE80211_CONF_PS) {
1668                 conf->flags &= ~IEEE80211_CONF_PS;
1669                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1670                 del_timer_sync(&local->dynamic_ps_timer);
1671                 cancel_work_sync(&local->dynamic_ps_enable_work);
1672         }
1673 }
1674
1675 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
1676 {
1677         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
1678         struct sta_info *sta = NULL;
1679         bool authorized = false;
1680
1681         if (!mgd->powersave)
1682                 return false;
1683
1684         if (mgd->broken_ap)
1685                 return false;
1686
1687         if (!mgd->associated)
1688                 return false;
1689
1690         if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1691                 return false;
1692
1693         if (!mgd->have_beacon)
1694                 return false;
1695
1696         rcu_read_lock();
1697         sta = sta_info_get(sdata, mgd->bssid);
1698         if (sta)
1699                 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1700         rcu_read_unlock();
1701
1702         return authorized;
1703 }
1704
1705 /* need to hold RTNL or interface lock */
1706 void ieee80211_recalc_ps(struct ieee80211_local *local)
1707 {
1708         struct ieee80211_sub_if_data *sdata, *found = NULL;
1709         int count = 0;
1710         int timeout;
1711
1712         if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1713                 local->ps_sdata = NULL;
1714                 return;
1715         }
1716
1717         list_for_each_entry(sdata, &local->interfaces, list) {
1718                 if (!ieee80211_sdata_running(sdata))
1719                         continue;
1720                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
1721                         /* If an AP vif is found, then disable PS
1722                          * by setting the count to zero thereby setting
1723                          * ps_sdata to NULL.
1724                          */
1725                         count = 0;
1726                         break;
1727                 }
1728                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1729                         continue;
1730                 found = sdata;
1731                 count++;
1732         }
1733
1734         if (count == 1 && ieee80211_powersave_allowed(found)) {
1735                 u8 dtimper = found->u.mgd.dtim_period;
1736
1737                 timeout = local->dynamic_ps_forced_timeout;
1738                 if (timeout < 0)
1739                         timeout = 100;
1740                 local->hw.conf.dynamic_ps_timeout = timeout;
1741
1742                 /* If the TIM IE is invalid, pretend the value is 1 */
1743                 if (!dtimper)
1744                         dtimper = 1;
1745
1746                 local->hw.conf.ps_dtim_period = dtimper;
1747                 local->ps_sdata = found;
1748         } else {
1749                 local->ps_sdata = NULL;
1750         }
1751
1752         ieee80211_change_ps(local);
1753 }
1754
1755 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
1756 {
1757         bool ps_allowed = ieee80211_powersave_allowed(sdata);
1758
1759         if (sdata->vif.bss_conf.ps != ps_allowed) {
1760                 sdata->vif.bss_conf.ps = ps_allowed;
1761                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
1762         }
1763 }
1764
1765 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
1766 {
1767         struct ieee80211_local *local =
1768                 container_of(work, struct ieee80211_local,
1769                              dynamic_ps_disable_work);
1770
1771         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1772                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1773                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1774         }
1775
1776         ieee80211_wake_queues_by_reason(&local->hw,
1777                                         IEEE80211_MAX_QUEUE_MAP,
1778                                         IEEE80211_QUEUE_STOP_REASON_PS,
1779                                         false);
1780 }
1781
1782 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
1783 {
1784         struct ieee80211_local *local =
1785                 container_of(work, struct ieee80211_local,
1786                              dynamic_ps_enable_work);
1787         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1788         struct ieee80211_if_managed *ifmgd;
1789         unsigned long flags;
1790         int q;
1791
1792         /* can only happen when PS was just disabled anyway */
1793         if (!sdata)
1794                 return;
1795
1796         ifmgd = &sdata->u.mgd;
1797
1798         if (local->hw.conf.flags & IEEE80211_CONF_PS)
1799                 return;
1800
1801         if (local->hw.conf.dynamic_ps_timeout > 0) {
1802                 /* don't enter PS if TX frames are pending */
1803                 if (drv_tx_frames_pending(local)) {
1804                         mod_timer(&local->dynamic_ps_timer, jiffies +
1805                                   msecs_to_jiffies(
1806                                   local->hw.conf.dynamic_ps_timeout));
1807                         return;
1808                 }
1809
1810                 /*
1811                  * transmission can be stopped by others which leads to
1812                  * dynamic_ps_timer expiry. Postpone the ps timer if it
1813                  * is not the actual idle state.
1814                  */
1815                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1816                 for (q = 0; q < local->hw.queues; q++) {
1817                         if (local->queue_stop_reasons[q]) {
1818                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1819                                                        flags);
1820                                 mod_timer(&local->dynamic_ps_timer, jiffies +
1821                                           msecs_to_jiffies(
1822                                           local->hw.conf.dynamic_ps_timeout));
1823                                 return;
1824                         }
1825                 }
1826                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1827         }
1828
1829         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1830             !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1831                 if (drv_tx_frames_pending(local)) {
1832                         mod_timer(&local->dynamic_ps_timer, jiffies +
1833                                   msecs_to_jiffies(
1834                                   local->hw.conf.dynamic_ps_timeout));
1835                 } else {
1836                         ieee80211_send_nullfunc(local, sdata, true);
1837                         /* Flush to get the tx status of nullfunc frame */
1838                         ieee80211_flush_queues(local, sdata, false);
1839                 }
1840         }
1841
1842         if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
1843               ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1844             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1845                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
1846                 local->hw.conf.flags |= IEEE80211_CONF_PS;
1847                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1848         }
1849 }
1850
1851 void ieee80211_dynamic_ps_timer(struct timer_list *t)
1852 {
1853         struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
1854
1855         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1856 }
1857
1858 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
1859 {
1860         struct delayed_work *delayed_work = to_delayed_work(work);
1861         struct ieee80211_sub_if_data *sdata =
1862                 container_of(delayed_work, struct ieee80211_sub_if_data,
1863                              dfs_cac_timer_work);
1864         struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1865
1866         mutex_lock(&sdata->local->mtx);
1867         if (sdata->wdev.cac_started) {
1868                 ieee80211_vif_release_channel(sdata);
1869                 cfg80211_cac_event(sdata->dev, &chandef,
1870                                    NL80211_RADAR_CAC_FINISHED,
1871                                    GFP_KERNEL);
1872         }
1873         mutex_unlock(&sdata->local->mtx);
1874 }
1875
1876 static bool
1877 __ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
1878 {
1879         struct ieee80211_local *local = sdata->local;
1880         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1881         bool ret = false;
1882         int ac;
1883
1884         if (local->hw.queues < IEEE80211_NUM_ACS)
1885                 return false;
1886
1887         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1888                 struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
1889                 int non_acm_ac;
1890                 unsigned long now = jiffies;
1891
1892                 if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
1893                     tx_tspec->admitted_time &&
1894                     time_after(now, tx_tspec->time_slice_start + HZ)) {
1895                         tx_tspec->consumed_tx_time = 0;
1896                         tx_tspec->time_slice_start = now;
1897
1898                         if (tx_tspec->downgraded)
1899                                 tx_tspec->action =
1900                                         TX_TSPEC_ACTION_STOP_DOWNGRADE;
1901                 }
1902
1903                 switch (tx_tspec->action) {
1904                 case TX_TSPEC_ACTION_STOP_DOWNGRADE:
1905                         /* take the original parameters */
1906                         if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
1907                                 sdata_err(sdata,
1908                                           "failed to set TX queue parameters for queue %d\n",
1909                                           ac);
1910                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
1911                         tx_tspec->downgraded = false;
1912                         ret = true;
1913                         break;
1914                 case TX_TSPEC_ACTION_DOWNGRADE:
1915                         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
1916                                 tx_tspec->action = TX_TSPEC_ACTION_NONE;
1917                                 ret = true;
1918                                 break;
1919                         }
1920                         /* downgrade next lower non-ACM AC */
1921                         for (non_acm_ac = ac + 1;
1922                              non_acm_ac < IEEE80211_NUM_ACS;
1923                              non_acm_ac++)
1924                                 if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
1925                                         break;
1926                         /* Usually the loop will result in using BK even if it
1927                          * requires admission control, but such a configuration
1928                          * makes no sense and we have to transmit somehow - the
1929                          * AC selection does the same thing.
1930                          * If we started out trying to downgrade from BK, then
1931                          * the extra condition here might be needed.
1932                          */
1933                         if (non_acm_ac >= IEEE80211_NUM_ACS)
1934                                 non_acm_ac = IEEE80211_AC_BK;
1935                         if (drv_conf_tx(local, sdata, ac,
1936                                         &sdata->tx_conf[non_acm_ac]))
1937                                 sdata_err(sdata,
1938                                           "failed to set TX queue parameters for queue %d\n",
1939                                           ac);
1940                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
1941                         ret = true;
1942                         schedule_delayed_work(&ifmgd->tx_tspec_wk,
1943                                 tx_tspec->time_slice_start + HZ - now + 1);
1944                         break;
1945                 case TX_TSPEC_ACTION_NONE:
1946                         /* nothing now */
1947                         break;
1948                 }
1949         }
1950
1951         return ret;
1952 }
1953
1954 void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
1955 {
1956         if (__ieee80211_sta_handle_tspec_ac_params(sdata))
1957                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
1958 }
1959
1960 static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
1961 {
1962         struct ieee80211_sub_if_data *sdata;
1963
1964         sdata = container_of(work, struct ieee80211_sub_if_data,
1965                              u.mgd.tx_tspec_wk.work);
1966         ieee80211_sta_handle_tspec_ac_params(sdata);
1967 }
1968
1969 /* MLME */
1970 static bool
1971 ieee80211_sta_wmm_params(struct ieee80211_local *local,
1972                          struct ieee80211_sub_if_data *sdata,
1973                          const u8 *wmm_param, size_t wmm_param_len,
1974                          const struct ieee80211_mu_edca_param_set *mu_edca)
1975 {
1976         struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1977         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1978         size_t left;
1979         int count, mu_edca_count, ac;
1980         const u8 *pos;
1981         u8 uapsd_queues = 0;
1982
1983         if (!local->ops->conf_tx)
1984                 return false;
1985
1986         if (local->hw.queues < IEEE80211_NUM_ACS)
1987                 return false;
1988
1989         if (!wmm_param)
1990                 return false;
1991
1992         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1993                 return false;
1994
1995         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1996                 uapsd_queues = ifmgd->uapsd_queues;
1997
1998         count = wmm_param[6] & 0x0f;
1999         /* -1 is the initial value of ifmgd->mu_edca_last_param_set.
2000          * if mu_edca was preset before and now it disappeared tell
2001          * the driver about it.
2002          */
2003         mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
2004         if (count == ifmgd->wmm_last_param_set &&
2005             mu_edca_count == ifmgd->mu_edca_last_param_set)
2006                 return false;
2007         ifmgd->wmm_last_param_set = count;
2008         ifmgd->mu_edca_last_param_set = mu_edca_count;
2009
2010         pos = wmm_param + 8;
2011         left = wmm_param_len - 8;
2012
2013         memset(&params, 0, sizeof(params));
2014
2015         sdata->wmm_acm = 0;
2016         for (; left >= 4; left -= 4, pos += 4) {
2017                 int aci = (pos[0] >> 5) & 0x03;
2018                 int acm = (pos[0] >> 4) & 0x01;
2019                 bool uapsd = false;
2020
2021                 switch (aci) {
2022                 case 1: /* AC_BK */
2023                         ac = IEEE80211_AC_BK;
2024                         if (acm)
2025                                 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
2026                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
2027                                 uapsd = true;
2028                         params[ac].mu_edca = !!mu_edca;
2029                         if (mu_edca)
2030                                 params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2031                         break;
2032                 case 2: /* AC_VI */
2033                         ac = IEEE80211_AC_VI;
2034                         if (acm)
2035                                 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
2036                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
2037                                 uapsd = true;
2038                         params[ac].mu_edca = !!mu_edca;
2039                         if (mu_edca)
2040                                 params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2041                         break;
2042                 case 3: /* AC_VO */
2043                         ac = IEEE80211_AC_VO;
2044                         if (acm)
2045                                 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
2046                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
2047                                 uapsd = true;
2048                         params[ac].mu_edca = !!mu_edca;
2049                         if (mu_edca)
2050                                 params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2051                         break;
2052                 case 0: /* AC_BE */
2053                 default:
2054                         ac = IEEE80211_AC_BE;
2055                         if (acm)
2056                                 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
2057                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
2058                                 uapsd = true;
2059                         params[ac].mu_edca = !!mu_edca;
2060                         if (mu_edca)
2061                                 params[ac].mu_edca_param_rec = mu_edca->ac_be;
2062                         break;
2063                 }
2064
2065                 params[ac].aifs = pos[0] & 0x0f;
2066
2067                 if (params[ac].aifs < 2) {
2068                         sdata_info(sdata,
2069                                    "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2070                                    params[ac].aifs, aci);
2071                         params[ac].aifs = 2;
2072                 }
2073                 params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
2074                 params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
2075                 params[ac].txop = get_unaligned_le16(pos + 2);
2076                 params[ac].acm = acm;
2077                 params[ac].uapsd = uapsd;
2078
2079                 if (params[ac].cw_min == 0 ||
2080                     params[ac].cw_min > params[ac].cw_max) {
2081                         sdata_info(sdata,
2082                                    "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
2083                                    params[ac].cw_min, params[ac].cw_max, aci);
2084                         return false;
2085                 }
2086                 ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2087         }
2088
2089         /* WMM specification requires all 4 ACIs. */
2090         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2091                 if (params[ac].cw_min == 0) {
2092                         sdata_info(sdata,
2093                                    "AP has invalid WMM params (missing AC %d), using defaults\n",
2094                                    ac);
2095                         return false;
2096                 }
2097         }
2098
2099         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2100                 mlme_dbg(sdata,
2101                          "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
2102                          ac, params[ac].acm,
2103                          params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
2104                          params[ac].txop, params[ac].uapsd,
2105                          ifmgd->tx_tspec[ac].downgraded);
2106                 sdata->tx_conf[ac] = params[ac];
2107                 if (!ifmgd->tx_tspec[ac].downgraded &&
2108                     drv_conf_tx(local, sdata, ac, &params[ac]))
2109                         sdata_err(sdata,
2110                                   "failed to set TX queue parameters for AC %d\n",
2111                                   ac);
2112         }
2113
2114         /* enable WMM or activate new settings */
2115         sdata->vif.bss_conf.qos = true;
2116         return true;
2117 }
2118
2119 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2120 {
2121         lockdep_assert_held(&sdata->local->mtx);
2122
2123         sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2124         ieee80211_run_deferred_scan(sdata->local);
2125 }
2126
2127 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2128 {
2129         mutex_lock(&sdata->local->mtx);
2130         __ieee80211_stop_poll(sdata);
2131         mutex_unlock(&sdata->local->mtx);
2132 }
2133
2134 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
2135                                            u16 capab, bool erp_valid, u8 erp)
2136 {
2137         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2138         struct ieee80211_supported_band *sband;
2139         u32 changed = 0;
2140         bool use_protection;
2141         bool use_short_preamble;
2142         bool use_short_slot;
2143
2144         sband = ieee80211_get_sband(sdata);
2145         if (!sband)
2146                 return changed;
2147
2148         if (erp_valid) {
2149                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
2150                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
2151         } else {
2152                 use_protection = false;
2153                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
2154         }
2155
2156         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2157         if (sband->band == NL80211_BAND_5GHZ ||
2158             sband->band == NL80211_BAND_6GHZ)
2159                 use_short_slot = true;
2160
2161         if (use_protection != bss_conf->use_cts_prot) {
2162                 bss_conf->use_cts_prot = use_protection;
2163                 changed |= BSS_CHANGED_ERP_CTS_PROT;
2164         }
2165
2166         if (use_short_preamble != bss_conf->use_short_preamble) {
2167                 bss_conf->use_short_preamble = use_short_preamble;
2168                 changed |= BSS_CHANGED_ERP_PREAMBLE;
2169         }
2170
2171         if (use_short_slot != bss_conf->use_short_slot) {
2172                 bss_conf->use_short_slot = use_short_slot;
2173                 changed |= BSS_CHANGED_ERP_SLOT;
2174         }
2175
2176         return changed;
2177 }
2178
2179 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2180                                      struct cfg80211_bss *cbss,
2181                                      u32 bss_info_changed)
2182 {
2183         struct ieee80211_bss *bss = (void *)cbss->priv;
2184         struct ieee80211_local *local = sdata->local;
2185         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2186
2187         bss_info_changed |= BSS_CHANGED_ASSOC;
2188         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
2189                 bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
2190
2191         sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
2192                 beacon_loss_count * bss_conf->beacon_int));
2193
2194         sdata->u.mgd.associated = cbss;
2195         memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2196
2197         ieee80211_check_rate_mask(sdata);
2198
2199         sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
2200
2201         if (sdata->vif.p2p ||
2202             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2203                 const struct cfg80211_bss_ies *ies;
2204
2205                 rcu_read_lock();
2206                 ies = rcu_dereference(cbss->ies);
2207                 if (ies) {
2208                         int ret;
2209
2210                         ret = cfg80211_get_p2p_attr(
2211                                         ies->data, ies->len,
2212                                         IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
2213                                         (u8 *) &bss_conf->p2p_noa_attr,
2214                                         sizeof(bss_conf->p2p_noa_attr));
2215                         if (ret >= 2) {
2216                                 sdata->u.mgd.p2p_noa_index =
2217                                         bss_conf->p2p_noa_attr.index;
2218                                 bss_info_changed |= BSS_CHANGED_P2P_PS;
2219                         }
2220                 }
2221                 rcu_read_unlock();
2222         }
2223
2224         /* just to be sure */
2225         ieee80211_stop_poll(sdata);
2226
2227         ieee80211_led_assoc(local, 1);
2228
2229         if (sdata->u.mgd.have_beacon) {
2230                 /*
2231                  * If the AP is buggy we may get here with no DTIM period
2232                  * known, so assume it's 1 which is the only safe assumption
2233                  * in that case, although if the TIM IE is broken powersave
2234                  * probably just won't work at all.
2235                  */
2236                 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
2237                 bss_conf->beacon_rate = bss->beacon_rate;
2238                 bss_info_changed |= BSS_CHANGED_BEACON_INFO;
2239         } else {
2240                 bss_conf->beacon_rate = NULL;
2241                 bss_conf->dtim_period = 0;
2242         }
2243
2244         bss_conf->assoc = 1;
2245
2246         /* Tell the driver to monitor connection quality (if supported) */
2247         if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2248             bss_conf->cqm_rssi_thold)
2249                 bss_info_changed |= BSS_CHANGED_CQM;
2250
2251         /* Enable ARP filtering */
2252         if (bss_conf->arp_addr_cnt)
2253                 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
2254
2255         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
2256
2257         mutex_lock(&local->iflist_mtx);
2258         ieee80211_recalc_ps(local);
2259         mutex_unlock(&local->iflist_mtx);
2260
2261         ieee80211_recalc_smps(sdata);
2262         ieee80211_recalc_ps_vif(sdata);
2263
2264         netif_carrier_on(sdata->dev);
2265 }
2266
2267 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2268                                    u16 stype, u16 reason, bool tx,
2269                                    u8 *frame_buf)
2270 {
2271         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2272         struct ieee80211_local *local = sdata->local;
2273         u32 changed = 0;
2274         struct ieee80211_prep_tx_info info = {
2275                 .subtype = stype,
2276         };
2277
2278         sdata_assert_lock(sdata);
2279
2280         if (WARN_ON_ONCE(tx && !frame_buf))
2281                 return;
2282
2283         if (WARN_ON(!ifmgd->associated))
2284                 return;
2285
2286         ieee80211_stop_poll(sdata);
2287
2288         ifmgd->associated = NULL;
2289         netif_carrier_off(sdata->dev);
2290
2291         /*
2292          * if we want to get out of ps before disassoc (why?) we have
2293          * to do it before sending disassoc, as otherwise the null-packet
2294          * won't be valid.
2295          */
2296         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2297                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2298                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2299         }
2300         local->ps_sdata = NULL;
2301
2302         /* disable per-vif ps */
2303         ieee80211_recalc_ps_vif(sdata);
2304
2305         /* make sure ongoing transmission finishes */
2306         synchronize_net();
2307
2308         /*
2309          * drop any frame before deauth/disassoc, this can be data or
2310          * management frame. Since we are disconnecting, we should not
2311          * insist sending these frames which can take time and delay
2312          * the disconnection and possible the roaming.
2313          */
2314         if (tx)
2315                 ieee80211_flush_queues(local, sdata, true);
2316
2317         /* deauthenticate/disassociate now */
2318         if (tx || frame_buf) {
2319                 /*
2320                  * In multi channel scenarios guarantee that the virtual
2321                  * interface is granted immediate airtime to transmit the
2322                  * deauthentication frame by calling mgd_prepare_tx, if the
2323                  * driver requested so.
2324                  */
2325                 if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
2326                     !ifmgd->have_beacon) {
2327                         drv_mgd_prepare_tx(sdata->local, sdata, &info);
2328                 }
2329
2330                 ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid,
2331                                                ifmgd->bssid, stype, reason,
2332                                                tx, frame_buf);
2333         }
2334
2335         /* flush out frame - make sure the deauth was actually sent */
2336         if (tx)
2337                 ieee80211_flush_queues(local, sdata, false);
2338
2339         drv_mgd_complete_tx(sdata->local, sdata, &info);
2340
2341         /* clear bssid only after building the needed mgmt frames */
2342         eth_zero_addr(ifmgd->bssid);
2343
2344         sdata->vif.bss_conf.ssid_len = 0;
2345
2346         /* remove AP and TDLS peers */
2347         sta_info_flush(sdata);
2348
2349         /* finally reset all BSS / config parameters */
2350         changed |= ieee80211_reset_erp_info(sdata);
2351
2352         ieee80211_led_assoc(local, 0);
2353         changed |= BSS_CHANGED_ASSOC;
2354         sdata->vif.bss_conf.assoc = false;
2355
2356         ifmgd->p2p_noa_index = -1;
2357         memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
2358                sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2359
2360         /* on the next assoc, re-program HT/VHT parameters */
2361         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
2362         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2363         memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
2364         memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2365
2366         /* reset MU-MIMO ownership and group data */
2367         memset(sdata->vif.bss_conf.mu_group.membership, 0,
2368                sizeof(sdata->vif.bss_conf.mu_group.membership));
2369         memset(sdata->vif.bss_conf.mu_group.position, 0,
2370                sizeof(sdata->vif.bss_conf.mu_group.position));
2371         changed |= BSS_CHANGED_MU_GROUPS;
2372         sdata->vif.mu_mimo_owner = false;
2373
2374         sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2375
2376         del_timer_sync(&local->dynamic_ps_timer);
2377         cancel_work_sync(&local->dynamic_ps_enable_work);
2378
2379         /* Disable ARP filtering */
2380         if (sdata->vif.bss_conf.arp_addr_cnt)
2381                 changed |= BSS_CHANGED_ARP_FILTER;
2382
2383         sdata->vif.bss_conf.qos = false;
2384         changed |= BSS_CHANGED_QOS;
2385
2386         /* The BSSID (not really interesting) and HT changed */
2387         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
2388         ieee80211_bss_info_change_notify(sdata, changed);
2389
2390         /* disassociated - set to defaults now */
2391         ieee80211_set_wmm_default(sdata, false, false);
2392
2393         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
2394         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
2395         del_timer_sync(&sdata->u.mgd.timer);
2396         del_timer_sync(&sdata->u.mgd.chswitch_timer);
2397
2398         sdata->vif.bss_conf.dtim_period = 0;
2399         sdata->vif.bss_conf.beacon_rate = NULL;
2400
2401         ifmgd->have_beacon = false;
2402
2403         ifmgd->flags = 0;
2404         mutex_lock(&local->mtx);
2405         ieee80211_vif_release_channel(sdata);
2406
2407         sdata->vif.csa_active = false;
2408         ifmgd->csa_waiting_bcn = false;
2409         ifmgd->csa_ignored_same_chan = false;
2410         if (sdata->csa_block_tx) {
2411                 ieee80211_wake_vif_queues(local, sdata,
2412                                           IEEE80211_QUEUE_STOP_REASON_CSA);
2413                 sdata->csa_block_tx = false;
2414         }
2415         mutex_unlock(&local->mtx);
2416
2417         /* existing TX TSPEC sessions no longer exist */
2418         memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
2419         cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
2420
2421         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2422 }
2423
2424 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
2425 {
2426         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2427         struct ieee80211_local *local = sdata->local;
2428
2429         mutex_lock(&local->mtx);
2430         if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
2431                 goto out;
2432
2433         __ieee80211_stop_poll(sdata);
2434
2435         mutex_lock(&local->iflist_mtx);
2436         ieee80211_recalc_ps(local);
2437         mutex_unlock(&local->iflist_mtx);
2438
2439         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2440                 goto out;
2441
2442         /*
2443          * We've received a probe response, but are not sure whether
2444          * we have or will be receiving any beacons or data, so let's
2445          * schedule the timers again, just in case.
2446          */
2447         ieee80211_sta_reset_beacon_monitor(sdata);
2448
2449         mod_timer(&ifmgd->conn_mon_timer,
2450                   round_jiffies_up(jiffies +
2451                                    IEEE80211_CONNECTION_IDLE_TIME));
2452 out:
2453         mutex_unlock(&local->mtx);
2454 }
2455
2456 static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
2457                                            struct ieee80211_hdr *hdr,
2458                                            u16 tx_time)
2459 {
2460         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2461         u16 tid;
2462         int ac;
2463         struct ieee80211_sta_tx_tspec *tx_tspec;
2464         unsigned long now = jiffies;
2465
2466         if (!ieee80211_is_data_qos(hdr->frame_control))
2467                 return;
2468
2469         tid = ieee80211_get_tid(hdr);
2470         ac = ieee80211_ac_from_tid(tid);
2471         tx_tspec = &ifmgd->tx_tspec[ac];
2472
2473         if (likely(!tx_tspec->admitted_time))
2474                 return;
2475
2476         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
2477                 tx_tspec->consumed_tx_time = 0;
2478                 tx_tspec->time_slice_start = now;
2479
2480                 if (tx_tspec->downgraded) {
2481                         tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
2482                         schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
2483                 }
2484         }
2485
2486         if (tx_tspec->downgraded)
2487                 return;
2488
2489         tx_tspec->consumed_tx_time += tx_time;
2490
2491         if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
2492                 tx_tspec->downgraded = true;
2493                 tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
2494                 schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
2495         }
2496 }
2497
2498 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2499                              struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2500 {
2501         ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
2502
2503         if (!ieee80211_is_any_nullfunc(hdr->frame_control) ||
2504             !sdata->u.mgd.probe_send_count)
2505                 return;
2506
2507         if (ack)
2508                 sdata->u.mgd.probe_send_count = 0;
2509         else
2510                 sdata->u.mgd.nullfunc_failed = true;
2511         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2512 }
2513
2514 static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
2515                                           const u8 *src, const u8 *dst,
2516                                           const u8 *ssid, size_t ssid_len,
2517                                           struct ieee80211_channel *channel)
2518 {
2519         struct sk_buff *skb;
2520
2521         skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
2522                                         ssid, ssid_len, NULL, 0,
2523                                         IEEE80211_PROBE_FLAG_DIRECTED);
2524         if (skb)
2525                 ieee80211_tx_skb(sdata, skb);
2526 }
2527
2528 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
2529 {
2530         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2531         const u8 *ssid;
2532         u8 *dst = ifmgd->associated->bssid;
2533         u8 unicast_limit = max(1, max_probe_tries - 3);
2534         struct sta_info *sta;
2535
2536         /*
2537          * Try sending broadcast probe requests for the last three
2538          * probe requests after the first ones failed since some
2539          * buggy APs only support broadcast probe requests.
2540          */
2541         if (ifmgd->probe_send_count >= unicast_limit)
2542                 dst = NULL;
2543
2544         /*
2545          * When the hardware reports an accurate Tx ACK status, it's
2546          * better to send a nullfunc frame instead of a probe request,
2547          * as it will kick us off the AP quickly if we aren't associated
2548          * anymore. The timeout will be reset if the frame is ACKed by
2549          * the AP.
2550          */
2551         ifmgd->probe_send_count++;
2552
2553         if (dst) {
2554                 mutex_lock(&sdata->local->sta_mtx);
2555                 sta = sta_info_get(sdata, dst);
2556                 if (!WARN_ON(!sta))
2557                         ieee80211_check_fast_rx(sta);
2558                 mutex_unlock(&sdata->local->sta_mtx);
2559         }
2560
2561         if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2562                 ifmgd->nullfunc_failed = false;
2563                 ieee80211_send_nullfunc(sdata->local, sdata, false);
2564         } else {
2565                 int ssid_len;
2566
2567                 rcu_read_lock();
2568                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2569                 if (WARN_ON_ONCE(ssid == NULL))
2570                         ssid_len = 0;
2571                 else
2572                         ssid_len = ssid[1];
2573
2574                 ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
2575                                               ssid + 2, ssid_len,
2576                                               ifmgd->associated->channel);
2577                 rcu_read_unlock();
2578         }
2579
2580         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2581         run_again(sdata, ifmgd->probe_timeout);
2582 }
2583
2584 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
2585                                    bool beacon)
2586 {
2587         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2588         bool already = false;
2589
2590         if (!ieee80211_sdata_running(sdata))
2591                 return;
2592
2593         sdata_lock(sdata);
2594
2595         if (!ifmgd->associated)
2596                 goto out;
2597
2598         mutex_lock(&sdata->local->mtx);
2599
2600         if (sdata->local->tmp_channel || sdata->local->scanning) {
2601                 mutex_unlock(&sdata->local->mtx);
2602                 goto out;
2603         }
2604
2605         if (beacon) {
2606                 mlme_dbg_ratelimited(sdata,
2607                                      "detected beacon loss from AP (missed %d beacons) - probing\n",
2608                                      beacon_loss_count);
2609
2610                 ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2611         }
2612
2613         /*
2614          * The driver/our work has already reported this event or the
2615          * connection monitoring has kicked in and we have already sent
2616          * a probe request. Or maybe the AP died and the driver keeps
2617          * reporting until we disassociate...
2618          *
2619          * In either case we have to ignore the current call to this
2620          * function (except for setting the correct probe reason bit)
2621          * because otherwise we would reset the timer every time and
2622          * never check whether we received a probe response!
2623          */
2624         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
2625                 already = true;
2626
2627         ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
2628
2629         mutex_unlock(&sdata->local->mtx);
2630
2631         if (already)
2632                 goto out;
2633
2634         mutex_lock(&sdata->local->iflist_mtx);
2635         ieee80211_recalc_ps(sdata->local);
2636         mutex_unlock(&sdata->local->iflist_mtx);
2637
2638         ifmgd->probe_send_count = 0;
2639         ieee80211_mgd_probe_ap_send(sdata);
2640  out:
2641         sdata_unlock(sdata);
2642 }
2643
2644 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
2645                                           struct ieee80211_vif *vif)
2646 {
2647         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2648         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2649         struct cfg80211_bss *cbss;
2650         struct sk_buff *skb;
2651         const u8 *ssid;
2652         int ssid_len;
2653
2654         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2655                 return NULL;
2656
2657         sdata_assert_lock(sdata);
2658
2659         if (ifmgd->associated)
2660                 cbss = ifmgd->associated;
2661         else if (ifmgd->auth_data)
2662                 cbss = ifmgd->auth_data->bss;
2663         else if (ifmgd->assoc_data)
2664                 cbss = ifmgd->assoc_data->bss;
2665         else
2666                 return NULL;
2667
2668         rcu_read_lock();
2669         ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2670         if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
2671                       "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
2672                 ssid_len = 0;
2673         else
2674                 ssid_len = ssid[1];
2675
2676         skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
2677                                         (u32) -1, cbss->channel,
2678                                         ssid + 2, ssid_len,
2679                                         NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
2680         rcu_read_unlock();
2681
2682         return skb;
2683 }
2684 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
2685
2686 static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
2687                                         const u8 *buf, size_t len, bool tx,
2688                                         u16 reason, bool reconnect)
2689 {
2690         struct ieee80211_event event = {
2691                 .type = MLME_EVENT,
2692                 .u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
2693                 .u.mlme.reason = reason,
2694         };
2695
2696         if (tx)
2697                 cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
2698         else
2699                 cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
2700
2701         drv_event_callback(sdata->local, sdata, &event);
2702 }
2703
2704 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2705 {
2706         struct ieee80211_local *local = sdata->local;
2707         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2708         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2709         bool tx;
2710
2711         sdata_lock(sdata);
2712         if (!ifmgd->associated) {
2713                 sdata_unlock(sdata);
2714                 return;
2715         }
2716
2717         tx = !sdata->csa_block_tx;
2718
2719         if (!ifmgd->driver_disconnect) {
2720                 /*
2721                  * AP is probably out of range (or not reachable for another
2722                  * reason) so remove the bss struct for that AP.
2723                  */
2724                 cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);
2725         }
2726
2727         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
2728                                ifmgd->driver_disconnect ?
2729                                         WLAN_REASON_DEAUTH_LEAVING :
2730                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2731                                tx, frame_buf);
2732         mutex_lock(&local->mtx);
2733         sdata->vif.csa_active = false;
2734         ifmgd->csa_waiting_bcn = false;
2735         if (sdata->csa_block_tx) {
2736                 ieee80211_wake_vif_queues(local, sdata,
2737                                           IEEE80211_QUEUE_STOP_REASON_CSA);
2738                 sdata->csa_block_tx = false;
2739         }
2740         mutex_unlock(&local->mtx);
2741
2742         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
2743                                     WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2744                                     ifmgd->reconnect);
2745         ifmgd->reconnect = false;
2746
2747         sdata_unlock(sdata);
2748 }
2749
2750 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
2751 {
2752         struct ieee80211_sub_if_data *sdata =
2753                 container_of(work, struct ieee80211_sub_if_data,
2754                              u.mgd.beacon_connection_loss_work);
2755         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2756
2757         if (ifmgd->associated)
2758                 ifmgd->beacon_loss_count++;
2759
2760         if (ifmgd->connection_loss) {
2761                 sdata_info(sdata, "Connection to AP %pM lost\n",
2762                            ifmgd->bssid);
2763                 __ieee80211_disconnect(sdata);
2764                 ifmgd->connection_loss = false;
2765         } else if (ifmgd->driver_disconnect) {
2766                 sdata_info(sdata,
2767                            "Driver requested disconnection from AP %pM\n",
2768                            ifmgd->bssid);
2769                 __ieee80211_disconnect(sdata);
2770                 ifmgd->driver_disconnect = false;
2771         } else {
2772                 ieee80211_mgd_probe_ap(sdata, true);
2773         }
2774 }
2775
2776 static void ieee80211_csa_connection_drop_work(struct work_struct *work)
2777 {
2778         struct ieee80211_sub_if_data *sdata =
2779                 container_of(work, struct ieee80211_sub_if_data,
2780                              u.mgd.csa_connection_drop_work);
2781
2782         __ieee80211_disconnect(sdata);
2783 }
2784
2785 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
2786 {
2787         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2788         struct ieee80211_hw *hw = &sdata->local->hw;
2789
2790         trace_api_beacon_loss(sdata);
2791
2792         sdata->u.mgd.connection_loss = false;
2793         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2794 }
2795 EXPORT_SYMBOL(ieee80211_beacon_loss);
2796
2797 void ieee80211_connection_loss(struct ieee80211_vif *vif)
2798 {
2799         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2800         struct ieee80211_hw *hw = &sdata->local->hw;
2801
2802         trace_api_connection_loss(sdata);
2803
2804         sdata->u.mgd.connection_loss = true;
2805         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2806 }
2807 EXPORT_SYMBOL(ieee80211_connection_loss);
2808
2809 void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
2810 {
2811         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2812         struct ieee80211_hw *hw = &sdata->local->hw;
2813
2814         trace_api_disconnect(sdata, reconnect);
2815
2816         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2817                 return;
2818
2819         sdata->u.mgd.driver_disconnect = true;
2820         sdata->u.mgd.reconnect = reconnect;
2821         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2822 }
2823 EXPORT_SYMBOL(ieee80211_disconnect);
2824
2825 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
2826                                         bool assoc)
2827 {
2828         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2829
2830         sdata_assert_lock(sdata);
2831
2832         if (!assoc) {
2833                 /*
2834                  * we are not authenticated yet, the only timer that could be
2835                  * running is the timeout for the authentication response which
2836                  * which is not relevant anymore.
2837                  */
2838                 del_timer_sync(&sdata->u.mgd.timer);
2839                 sta_info_destroy_addr(sdata, auth_data->bss->bssid);
2840
2841                 eth_zero_addr(sdata->u.mgd.bssid);
2842                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2843                 sdata->u.mgd.flags = 0;
2844                 mutex_lock(&sdata->local->mtx);
2845                 ieee80211_vif_release_channel(sdata);
2846                 mutex_unlock(&sdata->local->mtx);
2847         }
2848
2849         cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
2850         kfree(auth_data);
2851         sdata->u.mgd.auth_data = NULL;
2852 }
2853
2854 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2855                                          bool assoc, bool abandon)
2856 {
2857         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2858
2859         sdata_assert_lock(sdata);
2860
2861         if (!assoc) {
2862                 /*
2863                  * we are not associated yet, the only timer that could be
2864                  * running is the timeout for the association response which
2865                  * which is not relevant anymore.
2866                  */
2867                 del_timer_sync(&sdata->u.mgd.timer);
2868                 sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
2869
2870                 eth_zero_addr(sdata->u.mgd.bssid);
2871                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2872                 sdata->u.mgd.flags = 0;
2873                 sdata->vif.mu_mimo_owner = false;
2874
2875                 mutex_lock(&sdata->local->mtx);
2876                 ieee80211_vif_release_channel(sdata);
2877                 mutex_unlock(&sdata->local->mtx);
2878
2879                 if (abandon)
2880                         cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
2881         }
2882
2883         kfree(assoc_data);
2884         sdata->u.mgd.assoc_data = NULL;
2885 }
2886
2887 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
2888                                      struct ieee80211_mgmt *mgmt, size_t len)
2889 {
2890         struct ieee80211_local *local = sdata->local;
2891         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2892         const struct element *challenge;
2893         u8 *pos;
2894         u32 tx_flags = 0;
2895         struct ieee80211_prep_tx_info info = {
2896                 .subtype = IEEE80211_STYPE_AUTH,
2897         };
2898
2899         pos = mgmt->u.auth.variable;
2900         challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
2901                                        len - (pos - (u8 *)mgmt));
2902         if (!challenge)
2903                 return;
2904         auth_data->expected_transaction = 4;
2905         drv_mgd_prepare_tx(sdata->local, sdata, &info);
2906         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2907                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2908                            IEEE80211_TX_INTFL_MLME_CONN_TX;
2909         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
2910                             (void *)challenge,
2911                             challenge->datalen + sizeof(*challenge),
2912                             auth_data->bss->bssid, auth_data->bss->bssid,
2913                             auth_data->key, auth_data->key_len,
2914                             auth_data->key_idx, tx_flags);
2915 }
2916
2917 static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
2918                                     const u8 *bssid)
2919 {
2920         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2921         struct sta_info *sta;
2922         bool result = true;
2923
2924         sdata_info(sdata, "authenticated\n");
2925         ifmgd->auth_data->done = true;
2926         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2927         ifmgd->auth_data->timeout_started = true;
2928         run_again(sdata, ifmgd->auth_data->timeout);
2929
2930         /* move station state to auth */
2931         mutex_lock(&sdata->local->sta_mtx);
2932         sta = sta_info_get(sdata, bssid);
2933         if (!sta) {
2934                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2935                 result = false;
2936                 goto out;
2937         }
2938         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
2939                 sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2940                 result = false;
2941                 goto out;
2942         }
2943
2944 out:
2945         mutex_unlock(&sdata->local->sta_mtx);
2946         return result;
2947 }
2948
2949 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
2950                                    struct ieee80211_mgmt *mgmt, size_t len)
2951 {
2952         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2953         u8 bssid[ETH_ALEN];
2954         u16 auth_alg, auth_transaction, status_code;
2955         struct ieee80211_event event = {
2956                 .type = MLME_EVENT,
2957                 .u.mlme.data = AUTH_EVENT,
2958         };
2959         struct ieee80211_prep_tx_info info = {
2960                 .subtype = IEEE80211_STYPE_AUTH,
2961         };
2962
2963         sdata_assert_lock(sdata);
2964
2965         if (len < 24 + 6)
2966                 return;
2967
2968         if (!ifmgd->auth_data || ifmgd->auth_data->done)
2969                 return;
2970
2971         memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
2972
2973         if (!ether_addr_equal(bssid, mgmt->bssid))
2974                 return;
2975
2976         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
2977         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
2978         status_code = le16_to_cpu(mgmt->u.auth.status_code);
2979
2980         if (auth_alg != ifmgd->auth_data->algorithm ||
2981             (auth_alg != WLAN_AUTH_SAE &&
2982              auth_transaction != ifmgd->auth_data->expected_transaction) ||
2983             (auth_alg == WLAN_AUTH_SAE &&
2984              (auth_transaction < ifmgd->auth_data->expected_transaction ||
2985               auth_transaction > 2))) {
2986                 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
2987                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
2988                            auth_transaction,
2989                            ifmgd->auth_data->expected_transaction);
2990                 goto notify_driver;
2991         }
2992
2993         if (status_code != WLAN_STATUS_SUCCESS) {
2994                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2995
2996                 if (auth_alg == WLAN_AUTH_SAE &&
2997                     (status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED ||
2998                      (auth_transaction == 1 &&
2999                       (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
3000                        status_code == WLAN_STATUS_SAE_PK)))) {
3001                         /* waiting for userspace now */
3002                         ifmgd->auth_data->waiting = true;
3003                         ifmgd->auth_data->timeout =
3004                                 jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY;
3005                         ifmgd->auth_data->timeout_started = true;
3006                         run_again(sdata, ifmgd->auth_data->timeout);
3007                         goto notify_driver;
3008                 }
3009
3010                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
3011                            mgmt->sa, status_code);
3012                 ieee80211_destroy_auth_data(sdata, false);
3013                 event.u.mlme.status = MLME_DENIED;
3014                 event.u.mlme.reason = status_code;
3015                 drv_event_callback(sdata->local, sdata, &event);
3016                 goto notify_driver;
3017         }
3018
3019         switch (ifmgd->auth_data->algorithm) {
3020         case WLAN_AUTH_OPEN:
3021         case WLAN_AUTH_LEAP:
3022         case WLAN_AUTH_FT:
3023         case WLAN_AUTH_SAE:
3024         case WLAN_AUTH_FILS_SK:
3025         case WLAN_AUTH_FILS_SK_PFS:
3026         case WLAN_AUTH_FILS_PK:
3027                 break;
3028         case WLAN_AUTH_SHARED_KEY:
3029                 if (ifmgd->auth_data->expected_transaction != 4) {
3030                         ieee80211_auth_challenge(sdata, mgmt, len);
3031                         /* need another frame */
3032                         return;
3033                 }
3034                 break;
3035         default:
3036                 WARN_ONCE(1, "invalid auth alg %d",
3037                           ifmgd->auth_data->algorithm);
3038                 goto notify_driver;
3039         }
3040
3041         event.u.mlme.status = MLME_SUCCESS;
3042         info.success = 1;
3043         drv_event_callback(sdata->local, sdata, &event);
3044         if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
3045             (auth_transaction == 2 &&
3046              ifmgd->auth_data->expected_transaction == 2)) {
3047                 if (!ieee80211_mark_sta_auth(sdata, bssid))
3048                         return; /* ignore frame -- wait for timeout */
3049         } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
3050                    auth_transaction == 2) {
3051                 sdata_info(sdata, "SAE peer confirmed\n");
3052                 ifmgd->auth_data->peer_confirmed = true;
3053         }
3054
3055         cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3056 notify_driver:
3057         drv_mgd_complete_tx(sdata->local, sdata, &info);
3058 }
3059
3060 #define case_WLAN(type) \
3061         case WLAN_REASON_##type: return #type
3062
3063 const char *ieee80211_get_reason_code_string(u16 reason_code)
3064 {
3065         switch (reason_code) {
3066         case_WLAN(UNSPECIFIED);
3067         case_WLAN(PREV_AUTH_NOT_VALID);
3068         case_WLAN(DEAUTH_LEAVING);
3069         case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
3070         case_WLAN(DISASSOC_AP_BUSY);
3071         case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
3072         case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
3073         case_WLAN(DISASSOC_STA_HAS_LEFT);
3074         case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
3075         case_WLAN(DISASSOC_BAD_POWER);
3076         case_WLAN(DISASSOC_BAD_SUPP_CHAN);
3077         case_WLAN(INVALID_IE);
3078         case_WLAN(MIC_FAILURE);
3079         case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
3080         case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
3081         case_WLAN(IE_DIFFERENT);
3082         case_WLAN(INVALID_GROUP_CIPHER);
3083         case_WLAN(INVALID_PAIRWISE_CIPHER);
3084         case_WLAN(INVALID_AKMP);
3085         case_WLAN(UNSUPP_RSN_VERSION);
3086         case_WLAN(INVALID_RSN_IE_CAP);
3087         case_WLAN(IEEE8021X_FAILED);
3088         case_WLAN(CIPHER_SUITE_REJECTED);
3089         case_WLAN(DISASSOC_UNSPECIFIED_QOS);
3090         case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
3091         case_WLAN(DISASSOC_LOW_ACK);
3092         case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
3093         case_WLAN(QSTA_LEAVE_QBSS);
3094         case_WLAN(QSTA_NOT_USE);
3095         case_WLAN(QSTA_REQUIRE_SETUP);
3096         case_WLAN(QSTA_TIMEOUT);
3097         case_WLAN(QSTA_CIPHER_NOT_SUPP);
3098         case_WLAN(MESH_PEER_CANCELED);
3099         case_WLAN(MESH_MAX_PEERS);
3100         case_WLAN(MESH_CONFIG);
3101         case_WLAN(MESH_CLOSE);
3102         case_WLAN(MESH_MAX_RETRIES);
3103         case_WLAN(MESH_CONFIRM_TIMEOUT);
3104         case_WLAN(MESH_INVALID_GTK);
3105         case_WLAN(MESH_INCONSISTENT_PARAM);
3106         case_WLAN(MESH_INVALID_SECURITY);
3107         case_WLAN(MESH_PATH_ERROR);
3108         case_WLAN(MESH_PATH_NOFORWARD);
3109         case_WLAN(MESH_PATH_DEST_UNREACHABLE);
3110         case_WLAN(MAC_EXISTS_IN_MBSS);
3111         case_WLAN(MESH_CHAN_REGULATORY);
3112         case_WLAN(MESH_CHAN);
3113         default: return "<unknown>";
3114         }
3115 }
3116
3117 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
3118                                      struct ieee80211_mgmt *mgmt, size_t len)
3119 {
3120         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3121         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3122
3123         sdata_assert_lock(sdata);
3124
3125         if (len < 24 + 2)
3126                 return;
3127
3128         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3129                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3130                 return;
3131         }
3132
3133         if (ifmgd->associated &&
3134             ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
3135                 const u8 *bssid = ifmgd->associated->bssid;
3136
3137                 sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
3138                            bssid, reason_code,
3139                            ieee80211_get_reason_code_string(reason_code));
3140
3141                 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3142
3143                 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
3144                                             reason_code, false);
3145                 return;
3146         }
3147
3148         if (ifmgd->assoc_data &&
3149             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
3150                 const u8 *bssid = ifmgd->assoc_data->bss->bssid;
3151
3152                 sdata_info(sdata,
3153                            "deauthenticated from %pM while associating (Reason: %u=%s)\n",
3154                            bssid, reason_code,
3155                            ieee80211_get_reason_code_string(reason_code));
3156
3157                 ieee80211_destroy_assoc_data(sdata, false, true);
3158
3159                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3160                 return;
3161         }
3162 }
3163
3164
3165 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
3166                                        struct ieee80211_mgmt *mgmt, size_t len)
3167 {
3168         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3169         u16 reason_code;
3170
3171         sdata_assert_lock(sdata);
3172
3173         if (len < 24 + 2)
3174                 return;
3175
3176         if (!ifmgd->associated ||
3177             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3178                 return;
3179
3180         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
3181
3182         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3183                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3184                 return;
3185         }
3186
3187         sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
3188                    mgmt->sa, reason_code,
3189                    ieee80211_get_reason_code_string(reason_code));
3190
3191         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3192
3193         ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
3194                                     false);
3195 }
3196
3197 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
3198                                 u8 *supp_rates, unsigned int supp_rates_len,
3199                                 u32 *rates, u32 *basic_rates,
3200                                 bool *have_higher_than_11mbit,
3201                                 int *min_rate, int *min_rate_index,
3202                                 int shift)
3203 {
3204         int i, j;
3205
3206         for (i = 0; i < supp_rates_len; i++) {
3207                 int rate = supp_rates[i] & 0x7f;
3208                 bool is_basic = !!(supp_rates[i] & 0x80);
3209
3210                 if ((rate * 5 * (1 << shift)) > 110)
3211                         *have_higher_than_11mbit = true;
3212
3213                 /*
3214                  * Skip HT, VHT, HE and SAE H2E only BSS membership selectors
3215                  * since they're not rates.
3216                  *
3217                  * Note: Even though the membership selector and the basic
3218                  *       rate flag share the same bit, they are not exactly
3219                  *       the same.
3220                  */
3221                 if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3222                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
3223                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY) ||
3224                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E))
3225                         continue;
3226
3227                 for (j = 0; j < sband->n_bitrates; j++) {
3228                         struct ieee80211_rate *br;
3229                         int brate;
3230
3231                         br = &sband->bitrates[j];
3232
3233                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
3234                         if (brate == rate) {
3235                                 *rates |= BIT(j);
3236                                 if (is_basic)
3237                                         *basic_rates |= BIT(j);
3238                                 if ((rate * 5) < *min_rate) {
3239                                         *min_rate = rate * 5;
3240                                         *min_rate_index = j;
3241                                 }
3242                                 break;
3243                         }
3244                 }
3245         }
3246 }
3247
3248 static bool ieee80211_twt_req_supported(const struct sta_info *sta,
3249                                         const struct ieee802_11_elems *elems)
3250 {
3251         if (elems->ext_capab_len < 10)
3252                 return false;
3253
3254         if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
3255                 return false;
3256
3257         return sta->sta.he_cap.he_cap_elem.mac_cap_info[0] &
3258                 IEEE80211_HE_MAC_CAP0_TWT_RES;
3259 }
3260
3261 static int ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
3262                                     struct sta_info *sta,
3263                                     struct ieee802_11_elems *elems)
3264 {
3265         bool twt = ieee80211_twt_req_supported(sta, elems);
3266
3267         if (sdata->vif.bss_conf.twt_requester != twt) {
3268                 sdata->vif.bss_conf.twt_requester = twt;
3269                 return BSS_CHANGED_TWT;
3270         }
3271         return 0;
3272 }
3273
3274 static bool ieee80211_twt_bcast_support(struct ieee80211_sub_if_data *sdata,
3275                                         struct ieee80211_bss_conf *bss_conf,
3276                                         struct ieee80211_supported_band *sband,
3277                                         struct sta_info *sta)
3278 {
3279         const struct ieee80211_sta_he_cap *own_he_cap =
3280                 ieee80211_get_he_iftype_cap(sband,
3281                                             ieee80211_vif_type_p2p(&sdata->vif));
3282
3283         return bss_conf->he_support &&
3284                 (sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
3285                         IEEE80211_HE_MAC_CAP2_BCAST_TWT) &&
3286                 own_he_cap &&
3287                 (own_he_cap->he_cap_elem.mac_cap_info[2] &
3288                         IEEE80211_HE_MAC_CAP2_BCAST_TWT);
3289 }
3290
3291 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
3292                                     struct cfg80211_bss *cbss,
3293                                     struct ieee80211_mgmt *mgmt, size_t len,
3294                                     struct ieee802_11_elems *elems)
3295 {
3296         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3297         struct ieee80211_local *local = sdata->local;
3298         struct ieee80211_supported_band *sband;
3299         struct sta_info *sta;
3300         u16 capab_info, aid;
3301         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3302         const struct cfg80211_bss_ies *bss_ies = NULL;
3303         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
3304         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
3305         bool is_s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
3306         u32 changed = 0;
3307         u8 *pos;
3308         int err;
3309         bool ret;
3310
3311         /* AssocResp and ReassocResp have identical structure */
3312
3313         pos = mgmt->u.assoc_resp.variable;
3314         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
3315         if (is_s1g) {
3316                 pos = (u8 *) mgmt->u.s1g_assoc_resp.variable;
3317                 aid = 0; /* TODO */
3318         }
3319         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3320         ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, elems,
3321                                mgmt->bssid, assoc_data->bss->bssid);
3322
3323         if (elems->aid_resp)
3324                 aid = le16_to_cpu(elems->aid_resp->aid);
3325
3326         /*
3327          * The 5 MSB of the AID field are reserved
3328          * (802.11-2016 9.4.1.8 AID field)
3329          */
3330         aid &= 0x7ff;
3331
3332         ifmgd->broken_ap = false;
3333
3334         if (aid == 0 || aid > IEEE80211_MAX_AID) {
3335                 sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
3336                            aid);
3337                 aid = 0;
3338                 ifmgd->broken_ap = true;
3339         }
3340
3341         if (!is_s1g && !elems->supp_rates) {
3342                 sdata_info(sdata, "no SuppRates element in AssocResp\n");
3343                 return false;
3344         }
3345
3346         sdata->vif.bss_conf.aid = aid;
3347         ifmgd->tdls_chan_switch_prohibited =
3348                 elems->ext_capab && elems->ext_capab_len >= 5 &&
3349                 (elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
3350
3351         /*
3352          * Some APs are erroneously not including some information in their
3353          * (re)association response frames. Try to recover by using the data
3354          * from the beacon or probe response. This seems to afflict mobile
3355          * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
3356          * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
3357          */
3358         if (!is_6ghz &&
3359             ((assoc_data->wmm && !elems->wmm_param) ||
3360              (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3361               (!elems->ht_cap_elem || !elems->ht_operation)) ||
3362              (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3363               (!elems->vht_cap_elem || !elems->vht_operation)))) {
3364                 const struct cfg80211_bss_ies *ies;
3365                 struct ieee802_11_elems bss_elems;
3366
3367                 rcu_read_lock();
3368                 ies = rcu_dereference(cbss->ies);
3369                 if (ies)
3370                         bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
3371                                           GFP_ATOMIC);
3372                 rcu_read_unlock();
3373                 if (!bss_ies)
3374                         return false;
3375
3376                 ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
3377                                        false, &bss_elems,
3378                                        mgmt->bssid,
3379                                        assoc_data->bss->bssid);
3380                 if (assoc_data->wmm &&
3381                     !elems->wmm_param && bss_elems.wmm_param) {
3382                         elems->wmm_param = bss_elems.wmm_param;
3383                         sdata_info(sdata,
3384                                    "AP bug: WMM param missing from AssocResp\n");
3385                 }
3386
3387                 /*
3388                  * Also check if we requested HT/VHT, otherwise the AP doesn't
3389                  * have to include the IEs in the (re)association response.
3390                  */
3391                 if (!elems->ht_cap_elem && bss_elems.ht_cap_elem &&
3392                     !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3393                         elems->ht_cap_elem = bss_elems.ht_cap_elem;
3394                         sdata_info(sdata,
3395                                    "AP bug: HT capability missing from AssocResp\n");
3396                 }
3397                 if (!elems->ht_operation && bss_elems.ht_operation &&
3398                     !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3399                         elems->ht_operation = bss_elems.ht_operation;
3400                         sdata_info(sdata,
3401                                    "AP bug: HT operation missing from AssocResp\n");
3402                 }
3403                 if (!elems->vht_cap_elem && bss_elems.vht_cap_elem &&
3404                     !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3405                         elems->vht_cap_elem = bss_elems.vht_cap_elem;
3406                         sdata_info(sdata,
3407                                    "AP bug: VHT capa missing from AssocResp\n");
3408                 }
3409                 if (!elems->vht_operation && bss_elems.vht_operation &&
3410                     !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3411                         elems->vht_operation = bss_elems.vht_operation;
3412                         sdata_info(sdata,
3413                                    "AP bug: VHT operation missing from AssocResp\n");
3414                 }
3415         }
3416
3417         /*
3418          * We previously checked these in the beacon/probe response, so
3419          * they should be present here. This is just a safety net.
3420          */
3421         if (!is_6ghz && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3422             (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
3423                 sdata_info(sdata,
3424                            "HT AP is missing WMM params or HT capability/operation\n");
3425                 ret = false;
3426                 goto out;
3427         }
3428
3429         if (!is_6ghz && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3430             (!elems->vht_cap_elem || !elems->vht_operation)) {
3431                 sdata_info(sdata,
3432                            "VHT AP is missing VHT capability/operation\n");
3433                 ret = false;
3434                 goto out;
3435         }
3436
3437         if (is_6ghz && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3438             !elems->he_6ghz_capa) {
3439                 sdata_info(sdata,
3440                            "HE 6 GHz AP is missing HE 6 GHz band capability\n");
3441                 ret = false;
3442                 goto out;
3443         }
3444
3445         mutex_lock(&sdata->local->sta_mtx);
3446         /*
3447          * station info was already allocated and inserted before
3448          * the association and should be available to us
3449          */
3450         sta = sta_info_get(sdata, cbss->bssid);
3451         if (WARN_ON(!sta)) {
3452                 mutex_unlock(&sdata->local->sta_mtx);
3453                 ret = false;
3454                 goto out;
3455         }
3456
3457         sband = ieee80211_get_sband(sdata);
3458         if (!sband) {
3459                 mutex_unlock(&sdata->local->sta_mtx);
3460                 ret = false;
3461                 goto out;
3462         }
3463
3464         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3465             (!elems->he_cap || !elems->he_operation)) {
3466                 mutex_unlock(&sdata->local->sta_mtx);
3467                 sdata_info(sdata,
3468                            "HE AP is missing HE capability/operation\n");
3469                 ret = false;
3470                 goto out;
3471         }
3472
3473         /* Set up internal HT/VHT capabilities */
3474         if (elems->ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
3475                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3476                                                   elems->ht_cap_elem, sta);
3477
3478         if (elems->vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
3479                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3480                                                     elems->vht_cap_elem, sta);
3481
3482         if (elems->he_operation && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3483             elems->he_cap) {
3484                 ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
3485                                                   elems->he_cap,
3486                                                   elems->he_cap_len,
3487                                                   elems->he_6ghz_capa,
3488                                                   sta);
3489
3490                 bss_conf->he_support = sta->sta.he_cap.has_he;
3491                 if (elems->rsnx && elems->rsnx_len &&
3492                     (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
3493                     wiphy_ext_feature_isset(local->hw.wiphy,
3494                                             NL80211_EXT_FEATURE_PROTECTED_TWT))
3495                         bss_conf->twt_protected = true;
3496                 else
3497                         bss_conf->twt_protected = false;
3498
3499                 changed |= ieee80211_recalc_twt_req(sdata, sta, elems);
3500         } else {
3501                 bss_conf->he_support = false;
3502                 bss_conf->twt_requester = false;
3503                 bss_conf->twt_protected = false;
3504         }
3505
3506         bss_conf->twt_broadcast =
3507                 ieee80211_twt_bcast_support(sdata, bss_conf, sband, sta);
3508
3509         if (bss_conf->he_support) {
3510                 bss_conf->he_bss_color.color =
3511                         le32_get_bits(elems->he_operation->he_oper_params,
3512                                       IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3513                 bss_conf->he_bss_color.partial =
3514                         le32_get_bits(elems->he_operation->he_oper_params,
3515                                       IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
3516                 bss_conf->he_bss_color.enabled =
3517                         !le32_get_bits(elems->he_operation->he_oper_params,
3518                                        IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
3519
3520                 if (bss_conf->he_bss_color.enabled)
3521                         changed |= BSS_CHANGED_HE_BSS_COLOR;
3522
3523                 bss_conf->htc_trig_based_pkt_ext =
3524                         le32_get_bits(elems->he_operation->he_oper_params,
3525                               IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
3526                 bss_conf->frame_time_rts_th =
3527                         le32_get_bits(elems->he_operation->he_oper_params,
3528                               IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
3529
3530                 bss_conf->uora_exists = !!elems->uora_element;
3531                 if (elems->uora_element)
3532                         bss_conf->uora_ocw_range = elems->uora_element[0];
3533
3534                 ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
3535                 ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
3536                 /* TODO: OPEN: what happens if BSS color disable is set? */
3537         }
3538
3539         if (cbss->transmitted_bss) {
3540                 bss_conf->nontransmitted = true;
3541                 ether_addr_copy(bss_conf->transmitter_bssid,
3542                                 cbss->transmitted_bss->bssid);
3543                 bss_conf->bssid_indicator = cbss->max_bssid_indicator;
3544                 bss_conf->bssid_index = cbss->bssid_index;
3545         } else {
3546                 bss_conf->nontransmitted = false;
3547                 memset(bss_conf->transmitter_bssid, 0,
3548                        sizeof(bss_conf->transmitter_bssid));
3549                 bss_conf->bssid_indicator = 0;
3550                 bss_conf->bssid_index = 0;
3551         }
3552
3553         /*
3554          * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
3555          * in their association response, so ignore that data for our own
3556          * configuration. If it changed since the last beacon, we'll get the
3557          * next beacon and update then.
3558          */
3559
3560         /*
3561          * If an operating mode notification IE is present, override the
3562          * NSS calculation (that would be done in rate_control_rate_init())
3563          * and use the # of streams from that element.
3564          */
3565         if (elems->opmode_notif &&
3566             !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
3567                 u8 nss;
3568
3569                 nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
3570                 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
3571                 nss += 1;
3572                 sta->sta.rx_nss = nss;
3573         }
3574
3575         rate_control_rate_init(sta);
3576
3577         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
3578                 set_sta_flag(sta, WLAN_STA_MFP);
3579                 sta->sta.mfp = true;
3580         } else {
3581                 sta->sta.mfp = false;
3582         }
3583
3584         sta->sta.wme = (elems->wmm_param || elems->s1g_capab) &&
3585                        local->hw.queues >= IEEE80211_NUM_ACS;
3586
3587         err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3588         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
3589                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
3590         if (err) {
3591                 sdata_info(sdata,
3592                            "failed to move station %pM to desired state\n",
3593                            sta->sta.addr);
3594                 WARN_ON(__sta_info_destroy(sta));
3595                 mutex_unlock(&sdata->local->sta_mtx);
3596                 ret = false;
3597                 goto out;
3598         }
3599
3600         if (sdata->wdev.use_4addr)
3601                 drv_sta_set_4addr(local, sdata, &sta->sta, true);
3602
3603         mutex_unlock(&sdata->local->sta_mtx);
3604
3605         /*
3606          * Always handle WMM once after association regardless
3607          * of the first value the AP uses. Setting -1 here has
3608          * that effect because the AP values is an unsigned
3609          * 4-bit value.
3610          */
3611         ifmgd->wmm_last_param_set = -1;
3612         ifmgd->mu_edca_last_param_set = -1;
3613
3614         if (ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
3615                 ieee80211_set_wmm_default(sdata, false, false);
3616         } else if (!ieee80211_sta_wmm_params(local, sdata, elems->wmm_param,
3617                                              elems->wmm_param_len,
3618                                              elems->mu_edca_param_set)) {
3619                 /* still enable QoS since we might have HT/VHT */
3620                 ieee80211_set_wmm_default(sdata, false, true);
3621                 /* set the disable-WMM flag in this case to disable
3622                  * tracking WMM parameter changes in the beacon if
3623                  * the parameters weren't actually valid. Doing so
3624                  * avoids changing parameters very strangely when
3625                  * the AP is going back and forth between valid and
3626                  * invalid parameters.
3627                  */
3628                 ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
3629         }
3630         changed |= BSS_CHANGED_QOS;
3631
3632         if (elems->max_idle_period_ie) {
3633                 bss_conf->max_idle_period =
3634                         le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
3635                 bss_conf->protected_keep_alive =
3636                         !!(elems->max_idle_period_ie->idle_options &
3637                            WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
3638                 changed |= BSS_CHANGED_KEEP_ALIVE;
3639         } else {
3640                 bss_conf->max_idle_period = 0;
3641                 bss_conf->protected_keep_alive = false;
3642         }
3643
3644         /* set assoc capability (AID was already set earlier),
3645          * ieee80211_set_associated() will tell the driver */
3646         bss_conf->assoc_capability = capab_info;
3647         ieee80211_set_associated(sdata, cbss, changed);
3648
3649         /*
3650          * If we're using 4-addr mode, let the AP know that we're
3651          * doing so, so that it can create the STA VLAN on its side
3652          */
3653         if (ifmgd->use_4addr)
3654                 ieee80211_send_4addr_nullfunc(local, sdata);
3655
3656         /*
3657          * Start timer to probe the connection to the AP now.
3658          * Also start the timer that will detect beacon loss.
3659          */
3660         ieee80211_sta_reset_beacon_monitor(sdata);
3661         ieee80211_sta_reset_conn_monitor(sdata);
3662
3663         ret = true;
3664  out:
3665         kfree(bss_ies);
3666         return ret;
3667 }
3668
3669 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
3670                                          struct ieee80211_mgmt *mgmt,
3671                                          size_t len)
3672 {
3673         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3674         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
3675         u16 capab_info, status_code, aid;
3676         struct ieee802_11_elems elems;
3677         int ac, uapsd_queues = -1;
3678         u8 *pos;
3679         bool reassoc;
3680         struct cfg80211_bss *cbss;
3681         struct ieee80211_event event = {
3682                 .type = MLME_EVENT,
3683                 .u.mlme.data = ASSOC_EVENT,
3684         };
3685         struct ieee80211_prep_tx_info info = {};
3686
3687         sdata_assert_lock(sdata);
3688
3689         if (!assoc_data)
3690                 return;
3691
3692         if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3693                 return;
3694
3695         cbss = assoc_data->bss;
3696
3697         /*
3698          * AssocResp and ReassocResp have identical structure, so process both
3699          * of them in this function.
3700          */
3701
3702         if (len < 24 + 6)
3703                 return;
3704
3705         reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
3706         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3707         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
3708         pos = mgmt->u.assoc_resp.variable;
3709         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
3710         if (cbss->channel->band == NL80211_BAND_S1GHZ) {
3711                 pos = (u8 *) mgmt->u.s1g_assoc_resp.variable;
3712                 aid = 0; /* TODO */
3713         }
3714
3715         /*
3716          * Note: this may not be perfect, AP might misbehave - if
3717          * anyone needs to rely on perfect complete notification
3718          * with the exact right subtype, then we need to track what
3719          * we actually transmitted.
3720          */
3721         info.subtype = reassoc ? IEEE80211_STYPE_REASSOC_REQ :
3722                                  IEEE80211_STYPE_ASSOC_REQ;
3723
3724         sdata_info(sdata,
3725                    "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
3726                    reassoc ? "Rea" : "A", mgmt->sa,
3727                    capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
3728
3729         if (assoc_data->fils_kek_len &&
3730             fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
3731                 return;
3732
3733         ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
3734                                mgmt->bssid, assoc_data->bss->bssid);
3735
3736         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3737             elems.timeout_int &&
3738             elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
3739                 u32 tu, ms;
3740                 tu = le32_to_cpu(elems.timeout_int->value);
3741                 ms = tu * 1024 / 1000;
3742                 sdata_info(sdata,
3743                            "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
3744                            mgmt->sa, tu, ms);
3745                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3746                 assoc_data->timeout_started = true;
3747                 if (ms > IEEE80211_ASSOC_TIMEOUT)
3748                         run_again(sdata, assoc_data->timeout);
3749                 goto notify_driver;
3750         }
3751
3752         if (status_code != WLAN_STATUS_SUCCESS) {
3753                 sdata_info(sdata, "%pM denied association (code=%d)\n",
3754                            mgmt->sa, status_code);
3755                 ieee80211_destroy_assoc_data(sdata, false, false);
3756                 event.u.mlme.status = MLME_DENIED;
3757                 event.u.mlme.reason = status_code;
3758                 drv_event_callback(sdata->local, sdata, &event);
3759         } else {
3760                 if (!ieee80211_assoc_success(sdata, cbss, mgmt, len, &elems)) {
3761                         /* oops -- internal error -- send timeout for now */
3762                         ieee80211_destroy_assoc_data(sdata, false, false);
3763                         cfg80211_assoc_timeout(sdata->dev, cbss);
3764                         goto notify_driver;
3765                 }
3766                 event.u.mlme.status = MLME_SUCCESS;
3767                 drv_event_callback(sdata->local, sdata, &event);
3768                 sdata_info(sdata, "associated\n");
3769
3770                 /*
3771                  * destroy assoc_data afterwards, as otherwise an idle
3772                  * recalc after assoc_data is NULL but before associated
3773                  * is set can cause the interface to go idle
3774                  */
3775                 ieee80211_destroy_assoc_data(sdata, true, false);
3776
3777                 /* get uapsd queues configuration */
3778                 uapsd_queues = 0;
3779                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
3780                         if (sdata->tx_conf[ac].uapsd)
3781                                 uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
3782
3783                 info.success = 1;
3784         }
3785
3786         cfg80211_rx_assoc_resp(sdata->dev, cbss, (u8 *)mgmt, len, uapsd_queues,
3787                                ifmgd->assoc_req_ies, ifmgd->assoc_req_ies_len);
3788 notify_driver:
3789         drv_mgd_complete_tx(sdata->local, sdata, &info);
3790 }
3791
3792 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
3793                                   struct ieee80211_mgmt *mgmt, size_t len,
3794                                   struct ieee80211_rx_status *rx_status)
3795 {
3796         struct ieee80211_local *local = sdata->local;
3797         struct ieee80211_bss *bss;
3798         struct ieee80211_channel *channel;
3799
3800         sdata_assert_lock(sdata);
3801
3802         channel = ieee80211_get_channel_khz(local->hw.wiphy,
3803                                         ieee80211_rx_status_to_khz(rx_status));
3804         if (!channel)
3805                 return;
3806
3807         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
3808         if (bss) {
3809                 sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3810                 ieee80211_rx_bss_put(local, bss);
3811         }
3812 }
3813
3814
3815 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
3816                                          struct sk_buff *skb)
3817 {
3818         struct ieee80211_mgmt *mgmt = (void *)skb->data;
3819         struct ieee80211_if_managed *ifmgd;
3820         struct ieee80211_rx_status *rx_status = (void *) skb->cb;
3821         struct ieee80211_channel *channel;
3822         size_t baselen, len = skb->len;
3823
3824         ifmgd = &sdata->u.mgd;
3825
3826         sdata_assert_lock(sdata);
3827
3828         /*
3829          * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
3830          * "If a 6 GHz AP receives a Probe Request frame  and responds with
3831          * a Probe Response frame [..], the Address 1 field of the Probe
3832          * Response frame shall be set to the broadcast address [..]"
3833          * So, on 6GHz band we should also accept broadcast responses.
3834          */
3835         channel = ieee80211_get_channel(sdata->local->hw.wiphy,
3836                                         rx_status->freq);
3837         if (!channel)
3838                 return;
3839
3840         if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
3841             (channel->band != NL80211_BAND_6GHZ ||
3842              !is_broadcast_ether_addr(mgmt->da)))
3843                 return; /* ignore ProbeResp to foreign address */
3844
3845         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
3846         if (baselen > len)
3847                 return;
3848
3849         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
3850
3851         if (ifmgd->associated &&
3852             ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3853                 ieee80211_reset_ap_probe(sdata);
3854 }
3855
3856 /*
3857  * This is the canonical list of information elements we care about,
3858  * the filter code also gives us all changes to the Microsoft OUI
3859  * (00:50:F2) vendor IE which is used for WMM which we need to track,
3860  * as well as the DTPC IE (part of the Cisco OUI) used for signaling
3861  * changes to requested client power.
3862  *
3863  * We implement beacon filtering in software since that means we can
3864  * avoid processing the frame here and in cfg80211, and userspace
3865  * will not be able to tell whether the hardware supports it or not.
3866  *
3867  * XXX: This list needs to be dynamic -- userspace needs to be able to
3868  *      add items it requires. It also needs to be able to tell us to
3869  *      look out for other vendor IEs.
3870  */
3871 static const u64 care_about_ies =
3872         (1ULL << WLAN_EID_COUNTRY) |
3873         (1ULL << WLAN_EID_ERP_INFO) |
3874         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
3875         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
3876         (1ULL << WLAN_EID_HT_CAPABILITY) |
3877         (1ULL << WLAN_EID_HT_OPERATION) |
3878         (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3879
3880 static void ieee80211_handle_beacon_sig(struct ieee80211_sub_if_data *sdata,
3881                                         struct ieee80211_if_managed *ifmgd,
3882                                         struct ieee80211_bss_conf *bss_conf,
3883                                         struct ieee80211_local *local,
3884                                         struct ieee80211_rx_status *rx_status)
3885 {
3886         /* Track average RSSI from the Beacon frames of the current AP */
3887
3888         if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
3889                 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3890                 ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3891                 ifmgd->last_cqm_event_signal = 0;
3892                 ifmgd->count_beacon_signal = 1;
3893                 ifmgd->last_ave_beacon_signal = 0;
3894         } else {
3895                 ifmgd->count_beacon_signal++;
3896         }
3897
3898         ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);
3899
3900         if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
3901             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3902                 int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3903                 int last_sig = ifmgd->last_ave_beacon_signal;
3904                 struct ieee80211_event event = {
3905                         .type = RSSI_EVENT,
3906                 };
3907
3908                 /*
3909                  * if signal crosses either of the boundaries, invoke callback
3910                  * with appropriate parameters
3911                  */
3912                 if (sig > ifmgd->rssi_max_thold &&
3913                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
3914                         ifmgd->last_ave_beacon_signal = sig;
3915                         event.u.rssi.data = RSSI_EVENT_HIGH;
3916                         drv_event_callback(local, sdata, &event);
3917                 } else if (sig < ifmgd->rssi_min_thold &&
3918                            (last_sig >= ifmgd->rssi_max_thold ||
3919                            last_sig == 0)) {
3920                         ifmgd->last_ave_beacon_signal = sig;
3921                         event.u.rssi.data = RSSI_EVENT_LOW;
3922                         drv_event_callback(local, sdata, &event);
3923                 }
3924         }
3925
3926         if (bss_conf->cqm_rssi_thold &&
3927             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3928             !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3929                 int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3930                 int last_event = ifmgd->last_cqm_event_signal;
3931                 int thold = bss_conf->cqm_rssi_thold;
3932                 int hyst = bss_conf->cqm_rssi_hyst;
3933
3934                 if (sig < thold &&
3935                     (last_event == 0 || sig < last_event - hyst)) {
3936                         ifmgd->last_cqm_event_signal = sig;
3937                         ieee80211_cqm_rssi_notify(
3938                                 &sdata->vif,
3939                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3940                                 sig, GFP_KERNEL);
3941                 } else if (sig > thold &&
3942                            (last_event == 0 || sig > last_event + hyst)) {
3943                         ifmgd->last_cqm_event_signal = sig;
3944                         ieee80211_cqm_rssi_notify(
3945                                 &sdata->vif,
3946                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3947                                 sig, GFP_KERNEL);
3948                 }
3949         }
3950
3951         if (bss_conf->cqm_rssi_low &&
3952             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3953                 int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3954                 int last_event = ifmgd->last_cqm_event_signal;
3955                 int low = bss_conf->cqm_rssi_low;
3956                 int high = bss_conf->cqm_rssi_high;
3957
3958                 if (sig < low &&
3959                     (last_event == 0 || last_event >= low)) {
3960                         ifmgd->last_cqm_event_signal = sig;
3961                         ieee80211_cqm_rssi_notify(
3962                                 &sdata->vif,
3963                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3964                                 sig, GFP_KERNEL);
3965                 } else if (sig > high &&
3966                            (last_event == 0 || last_event <= high)) {
3967                         ifmgd->last_cqm_event_signal = sig;
3968                         ieee80211_cqm_rssi_notify(
3969                                 &sdata->vif,
3970                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3971                                 sig, GFP_KERNEL);
3972                 }
3973         }
3974 }
3975
3976 static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
3977                                     struct cfg80211_bss *bss)
3978 {
3979         if (ether_addr_equal(tx_bssid, bss->bssid))
3980                 return true;
3981         if (!bss->transmitted_bss)
3982                 return false;
3983         return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
3984 }
3985
3986 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
3987                                      struct ieee80211_hdr *hdr, size_t len,
3988                                      struct ieee80211_rx_status *rx_status)
3989 {
3990         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3991         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3992         struct ieee80211_mgmt *mgmt = (void *) hdr;
3993         size_t baselen;
3994         struct ieee802_11_elems elems;
3995         struct ieee80211_local *local = sdata->local;
3996         struct ieee80211_chanctx_conf *chanctx_conf;
3997         struct ieee80211_channel *chan;
3998         struct sta_info *sta;
3999         u32 changed = 0;
4000         bool erp_valid;
4001         u8 erp_value = 0;
4002         u32 ncrc = 0;
4003         u8 *bssid, *variable = mgmt->u.beacon.variable;
4004         u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
4005
4006         sdata_assert_lock(sdata);
4007
4008         /* Process beacon from the current BSS */
4009         bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
4010         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
4011                 struct ieee80211_ext *ext = (void *) mgmt;
4012
4013                 if (ieee80211_is_s1g_short_beacon(ext->frame_control))
4014                         variable = ext->u.s1g_short_beacon.variable;
4015                 else
4016                         variable = ext->u.s1g_beacon.variable;
4017         }
4018
4019         baselen = (u8 *) variable - (u8 *) mgmt;
4020         if (baselen > len)
4021                 return;
4022
4023         rcu_read_lock();
4024         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4025         if (!chanctx_conf) {
4026                 rcu_read_unlock();
4027                 return;
4028         }
4029
4030         if (ieee80211_rx_status_to_khz(rx_status) !=
4031             ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
4032                 rcu_read_unlock();
4033                 return;
4034         }
4035         chan = chanctx_conf->def.chan;
4036         rcu_read_unlock();
4037
4038         if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
4039             ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->bss)) {
4040                 ieee802_11_parse_elems(variable,
4041                                        len - baselen, false, &elems,
4042                                        bssid,
4043                                        ifmgd->assoc_data->bss->bssid);
4044
4045                 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
4046
4047                 if (elems.dtim_period)
4048                         ifmgd->dtim_period = elems.dtim_period;
4049                 ifmgd->have_beacon = true;
4050                 ifmgd->assoc_data->need_beacon = false;
4051                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4052                         sdata->vif.bss_conf.sync_tsf =
4053                                 le64_to_cpu(mgmt->u.beacon.timestamp);
4054                         sdata->vif.bss_conf.sync_device_ts =
4055                                 rx_status->device_timestamp;
4056                         sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
4057                 }
4058
4059                 if (elems.mbssid_config_ie)
4060                         bss_conf->profile_periodicity =
4061                                 elems.mbssid_config_ie->profile_periodicity;
4062                 else
4063                         bss_conf->profile_periodicity = 0;
4064
4065                 if (elems.ext_capab_len >= 11 &&
4066                     (elems.ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
4067                         bss_conf->ema_ap = true;
4068                 else
4069                         bss_conf->ema_ap = false;
4070
4071                 /* continue assoc process */
4072                 ifmgd->assoc_data->timeout = jiffies;
4073                 ifmgd->assoc_data->timeout_started = true;
4074                 run_again(sdata, ifmgd->assoc_data->timeout);
4075                 return;
4076         }
4077
4078         if (!ifmgd->associated ||
4079             !ieee80211_rx_our_beacon(bssid,  ifmgd->associated))
4080                 return;
4081         bssid = ifmgd->associated->bssid;
4082
4083         if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
4084                 ieee80211_handle_beacon_sig(sdata, ifmgd, bss_conf,
4085                                             local, rx_status);
4086
4087         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
4088                 mlme_dbg_ratelimited(sdata,
4089                                      "cancelling AP probe due to a received beacon\n");
4090                 ieee80211_reset_ap_probe(sdata);
4091         }
4092
4093         /*
4094          * Push the beacon loss detection into the future since
4095          * we are processing a beacon from the AP just now.
4096          */
4097         ieee80211_sta_reset_beacon_monitor(sdata);
4098
4099         /* TODO: CRC urrently not calculated on S1G Beacon Compatibility
4100          * element (which carries the beacon interval). Don't forget to add a
4101          * bit to care_about_ies[] above if mac80211 is interested in a
4102          * changing S1G element.
4103          */
4104         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
4105                 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
4106         ieee802_11_parse_elems_crc(variable,
4107                                    len - baselen, false, &elems,
4108                                    care_about_ies, ncrc,
4109                                    mgmt->bssid, bssid);
4110         ncrc = elems.crc;
4111
4112         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
4113             ieee80211_check_tim(elems.tim, elems.tim_len, bss_conf->aid)) {
4114                 if (local->hw.conf.dynamic_ps_timeout > 0) {
4115                         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
4116                                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
4117                                 ieee80211_hw_config(local,
4118                                                     IEEE80211_CONF_CHANGE_PS);
4119                         }
4120                         ieee80211_send_nullfunc(local, sdata, false);
4121                 } else if (!local->pspolling && sdata->u.mgd.powersave) {
4122                         local->pspolling = true;
4123
4124                         /*
4125                          * Here is assumed that the driver will be
4126                          * able to send ps-poll frame and receive a
4127                          * response even though power save mode is
4128                          * enabled, but some drivers might require
4129                          * to disable power save here. This needs
4130                          * to be investigated.
4131                          */
4132                         ieee80211_send_pspoll(local, sdata);
4133                 }
4134         }
4135
4136         if (sdata->vif.p2p ||
4137             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
4138                 struct ieee80211_p2p_noa_attr noa = {};
4139                 int ret;
4140
4141                 ret = cfg80211_get_p2p_attr(variable,
4142                                             len - baselen,
4143                                             IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
4144                                             (u8 *) &noa, sizeof(noa));
4145                 if (ret >= 2) {
4146                         if (sdata->u.mgd.p2p_noa_index != noa.index) {
4147                                 /* valid noa_attr and index changed */
4148                                 sdata->u.mgd.p2p_noa_index = noa.index;
4149                                 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
4150                                 changed |= BSS_CHANGED_P2P_PS;
4151                                 /*
4152                                  * make sure we update all information, the CRC
4153                                  * mechanism doesn't look at P2P attributes.
4154                                  */
4155                                 ifmgd->beacon_crc_valid = false;
4156                         }
4157                 } else if (sdata->u.mgd.p2p_noa_index != -1) {
4158                         /* noa_attr not found and we had valid noa_attr before */
4159                         sdata->u.mgd.p2p_noa_index = -1;
4160                         memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
4161                         changed |= BSS_CHANGED_P2P_PS;
4162                         ifmgd->beacon_crc_valid = false;
4163                 }
4164         }
4165
4166         if (ifmgd->csa_waiting_bcn)
4167                 ieee80211_chswitch_post_beacon(sdata);
4168
4169         /*
4170          * Update beacon timing and dtim count on every beacon appearance. This
4171          * will allow the driver to use the most updated values. Do it before
4172          * comparing this one with last received beacon.
4173          * IMPORTANT: These parameters would possibly be out of sync by the time
4174          * the driver will use them. The synchronized view is currently
4175          * guaranteed only in certain callbacks.
4176          */
4177         if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
4178             !ieee80211_is_s1g_beacon(hdr->frame_control)) {
4179                 sdata->vif.bss_conf.sync_tsf =
4180                         le64_to_cpu(mgmt->u.beacon.timestamp);
4181                 sdata->vif.bss_conf.sync_device_ts =
4182                         rx_status->device_timestamp;
4183                 sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
4184         }
4185
4186         if ((ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid) ||
4187             ieee80211_is_s1g_short_beacon(mgmt->frame_control))
4188                 return;
4189         ifmgd->beacon_crc = ncrc;
4190         ifmgd->beacon_crc_valid = true;
4191
4192         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
4193
4194         ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
4195                                          rx_status->device_timestamp,
4196                                          &elems, true);
4197
4198         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
4199             ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
4200                                      elems.wmm_param_len,
4201                                      elems.mu_edca_param_set))
4202                 changed |= BSS_CHANGED_QOS;
4203
4204         /*
4205          * If we haven't had a beacon before, tell the driver about the
4206          * DTIM period (and beacon timing if desired) now.
4207          */
4208         if (!ifmgd->have_beacon) {
4209                 /* a few bogus AP send dtim_period = 0 or no TIM IE */
4210                 bss_conf->dtim_period = elems.dtim_period ?: 1;
4211
4212                 changed |= BSS_CHANGED_BEACON_INFO;
4213                 ifmgd->have_beacon = true;
4214
4215                 mutex_lock(&local->iflist_mtx);
4216                 ieee80211_recalc_ps(local);
4217                 mutex_unlock(&local->iflist_mtx);
4218
4219                 ieee80211_recalc_ps_vif(sdata);
4220         }
4221
4222         if (elems.erp_info) {
4223                 erp_valid = true;
4224                 erp_value = elems.erp_info[0];
4225         } else {
4226                 erp_valid = false;
4227         }
4228
4229         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
4230                 changed |= ieee80211_handle_bss_capability(sdata,
4231                                 le16_to_cpu(mgmt->u.beacon.capab_info),
4232                                 erp_valid, erp_value);
4233
4234         mutex_lock(&local->sta_mtx);
4235         sta = sta_info_get(sdata, bssid);
4236
4237         changed |= ieee80211_recalc_twt_req(sdata, sta, &elems);
4238
4239         if (ieee80211_config_bw(sdata, sta, elems.ht_cap_elem,
4240                                 elems.vht_cap_elem, elems.ht_operation,
4241                                 elems.vht_operation, elems.he_operation,
4242                                 elems.s1g_oper, bssid, &changed)) {
4243                 mutex_unlock(&local->sta_mtx);
4244                 sdata_info(sdata,
4245                            "failed to follow AP %pM bandwidth change, disconnect\n",
4246                            bssid);
4247                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4248                                        WLAN_REASON_DEAUTH_LEAVING,
4249                                        true, deauth_buf);
4250                 ieee80211_report_disconnect(sdata, deauth_buf,
4251                                             sizeof(deauth_buf), true,
4252                                             WLAN_REASON_DEAUTH_LEAVING,
4253                                             false);
4254                 return;
4255         }
4256
4257         if (sta && elems.opmode_notif)
4258                 ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
4259                                             rx_status->band);
4260         mutex_unlock(&local->sta_mtx);
4261
4262         changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
4263                                                elems.country_elem,
4264                                                elems.country_elem_len,
4265                                                elems.pwr_constr_elem,
4266                                                elems.cisco_dtpc_elem);
4267
4268         ieee80211_bss_info_change_notify(sdata, changed);
4269 }
4270
4271 void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
4272                                  struct sk_buff *skb)
4273 {
4274         struct ieee80211_rx_status *rx_status;
4275         struct ieee80211_hdr *hdr;
4276         u16 fc;
4277
4278         rx_status = (struct ieee80211_rx_status *) skb->cb;
4279         hdr = (struct ieee80211_hdr *) skb->data;
4280         fc = le16_to_cpu(hdr->frame_control);
4281
4282         sdata_lock(sdata);
4283         switch (fc & IEEE80211_FCTL_STYPE) {
4284         case IEEE80211_STYPE_S1G_BEACON:
4285                 ieee80211_rx_mgmt_beacon(sdata, hdr, skb->len, rx_status);
4286                 break;
4287         }
4288         sdata_unlock(sdata);
4289 }
4290
4291 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
4292                                   struct sk_buff *skb)
4293 {
4294         struct ieee80211_rx_status *rx_status;
4295         struct ieee80211_mgmt *mgmt;
4296         u16 fc;
4297         struct ieee802_11_elems elems;
4298         int ies_len;
4299
4300         rx_status = (struct ieee80211_rx_status *) skb->cb;
4301         mgmt = (struct ieee80211_mgmt *) skb->data;
4302         fc = le16_to_cpu(mgmt->frame_control);
4303
4304         sdata_lock(sdata);
4305
4306         switch (fc & IEEE80211_FCTL_STYPE) {
4307         case IEEE80211_STYPE_BEACON:
4308                 ieee80211_rx_mgmt_beacon(sdata, (void *)mgmt,
4309                                          skb->len, rx_status);
4310                 break;
4311         case IEEE80211_STYPE_PROBE_RESP:
4312                 ieee80211_rx_mgmt_probe_resp(sdata, skb);
4313                 break;
4314         case IEEE80211_STYPE_AUTH:
4315                 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
4316                 break;
4317         case IEEE80211_STYPE_DEAUTH:
4318                 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
4319                 break;
4320         case IEEE80211_STYPE_DISASSOC:
4321                 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
4322                 break;
4323         case IEEE80211_STYPE_ASSOC_RESP:
4324         case IEEE80211_STYPE_REASSOC_RESP:
4325                 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
4326                 break;
4327         case IEEE80211_STYPE_ACTION:
4328                 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
4329                         ies_len = skb->len -
4330                                   offsetof(struct ieee80211_mgmt,
4331                                            u.action.u.chan_switch.variable);
4332
4333                         if (ies_len < 0)
4334                                 break;
4335
4336                         /* CSA IE cannot be overridden, no need for BSSID */
4337                         ieee802_11_parse_elems(
4338                                 mgmt->u.action.u.chan_switch.variable,
4339                                 ies_len, true, &elems, mgmt->bssid, NULL);
4340
4341                         if (elems.parse_error)
4342                                 break;
4343
4344                         ieee80211_sta_process_chanswitch(sdata,
4345                                                  rx_status->mactime,
4346                                                  rx_status->device_timestamp,
4347                                                  &elems, false);
4348                 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
4349                         ies_len = skb->len -
4350                                   offsetof(struct ieee80211_mgmt,
4351                                            u.action.u.ext_chan_switch.variable);
4352
4353                         if (ies_len < 0)
4354                                 break;
4355
4356                         /*
4357                          * extended CSA IE can't be overridden, no need for
4358                          * BSSID
4359                          */
4360                         ieee802_11_parse_elems(
4361                                 mgmt->u.action.u.ext_chan_switch.variable,
4362                                 ies_len, true, &elems, mgmt->bssid, NULL);
4363
4364                         if (elems.parse_error)
4365                                 break;
4366
4367                         /* for the handling code pretend this was also an IE */
4368                         elems.ext_chansw_ie =
4369                                 &mgmt->u.action.u.ext_chan_switch.data;
4370
4371                         ieee80211_sta_process_chanswitch(sdata,
4372                                                  rx_status->mactime,
4373                                                  rx_status->device_timestamp,
4374                                                  &elems, false);
4375                 }
4376                 break;
4377         }
4378         sdata_unlock(sdata);
4379 }
4380
4381 static void ieee80211_sta_timer(struct timer_list *t)
4382 {
4383         struct ieee80211_sub_if_data *sdata =
4384                 from_timer(sdata, t, u.mgd.timer);
4385
4386         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
4387 }
4388
4389 void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
4390                                    u8 *bssid, u8 reason, bool tx)
4391 {
4392         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4393
4394         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
4395                                tx, frame_buf);
4396
4397         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
4398                                     reason, false);
4399 }
4400
4401 static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
4402 {
4403         struct ieee80211_local *local = sdata->local;
4404         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4405         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
4406         u32 tx_flags = 0;
4407         u16 trans = 1;
4408         u16 status = 0;
4409         struct ieee80211_prep_tx_info info = {
4410                 .subtype = IEEE80211_STYPE_AUTH,
4411         };
4412
4413         sdata_assert_lock(sdata);
4414
4415         if (WARN_ON_ONCE(!auth_data))
4416                 return -EINVAL;
4417
4418         auth_data->tries++;
4419
4420         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
4421                 sdata_info(sdata, "authentication with %pM timed out\n",
4422                            auth_data->bss->bssid);
4423
4424                 /*
4425                  * Most likely AP is not in the range so remove the
4426                  * bss struct for that AP.
4427                  */
4428                 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
4429
4430                 return -ETIMEDOUT;
4431         }
4432
4433         if (auth_data->algorithm == WLAN_AUTH_SAE)
4434                 info.duration = jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);
4435
4436         drv_mgd_prepare_tx(local, sdata, &info);
4437
4438         sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
4439                    auth_data->bss->bssid, auth_data->tries,
4440                    IEEE80211_AUTH_MAX_TRIES);
4441
4442         auth_data->expected_transaction = 2;
4443
4444         if (auth_data->algorithm == WLAN_AUTH_SAE) {
4445                 trans = auth_data->sae_trans;
4446                 status = auth_data->sae_status;
4447                 auth_data->expected_transaction = trans;
4448         }
4449
4450         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
4451                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
4452                            IEEE80211_TX_INTFL_MLME_CONN_TX;
4453
4454         ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
4455                             auth_data->data, auth_data->data_len,
4456                             auth_data->bss->bssid,
4457                             auth_data->bss->bssid, NULL, 0, 0,
4458                             tx_flags);
4459
4460         if (tx_flags == 0) {
4461                 if (auth_data->algorithm == WLAN_AUTH_SAE)
4462                         auth_data->timeout = jiffies +
4463                                 IEEE80211_AUTH_TIMEOUT_SAE;
4464                 else
4465                         auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
4466         } else {
4467                 auth_data->timeout =
4468                         round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
4469         }
4470
4471         auth_data->timeout_started = true;
4472         run_again(sdata, auth_data->timeout);
4473
4474         return 0;
4475 }
4476
4477 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
4478 {
4479         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
4480         struct ieee80211_local *local = sdata->local;
4481         int ret;
4482
4483         sdata_assert_lock(sdata);
4484
4485         assoc_data->tries++;
4486         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
4487                 sdata_info(sdata, "association with %pM timed out\n",
4488                            assoc_data->bss->bssid);
4489
4490                 /*
4491                  * Most likely AP is not in the range so remove the
4492                  * bss struct for that AP.
4493                  */
4494                 cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);
4495
4496                 return -ETIMEDOUT;
4497         }
4498
4499         sdata_info(sdata, "associate with %pM (try %d/%d)\n",
4500                    assoc_data->bss->bssid, assoc_data->tries,
4501                    IEEE80211_ASSOC_MAX_TRIES);
4502         ret = ieee80211_send_assoc(sdata);
4503         if (ret)
4504                 return ret;
4505
4506         if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
4507                 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
4508                 assoc_data->timeout_started = true;
4509                 run_again(sdata, assoc_data->timeout);
4510         } else {
4511                 assoc_data->timeout =
4512                         round_jiffies_up(jiffies +
4513                                          IEEE80211_ASSOC_TIMEOUT_LONG);
4514                 assoc_data->timeout_started = true;
4515                 run_again(sdata, assoc_data->timeout);
4516         }
4517
4518         return 0;
4519 }
4520
4521 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
4522                                   __le16 fc, bool acked)
4523 {
4524         struct ieee80211_local *local = sdata->local;
4525
4526         sdata->u.mgd.status_fc = fc;
4527         sdata->u.mgd.status_acked = acked;
4528         sdata->u.mgd.status_received = true;
4529
4530         ieee80211_queue_work(&local->hw, &sdata->work);
4531 }
4532
4533 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
4534 {
4535         struct ieee80211_local *local = sdata->local;
4536         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4537
4538         sdata_lock(sdata);
4539
4540         if (ifmgd->status_received) {
4541                 __le16 fc = ifmgd->status_fc;
4542                 bool status_acked = ifmgd->status_acked;
4543
4544                 ifmgd->status_received = false;
4545                 if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
4546                         if (status_acked) {
4547                                 if (ifmgd->auth_data->algorithm ==
4548                                     WLAN_AUTH_SAE)
4549                                         ifmgd->auth_data->timeout =
4550                                                 jiffies +
4551                                                 IEEE80211_AUTH_TIMEOUT_SAE;
4552                                 else
4553                                         ifmgd->auth_data->timeout =
4554                                                 jiffies +
4555                                                 IEEE80211_AUTH_TIMEOUT_SHORT;
4556                                 run_again(sdata, ifmgd->auth_data->timeout);
4557                         } else {
4558                                 ifmgd->auth_data->timeout = jiffies - 1;
4559                         }
4560                         ifmgd->auth_data->timeout_started = true;
4561                 } else if (ifmgd->assoc_data &&
4562                            (ieee80211_is_assoc_req(fc) ||
4563                             ieee80211_is_reassoc_req(fc))) {
4564                         if (status_acked) {
4565                                 ifmgd->assoc_data->timeout =
4566                                         jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
4567                                 run_again(sdata, ifmgd->assoc_data->timeout);
4568                         } else {
4569                                 ifmgd->assoc_data->timeout = jiffies - 1;
4570                         }
4571                         ifmgd->assoc_data->timeout_started = true;
4572                 }
4573         }
4574
4575         if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
4576             time_after(jiffies, ifmgd->auth_data->timeout)) {
4577                 if (ifmgd->auth_data->done || ifmgd->auth_data->waiting) {
4578                         /*
4579                          * ok ... we waited for assoc or continuation but
4580                          * userspace didn't do it, so kill the auth data
4581                          */
4582                         ieee80211_destroy_auth_data(sdata, false);
4583                 } else if (ieee80211_auth(sdata)) {
4584                         u8 bssid[ETH_ALEN];
4585                         struct ieee80211_event event = {
4586                                 .type = MLME_EVENT,
4587                                 .u.mlme.data = AUTH_EVENT,
4588                                 .u.mlme.status = MLME_TIMEOUT,
4589                         };
4590
4591                         memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
4592
4593                         ieee80211_destroy_auth_data(sdata, false);
4594
4595                         cfg80211_auth_timeout(sdata->dev, bssid);
4596                         drv_event_callback(sdata->local, sdata, &event);
4597                 }
4598         } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
4599                 run_again(sdata, ifmgd->auth_data->timeout);
4600
4601         if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
4602             time_after(jiffies, ifmgd->assoc_data->timeout)) {
4603                 if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
4604                     ieee80211_do_assoc(sdata)) {
4605                         struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4606                         struct ieee80211_event event = {
4607                                 .type = MLME_EVENT,
4608                                 .u.mlme.data = ASSOC_EVENT,
4609                                 .u.mlme.status = MLME_TIMEOUT,
4610                         };
4611
4612                         ieee80211_destroy_assoc_data(sdata, false, false);
4613                         cfg80211_assoc_timeout(sdata->dev, bss);
4614                         drv_event_callback(sdata->local, sdata, &event);
4615                 }
4616         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
4617                 run_again(sdata, ifmgd->assoc_data->timeout);
4618
4619         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
4620             ifmgd->associated) {
4621                 u8 bssid[ETH_ALEN];
4622                 int max_tries;
4623
4624                 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
4625
4626                 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
4627                         max_tries = max_nullfunc_tries;
4628                 else
4629                         max_tries = max_probe_tries;
4630
4631                 /* ACK received for nullfunc probing frame */
4632                 if (!ifmgd->probe_send_count)
4633                         ieee80211_reset_ap_probe(sdata);
4634                 else if (ifmgd->nullfunc_failed) {
4635                         if (ifmgd->probe_send_count < max_tries) {
4636                                 mlme_dbg(sdata,
4637                                          "No ack for nullfunc frame to AP %pM, try %d/%i\n",
4638                                          bssid, ifmgd->probe_send_count,
4639                                          max_tries);
4640                                 ieee80211_mgd_probe_ap_send(sdata);
4641                         } else {
4642                                 mlme_dbg(sdata,
4643                                          "No ack for nullfunc frame to AP %pM, disconnecting.\n",
4644                                          bssid);
4645                                 ieee80211_sta_connection_lost(sdata, bssid,
4646                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
4647                                         false);
4648                         }
4649                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
4650                         run_again(sdata, ifmgd->probe_timeout);
4651                 else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
4652                         mlme_dbg(sdata,
4653                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
4654                                  bssid, probe_wait_ms);
4655                         ieee80211_sta_connection_lost(sdata, bssid,
4656                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
4657                 } else if (ifmgd->probe_send_count < max_tries) {
4658                         mlme_dbg(sdata,
4659                                  "No probe response from AP %pM after %dms, try %d/%i\n",
4660                                  bssid, probe_wait_ms,
4661                                  ifmgd->probe_send_count, max_tries);
4662                         ieee80211_mgd_probe_ap_send(sdata);
4663                 } else {
4664                         /*
4665                          * We actually lost the connection ... or did we?
4666                          * Let's make sure!
4667                          */
4668                         mlme_dbg(sdata,
4669                                  "No probe response from AP %pM after %dms, disconnecting.\n",
4670                                  bssid, probe_wait_ms);
4671
4672                         ieee80211_sta_connection_lost(sdata, bssid,
4673                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
4674                 }
4675         }
4676
4677         sdata_unlock(sdata);
4678 }
4679
4680 static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
4681 {
4682         struct ieee80211_sub_if_data *sdata =
4683                 from_timer(sdata, t, u.mgd.bcn_mon_timer);
4684         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4685
4686         if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
4687                 return;
4688
4689         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
4690                 return;
4691
4692         sdata->u.mgd.connection_loss = false;
4693         ieee80211_queue_work(&sdata->local->hw,
4694                              &sdata->u.mgd.beacon_connection_loss_work);
4695 }
4696
4697 static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
4698 {
4699         struct ieee80211_sub_if_data *sdata =
4700                 from_timer(sdata, t, u.mgd.conn_mon_timer);
4701         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4702         struct ieee80211_local *local = sdata->local;
4703         struct sta_info *sta;
4704         unsigned long timeout;
4705
4706         if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
4707                 return;
4708
4709         sta = sta_info_get(sdata, ifmgd->bssid);
4710         if (!sta)
4711                 return;
4712
4713         timeout = sta->status_stats.last_ack;
4714         if (time_before(sta->status_stats.last_ack, sta->rx_stats.last_rx))
4715                 timeout = sta->rx_stats.last_rx;
4716         timeout += IEEE80211_CONNECTION_IDLE_TIME;
4717
4718         /* If timeout is after now, then update timer to fire at
4719          * the later date, but do not actually probe at this time.
4720          */
4721         if (time_is_after_jiffies(timeout)) {
4722                 mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
4723                 return;
4724         }
4725
4726         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
4727 }
4728
4729 static void ieee80211_sta_monitor_work(struct work_struct *work)
4730 {
4731         struct ieee80211_sub_if_data *sdata =
4732                 container_of(work, struct ieee80211_sub_if_data,
4733                              u.mgd.monitor_work);
4734
4735         ieee80211_mgd_probe_ap(sdata, false);
4736 }
4737
4738 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
4739 {
4740         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
4741                 __ieee80211_stop_poll(sdata);
4742
4743                 /* let's probe the connection once */
4744                 if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
4745                         ieee80211_queue_work(&sdata->local->hw,
4746                                              &sdata->u.mgd.monitor_work);
4747         }
4748 }
4749
4750 #ifdef CONFIG_PM
4751 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
4752 {
4753         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4754         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4755
4756         sdata_lock(sdata);
4757
4758         if (ifmgd->auth_data || ifmgd->assoc_data) {
4759                 const u8 *bssid = ifmgd->auth_data ?
4760                                 ifmgd->auth_data->bss->bssid :
4761                                 ifmgd->assoc_data->bss->bssid;
4762
4763                 /*
4764                  * If we are trying to authenticate / associate while suspending,
4765                  * cfg80211 won't know and won't actually abort those attempts,
4766                  * thus we need to do that ourselves.
4767                  */
4768                 ieee80211_send_deauth_disassoc(sdata, bssid, bssid,
4769                                                IEEE80211_STYPE_DEAUTH,
4770                                                WLAN_REASON_DEAUTH_LEAVING,
4771                                                false, frame_buf);
4772                 if (ifmgd->assoc_data)
4773                         ieee80211_destroy_assoc_data(sdata, false, true);
4774                 if (ifmgd->auth_data)
4775                         ieee80211_destroy_auth_data(sdata, false);
4776                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4777                                       IEEE80211_DEAUTH_FRAME_LEN,
4778                                       false);
4779         }
4780
4781         /* This is a bit of a hack - we should find a better and more generic
4782          * solution to this. Normally when suspending, cfg80211 will in fact
4783          * deauthenticate. However, it doesn't (and cannot) stop an ongoing
4784          * auth (not so important) or assoc (this is the problem) process.
4785          *
4786          * As a consequence, it can happen that we are in the process of both
4787          * associating and suspending, and receive an association response
4788          * after cfg80211 has checked if it needs to disconnect, but before
4789          * we actually set the flag to drop incoming frames. This will then
4790          * cause the workqueue flush to process the association response in
4791          * the suspend, resulting in a successful association just before it
4792          * tries to remove the interface from the driver, which now though
4793          * has a channel context assigned ... this results in issues.
4794          *
4795          * To work around this (for now) simply deauth here again if we're
4796          * now connected.
4797          */
4798         if (ifmgd->associated && !sdata->local->wowlan) {
4799                 u8 bssid[ETH_ALEN];
4800                 struct cfg80211_deauth_request req = {
4801                         .reason_code = WLAN_REASON_DEAUTH_LEAVING,
4802                         .bssid = bssid,
4803                 };
4804
4805                 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
4806                 ieee80211_mgd_deauth(sdata, &req);
4807         }
4808
4809         sdata_unlock(sdata);
4810 }
4811
4812 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
4813 {
4814         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4815
4816         sdata_lock(sdata);
4817         if (!ifmgd->associated) {
4818                 sdata_unlock(sdata);
4819                 return;
4820         }
4821
4822         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
4823                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
4824                 mlme_dbg(sdata, "driver requested disconnect after resume\n");
4825                 ieee80211_sta_connection_lost(sdata,
4826                                               ifmgd->associated->bssid,
4827                                               WLAN_REASON_UNSPECIFIED,
4828                                               true);
4829                 sdata_unlock(sdata);
4830                 return;
4831         }
4832         sdata_unlock(sdata);
4833 }
4834 #endif
4835
4836 /* interface setup */
4837 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4838 {
4839         struct ieee80211_if_managed *ifmgd;
4840
4841         ifmgd = &sdata->u.mgd;
4842         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4843         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4844         INIT_WORK(&ifmgd->beacon_connection_loss_work,
4845                   ieee80211_beacon_connection_loss_work);
4846         INIT_WORK(&ifmgd->csa_connection_drop_work,
4847                   ieee80211_csa_connection_drop_work);
4848         INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4849         INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
4850                           ieee80211_tdls_peer_del_work);
4851         timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
4852         timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
4853         timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
4854         timer_setup(&ifmgd->chswitch_timer, ieee80211_chswitch_timer, 0);
4855         INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
4856                           ieee80211_sta_handle_tspec_ac_params_wk);
4857
4858         ifmgd->flags = 0;
4859         ifmgd->powersave = sdata->wdev.ps;
4860         ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
4861         ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
4862         ifmgd->p2p_noa_index = -1;
4863
4864         if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4865                 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
4866         else
4867                 ifmgd->req_smps = IEEE80211_SMPS_OFF;
4868
4869         /* Setup TDLS data */
4870         spin_lock_init(&ifmgd->teardown_lock);
4871         ifmgd->teardown_skb = NULL;
4872         ifmgd->orig_teardown_skb = NULL;
4873 }
4874
4875 /* scan finished notification */
4876 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
4877 {
4878         struct ieee80211_sub_if_data *sdata;
4879
4880         /* Restart STA timers */
4881         rcu_read_lock();
4882         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4883                 if (ieee80211_sdata_running(sdata))
4884                         ieee80211_restart_sta_timer(sdata);
4885         }
4886         rcu_read_unlock();
4887 }
4888
4889 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
4890                                      struct cfg80211_bss *cbss)
4891 {
4892         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4893         const u8 *ht_cap_ie, *vht_cap_ie;
4894         const struct ieee80211_ht_cap *ht_cap;
4895         const struct ieee80211_vht_cap *vht_cap;
4896         u8 chains = 1;
4897
4898         if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
4899                 return chains;
4900
4901         ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
4902         if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
4903                 ht_cap = (void *)(ht_cap_ie + 2);
4904                 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
4905                 /*
4906                  * TODO: use "Tx Maximum Number Spatial Streams Supported" and
4907                  *       "Tx Unequal Modulation Supported" fields.
4908                  */
4909         }
4910
4911         if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
4912                 return chains;
4913
4914         vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
4915         if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
4916                 u8 nss;
4917                 u16 tx_mcs_map;
4918
4919                 vht_cap = (void *)(vht_cap_ie + 2);
4920                 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
4921                 for (nss = 8; nss > 0; nss--) {
4922                         if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
4923                                         IEEE80211_VHT_MCS_NOT_SUPPORTED)
4924                                 break;
4925                 }
4926                 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
4927                 chains = max(chains, nss);
4928         }
4929
4930         return chains;
4931 }
4932
4933 static bool
4934 ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
4935                                     struct ieee80211_supported_band *sband,
4936                                     const struct ieee80211_he_operation *he_op)
4937 {
4938         const struct ieee80211_sta_he_cap *sta_he_cap =
4939                 ieee80211_get_he_iftype_cap(sband,
4940                                             ieee80211_vif_type_p2p(&sdata->vif));
4941         u16 ap_min_req_set;
4942         int i;
4943
4944         if (!sta_he_cap || !he_op)
4945                 return false;
4946
4947         ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
4948
4949         /* Need to go over for 80MHz, 160MHz and for 80+80 */
4950         for (i = 0; i < 3; i++) {
4951                 const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
4952                         &sta_he_cap->he_mcs_nss_supp;
4953                 u16 sta_mcs_map_rx =
4954                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
4955                 u16 sta_mcs_map_tx =
4956                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
4957                 u8 nss;
4958                 bool verified = true;
4959
4960                 /*
4961                  * For each band there is a maximum of 8 spatial streams
4962                  * possible. Each of the sta_mcs_map_* is a 16-bit struct built
4963                  * of 2 bits per NSS (1-8), with the values defined in enum
4964                  * ieee80211_he_mcs_support. Need to make sure STA TX and RX
4965                  * capabilities aren't less than the AP's minimum requirements
4966                  * for this HE BSS per SS.
4967                  * It is enough to find one such band that meets the reqs.
4968                  */
4969                 for (nss = 8; nss > 0; nss--) {
4970                         u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
4971                         u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
4972                         u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
4973
4974                         if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
4975                                 continue;
4976
4977                         /*
4978                          * Make sure the HE AP doesn't require MCSs that aren't
4979                          * supported by the client
4980                          */
4981                         if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4982                             sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4983                             (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
4984                                 verified = false;
4985                                 break;
4986                         }
4987                 }
4988
4989                 if (verified)
4990                         return true;
4991         }
4992
4993         /* If here, STA doesn't meet AP's HE min requirements */
4994         return false;
4995 }
4996
4997 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
4998                                   struct cfg80211_bss *cbss)
4999 {
5000         struct ieee80211_local *local = sdata->local;
5001         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5002         const struct ieee80211_ht_cap *ht_cap = NULL;
5003         const struct ieee80211_ht_operation *ht_oper = NULL;
5004         const struct ieee80211_vht_operation *vht_oper = NULL;
5005         const struct ieee80211_he_operation *he_oper = NULL;
5006         const struct ieee80211_s1g_oper_ie *s1g_oper = NULL;
5007         struct ieee80211_supported_band *sband;
5008         struct cfg80211_chan_def chandef;
5009         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
5010         bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
5011         struct ieee80211_bss *bss = (void *)cbss->priv;
5012         int ret;
5013         u32 i;
5014         bool have_80mhz;
5015
5016         sband = local->hw.wiphy->bands[cbss->channel->band];
5017
5018         ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
5019                           IEEE80211_STA_DISABLE_80P80MHZ |
5020                           IEEE80211_STA_DISABLE_160MHZ);
5021
5022         /* disable HT/VHT/HE if we don't support them */
5023         if (!sband->ht_cap.ht_supported && !is_6ghz) {
5024                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5025                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5026                 ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5027         }
5028
5029         if (!sband->vht_cap.vht_supported && is_5ghz) {
5030                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5031                 ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5032         }
5033
5034         if (!ieee80211_get_he_iftype_cap(sband,
5035                                          ieee80211_vif_type_p2p(&sdata->vif)))
5036                 ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5037
5038         rcu_read_lock();
5039
5040         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) && !is_6ghz) {
5041                 const u8 *ht_oper_ie, *ht_cap_ie;
5042
5043                 ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
5044                 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
5045                         ht_oper = (void *)(ht_oper_ie + 2);
5046
5047                 ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
5048                 if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
5049                         ht_cap = (void *)(ht_cap_ie + 2);
5050
5051                 if (!ht_cap) {
5052                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5053                         ht_oper = NULL;
5054                 }
5055         }
5056
5057         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) && !is_6ghz) {
5058                 const u8 *vht_oper_ie, *vht_cap;
5059
5060                 vht_oper_ie = ieee80211_bss_get_ie(cbss,
5061                                                    WLAN_EID_VHT_OPERATION);
5062                 if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
5063                         vht_oper = (void *)(vht_oper_ie + 2);
5064                 if (vht_oper && !ht_oper) {
5065                         vht_oper = NULL;
5066                         sdata_info(sdata,
5067                                    "AP advertised VHT without HT, disabling HT/VHT/HE\n");
5068                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5069                         ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5070                         ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5071                 }
5072
5073                 vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
5074                 if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
5075                         ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5076                         vht_oper = NULL;
5077                 }
5078         }
5079
5080         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE)) {
5081                 const struct cfg80211_bss_ies *ies;
5082                 const u8 *he_oper_ie;
5083
5084                 ies = rcu_dereference(cbss->ies);
5085                 he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
5086                                                   ies->data, ies->len);
5087                 if (he_oper_ie &&
5088                     he_oper_ie[1] >= ieee80211_he_oper_size(&he_oper_ie[3]))
5089                         he_oper = (void *)(he_oper_ie + 3);
5090                 else
5091                         he_oper = NULL;
5092
5093                 if (!ieee80211_verify_sta_he_mcs_support(sdata, sband, he_oper))
5094                         ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5095         }
5096
5097         /* Allow VHT if at least one channel on the sband supports 80 MHz */
5098         have_80mhz = false;
5099         for (i = 0; i < sband->n_channels; i++) {
5100                 if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
5101                                                 IEEE80211_CHAN_NO_80MHZ))
5102                         continue;
5103
5104                 have_80mhz = true;
5105                 break;
5106         }
5107
5108         if (!have_80mhz)
5109                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5110
5111         if (sband->band == NL80211_BAND_S1GHZ) {
5112                 const u8 *s1g_oper_ie;
5113
5114                 s1g_oper_ie = ieee80211_bss_get_ie(cbss,
5115                                                    WLAN_EID_S1G_OPERATION);
5116                 if (s1g_oper_ie && s1g_oper_ie[1] >= sizeof(*s1g_oper))
5117                         s1g_oper = (void *)(s1g_oper_ie + 2);
5118                 else
5119                         sdata_info(sdata,
5120                                    "AP missing S1G operation element?\n");
5121         }
5122
5123         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
5124                                                      cbss->channel,
5125                                                      bss->vht_cap_info,
5126                                                      ht_oper, vht_oper, he_oper,
5127                                                      s1g_oper,
5128                                                      &chandef, false);
5129
5130         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
5131                                       local->rx_chains);
5132
5133         rcu_read_unlock();
5134
5135         if (ifmgd->flags & IEEE80211_STA_DISABLE_HE && is_6ghz) {
5136                 sdata_info(sdata, "Rejecting non-HE 6/7 GHz connection");
5137                 return -EINVAL;
5138         }
5139
5140         /* will change later if needed */
5141         sdata->smps_mode = IEEE80211_SMPS_OFF;
5142
5143         mutex_lock(&local->mtx);
5144         /*
5145          * If this fails (possibly due to channel context sharing
5146          * on incompatible channels, e.g. 80+80 and 160 sharing the
5147          * same control channel) try to use a smaller bandwidth.
5148          */
5149         ret = ieee80211_vif_use_channel(sdata, &chandef,
5150                                         IEEE80211_CHANCTX_SHARED);
5151
5152         /* don't downgrade for 5 and 10 MHz channels, though. */
5153         if (chandef.width == NL80211_CHAN_WIDTH_5 ||
5154             chandef.width == NL80211_CHAN_WIDTH_10)
5155                 goto out;
5156
5157         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
5158                 ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
5159                 ret = ieee80211_vif_use_channel(sdata, &chandef,
5160                                                 IEEE80211_CHANCTX_SHARED);
5161         }
5162  out:
5163         mutex_unlock(&local->mtx);
5164         return ret;
5165 }
5166
5167 static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
5168                                u8 *dtim_count, u8 *dtim_period)
5169 {
5170         const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
5171         const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
5172                                          ies->len);
5173         const struct ieee80211_tim_ie *tim = NULL;
5174         const struct ieee80211_bssid_index *idx;
5175         bool valid = tim_ie && tim_ie[1] >= 2;
5176
5177         if (valid)
5178                 tim = (void *)(tim_ie + 2);
5179
5180         if (dtim_count)
5181                 *dtim_count = valid ? tim->dtim_count : 0;
5182
5183         if (dtim_period)
5184                 *dtim_period = valid ? tim->dtim_period : 0;
5185
5186         /* Check if value is overridden by non-transmitted profile */
5187         if (!idx_ie || idx_ie[1] < 3)
5188                 return valid;
5189
5190         idx = (void *)(idx_ie + 2);
5191
5192         if (dtim_count)
5193                 *dtim_count = idx->dtim_count;
5194
5195         if (dtim_period)
5196                 *dtim_period = idx->dtim_period;
5197
5198         return true;
5199 }
5200
5201 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
5202                                      struct cfg80211_bss *cbss, bool assoc,
5203                                      bool override)
5204 {
5205         struct ieee80211_local *local = sdata->local;
5206         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5207         struct ieee80211_bss *bss = (void *)cbss->priv;
5208         struct sta_info *new_sta = NULL;
5209         struct ieee80211_supported_band *sband;
5210         bool have_sta = false;
5211         int err;
5212
5213         sband = local->hw.wiphy->bands[cbss->channel->band];
5214
5215         if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
5216                 return -EINVAL;
5217
5218         /* If a reconfig is happening, bail out */
5219         if (local->in_reconfig)
5220                 return -EBUSY;
5221
5222         if (assoc) {
5223                 rcu_read_lock();
5224                 have_sta = sta_info_get(sdata, cbss->bssid);
5225                 rcu_read_unlock();
5226         }
5227
5228         if (!have_sta) {
5229                 new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
5230                 if (!new_sta)
5231                         return -ENOMEM;
5232         }
5233
5234         /*
5235          * Set up the information for the new channel before setting the
5236          * new channel. We can't - completely race-free - change the basic
5237          * rates bitmap and the channel (sband) that it refers to, but if
5238          * we set it up before we at least avoid calling into the driver's
5239          * bss_info_changed() method with invalid information (since we do
5240          * call that from changing the channel - only for IDLE and perhaps
5241          * some others, but ...).
5242          *
5243          * So to avoid that, just set up all the new information before the
5244          * channel, but tell the driver to apply it only afterwards, since
5245          * it might need the new channel for that.
5246          */
5247         if (new_sta) {
5248                 u32 rates = 0, basic_rates = 0;
5249                 bool have_higher_than_11mbit = false;
5250                 int min_rate = INT_MAX, min_rate_index = -1;
5251                 const struct cfg80211_bss_ies *ies;
5252                 int shift = ieee80211_vif_get_shift(&sdata->vif);
5253
5254                 /* TODO: S1G Basic Rate Set is expressed elsewhere */
5255                 if (cbss->channel->band == NL80211_BAND_S1GHZ) {
5256                         ieee80211_s1g_sta_rate_init(new_sta);
5257                         goto skip_rates;
5258                 }
5259
5260                 ieee80211_get_rates(sband, bss->supp_rates,
5261                                     bss->supp_rates_len,
5262                                     &rates, &basic_rates,
5263                                     &have_higher_than_11mbit,
5264                                     &min_rate, &min_rate_index,
5265                                     shift);
5266
5267                 /*
5268                  * This used to be a workaround for basic rates missing
5269                  * in the association response frame. Now that we no
5270                  * longer use the basic rates from there, it probably
5271                  * doesn't happen any more, but keep the workaround so
5272                  * in case some *other* APs are buggy in different ways
5273                  * we can connect -- with a warning.
5274                  * Allow this workaround only in case the AP provided at least
5275                  * one rate.
5276                  */
5277                 if (min_rate_index < 0) {
5278                         sdata_info(sdata,
5279                                    "No legacy rates in association response\n");
5280
5281                         sta_info_free(local, new_sta);
5282                         return -EINVAL;
5283                 } else if (!basic_rates) {
5284                         sdata_info(sdata,
5285                                    "No basic rates, using min rate instead\n");
5286                         basic_rates = BIT(min_rate_index);
5287                 }
5288
5289                 if (rates)
5290                         new_sta->sta.supp_rates[cbss->channel->band] = rates;
5291                 else
5292                         sdata_info(sdata,
5293                                    "No rates found, keeping mandatory only\n");
5294
5295                 sdata->vif.bss_conf.basic_rates = basic_rates;
5296
5297                 /* cf. IEEE 802.11 9.2.12 */
5298                 if (cbss->channel->band == NL80211_BAND_2GHZ &&
5299                     have_higher_than_11mbit)
5300                         sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
5301                 else
5302                         sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
5303
5304 skip_rates:
5305                 memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
5306
5307                 /* set timing information */
5308                 sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
5309                 rcu_read_lock();
5310                 ies = rcu_dereference(cbss->beacon_ies);
5311                 if (ies) {
5312                         sdata->vif.bss_conf.sync_tsf = ies->tsf;
5313                         sdata->vif.bss_conf.sync_device_ts =
5314                                 bss->device_ts_beacon;
5315
5316                         ieee80211_get_dtim(ies,
5317                                            &sdata->vif.bss_conf.sync_dtim_count,
5318                                            NULL);
5319                 } else if (!ieee80211_hw_check(&sdata->local->hw,
5320                                                TIMING_BEACON_ONLY)) {
5321                         ies = rcu_dereference(cbss->proberesp_ies);
5322                         /* must be non-NULL since beacon IEs were NULL */
5323                         sdata->vif.bss_conf.sync_tsf = ies->tsf;
5324                         sdata->vif.bss_conf.sync_device_ts =
5325                                 bss->device_ts_presp;
5326                         sdata->vif.bss_conf.sync_dtim_count = 0;
5327                 } else {
5328                         sdata->vif.bss_conf.sync_tsf = 0;
5329                         sdata->vif.bss_conf.sync_device_ts = 0;
5330                         sdata->vif.bss_conf.sync_dtim_count = 0;
5331                 }
5332                 rcu_read_unlock();
5333         }
5334
5335         if (new_sta || override) {
5336                 err = ieee80211_prep_channel(sdata, cbss);
5337                 if (err) {
5338                         if (new_sta)
5339                                 sta_info_free(local, new_sta);
5340                         return -EINVAL;
5341                 }
5342         }
5343
5344         if (new_sta) {
5345                 /*
5346                  * tell driver about BSSID, basic rates and timing
5347                  * this was set up above, before setting the channel
5348                  */
5349                 ieee80211_bss_info_change_notify(sdata,
5350                         BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
5351                         BSS_CHANGED_BEACON_INT);
5352
5353                 if (assoc)
5354                         sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
5355
5356                 err = sta_info_insert(new_sta);
5357                 new_sta = NULL;
5358                 if (err) {
5359                         sdata_info(sdata,
5360                                    "failed to insert STA entry for the AP (error %d)\n",
5361                                    err);
5362                         return err;
5363                 }
5364         } else
5365                 WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
5366
5367         /* Cancel scan to ensure that nothing interferes with connection */
5368         if (local->scanning)
5369                 ieee80211_scan_cancel(local);
5370
5371         return 0;
5372 }
5373
5374 /* config hooks */
5375 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
5376                        struct cfg80211_auth_request *req)
5377 {
5378         struct ieee80211_local *local = sdata->local;
5379         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5380         struct ieee80211_mgd_auth_data *auth_data;
5381         u16 auth_alg;
5382         int err;
5383         bool cont_auth;
5384
5385         /* prepare auth data structure */
5386
5387         switch (req->auth_type) {
5388         case NL80211_AUTHTYPE_OPEN_SYSTEM:
5389                 auth_alg = WLAN_AUTH_OPEN;
5390                 break;
5391         case NL80211_AUTHTYPE_SHARED_KEY:
5392                 if (fips_enabled)
5393                         return -EOPNOTSUPP;
5394                 auth_alg = WLAN_AUTH_SHARED_KEY;
5395                 break;
5396         case NL80211_AUTHTYPE_FT:
5397                 auth_alg = WLAN_AUTH_FT;
5398                 break;
5399         case NL80211_AUTHTYPE_NETWORK_EAP:
5400                 auth_alg = WLAN_AUTH_LEAP;
5401                 break;
5402         case NL80211_AUTHTYPE_SAE:
5403                 auth_alg = WLAN_AUTH_SAE;
5404                 break;
5405         case NL80211_AUTHTYPE_FILS_SK:
5406                 auth_alg = WLAN_AUTH_FILS_SK;
5407                 break;
5408         case NL80211_AUTHTYPE_FILS_SK_PFS:
5409                 auth_alg = WLAN_AUTH_FILS_SK_PFS;
5410                 break;
5411         case NL80211_AUTHTYPE_FILS_PK:
5412                 auth_alg = WLAN_AUTH_FILS_PK;
5413                 break;
5414         default:
5415                 return -EOPNOTSUPP;
5416         }
5417
5418         if (ifmgd->assoc_data)
5419                 return -EBUSY;
5420
5421         auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
5422                             req->ie_len, GFP_KERNEL);
5423         if (!auth_data)
5424                 return -ENOMEM;
5425
5426         auth_data->bss = req->bss;
5427
5428         if (req->auth_data_len >= 4) {
5429                 if (req->auth_type == NL80211_AUTHTYPE_SAE) {
5430                         __le16 *pos = (__le16 *) req->auth_data;
5431
5432                         auth_data->sae_trans = le16_to_cpu(pos[0]);
5433                         auth_data->sae_status = le16_to_cpu(pos[1]);
5434                 }
5435                 memcpy(auth_data->data, req->auth_data + 4,
5436                        req->auth_data_len - 4);
5437                 auth_data->data_len += req->auth_data_len - 4;
5438         }
5439
5440         /* Check if continuing authentication or trying to authenticate with the
5441          * same BSS that we were in the process of authenticating with and avoid
5442          * removal and re-addition of the STA entry in
5443          * ieee80211_prep_connection().
5444          */
5445         cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss;
5446
5447         if (req->ie && req->ie_len) {
5448                 memcpy(&auth_data->data[auth_data->data_len],
5449                        req->ie, req->ie_len);
5450                 auth_data->data_len += req->ie_len;
5451         }
5452
5453         if (req->key && req->key_len) {
5454                 auth_data->key_len = req->key_len;
5455                 auth_data->key_idx = req->key_idx;
5456                 memcpy(auth_data->key, req->key, req->key_len);
5457         }
5458
5459         auth_data->algorithm = auth_alg;
5460
5461         /* try to authenticate/probe */
5462
5463         if (ifmgd->auth_data) {
5464                 if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
5465                         auth_data->peer_confirmed =
5466                                 ifmgd->auth_data->peer_confirmed;
5467                 }
5468                 ieee80211_destroy_auth_data(sdata, cont_auth);
5469         }
5470
5471         /* prep auth_data so we don't go into idle on disassoc */
5472         ifmgd->auth_data = auth_data;
5473
5474         /* If this is continuation of an ongoing SAE authentication exchange
5475          * (i.e., request to send SAE Confirm) and the peer has already
5476          * confirmed, mark authentication completed since we are about to send
5477          * out SAE Confirm.
5478          */
5479         if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
5480             auth_data->peer_confirmed && auth_data->sae_trans == 2)
5481                 ieee80211_mark_sta_auth(sdata, req->bss->bssid);
5482
5483         if (ifmgd->associated) {
5484                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5485
5486                 sdata_info(sdata,
5487                            "disconnect from AP %pM for new auth to %pM\n",
5488                            ifmgd->associated->bssid, req->bss->bssid);
5489                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
5490                                        WLAN_REASON_UNSPECIFIED,
5491                                        false, frame_buf);
5492
5493                 ieee80211_report_disconnect(sdata, frame_buf,
5494                                             sizeof(frame_buf), true,
5495                                             WLAN_REASON_UNSPECIFIED,
5496                                             false);
5497         }
5498
5499         sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
5500
5501         err = ieee80211_prep_connection(sdata, req->bss, cont_auth, false);
5502         if (err)
5503                 goto err_clear;
5504
5505         err = ieee80211_auth(sdata);
5506         if (err) {
5507                 sta_info_destroy_addr(sdata, req->bss->bssid);
5508                 goto err_clear;
5509         }
5510
5511         /* hold our own reference */
5512         cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
5513         return 0;
5514
5515  err_clear:
5516         eth_zero_addr(ifmgd->bssid);
5517         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
5518         ifmgd->auth_data = NULL;
5519         mutex_lock(&sdata->local->mtx);
5520         ieee80211_vif_release_channel(sdata);
5521         mutex_unlock(&sdata->local->mtx);
5522         kfree(auth_data);
5523         return err;
5524 }
5525
5526 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
5527                         struct cfg80211_assoc_request *req)
5528 {
5529         bool is_6ghz = req->bss->channel->band == NL80211_BAND_6GHZ;
5530         bool is_5ghz = req->bss->channel->band == NL80211_BAND_5GHZ;
5531         struct ieee80211_local *local = sdata->local;
5532         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5533         struct ieee80211_bss *bss = (void *)req->bss->priv;
5534         struct ieee80211_mgd_assoc_data *assoc_data;
5535         const struct cfg80211_bss_ies *beacon_ies;
5536         struct ieee80211_supported_band *sband;
5537         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
5538         const u8 *ssidie, *ht_ie, *vht_ie;
5539         int i, err;
5540         bool override = false;
5541
5542         assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
5543         if (!assoc_data)
5544                 return -ENOMEM;
5545
5546         rcu_read_lock();
5547         ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
5548         if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
5549                 rcu_read_unlock();
5550                 kfree(assoc_data);
5551                 return -EINVAL;
5552         }
5553         memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
5554         assoc_data->ssid_len = ssidie[1];
5555         memcpy(bss_conf->ssid, assoc_data->ssid, assoc_data->ssid_len);
5556         bss_conf->ssid_len = assoc_data->ssid_len;
5557         rcu_read_unlock();
5558
5559         if (ifmgd->associated) {
5560                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5561
5562                 sdata_info(sdata,
5563                            "disconnect from AP %pM for new assoc to %pM\n",
5564                            ifmgd->associated->bssid, req->bss->bssid);
5565                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
5566                                        WLAN_REASON_UNSPECIFIED,
5567                                        false, frame_buf);
5568
5569                 ieee80211_report_disconnect(sdata, frame_buf,
5570                                             sizeof(frame_buf), true,
5571                                             WLAN_REASON_UNSPECIFIED,
5572                                             false);
5573         }
5574
5575         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
5576                 err = -EBUSY;
5577                 goto err_free;
5578         }
5579
5580         if (ifmgd->assoc_data) {
5581                 err = -EBUSY;
5582                 goto err_free;
5583         }
5584
5585         if (ifmgd->auth_data) {
5586                 bool match;
5587
5588                 /* keep sta info, bssid if matching */
5589                 match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
5590                 ieee80211_destroy_auth_data(sdata, match);
5591         }
5592
5593         /* prepare assoc data */
5594
5595         ifmgd->beacon_crc_valid = false;
5596
5597         assoc_data->wmm = bss->wmm_used &&
5598                           (local->hw.queues >= IEEE80211_NUM_ACS);
5599
5600         /*
5601          * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
5602          * We still associate in non-HT mode (11a/b/g) if any one of these
5603          * ciphers is configured as pairwise.
5604          * We can set this to true for non-11n hardware, that'll be checked
5605          * separately along with the peer capabilities.
5606          */
5607         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
5608                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
5609                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
5610                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
5611                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5612                         ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5613                         ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5614                         netdev_info(sdata->dev,
5615                                     "disabling HT/VHT/HE due to WEP/TKIP use\n");
5616                 }
5617         }
5618
5619         sband = local->hw.wiphy->bands[req->bss->channel->band];
5620
5621         /* also disable HT/VHT/HE if the AP doesn't use WMM */
5622         if (!bss->wmm_used) {
5623                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5624                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5625                 ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5626                 netdev_info(sdata->dev,
5627                             "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
5628         }
5629
5630         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
5631         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
5632                sizeof(ifmgd->ht_capa_mask));
5633
5634         memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
5635         memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
5636                sizeof(ifmgd->vht_capa_mask));
5637
5638         memcpy(&ifmgd->s1g_capa, &req->s1g_capa, sizeof(ifmgd->s1g_capa));
5639         memcpy(&ifmgd->s1g_capa_mask, &req->s1g_capa_mask,
5640                sizeof(ifmgd->s1g_capa_mask));
5641
5642         if (req->ie && req->ie_len) {
5643                 memcpy(assoc_data->ie, req->ie, req->ie_len);
5644                 assoc_data->ie_len = req->ie_len;
5645         }
5646
5647         if (req->fils_kek) {
5648                 /* should already be checked in cfg80211 - so warn */
5649                 if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
5650                         err = -EINVAL;
5651                         goto err_free;
5652                 }
5653                 memcpy(assoc_data->fils_kek, req->fils_kek,
5654                        req->fils_kek_len);
5655                 assoc_data->fils_kek_len = req->fils_kek_len;
5656         }
5657
5658         if (req->fils_nonces)
5659                 memcpy(assoc_data->fils_nonces, req->fils_nonces,
5660                        2 * FILS_NONCE_LEN);
5661
5662         assoc_data->bss = req->bss;
5663         assoc_data->capability = req->bss->capability;
5664         assoc_data->supp_rates = bss->supp_rates;
5665         assoc_data->supp_rates_len = bss->supp_rates_len;
5666
5667         rcu_read_lock();
5668         ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
5669         if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
5670                 assoc_data->ap_ht_param =
5671                         ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
5672         else if (!is_6ghz)
5673                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5674         vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
5675         if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
5676                 memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
5677                        sizeof(struct ieee80211_vht_cap));
5678         else if (is_5ghz)
5679                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT |
5680                                 IEEE80211_STA_DISABLE_HE;
5681         rcu_read_unlock();
5682
5683         if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
5684                  ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
5685              "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
5686                 sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
5687
5688         if (bss->wmm_used && bss->uapsd_supported &&
5689             (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
5690                 assoc_data->uapsd = true;
5691                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
5692         } else {
5693                 assoc_data->uapsd = false;
5694                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
5695         }
5696
5697         if (req->prev_bssid)
5698                 memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
5699
5700         if (req->use_mfp) {
5701                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
5702                 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
5703         } else {
5704                 ifmgd->mfp = IEEE80211_MFP_DISABLED;
5705                 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
5706         }
5707
5708         if (req->flags & ASSOC_REQ_USE_RRM)
5709                 ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
5710         else
5711                 ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
5712
5713         if (req->crypto.control_port)
5714                 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
5715         else
5716                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
5717
5718         sdata->control_port_protocol = req->crypto.control_port_ethertype;
5719         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
5720         sdata->control_port_over_nl80211 =
5721                                         req->crypto.control_port_over_nl80211;
5722         sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
5723         sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
5724                                                         sdata->vif.type);
5725
5726         /* kick off associate process */
5727
5728         ifmgd->assoc_data = assoc_data;
5729         ifmgd->dtim_period = 0;
5730         ifmgd->have_beacon = false;
5731
5732         /* override HT/VHT configuration only if the AP and we support it */
5733         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
5734                 struct ieee80211_sta_ht_cap sta_ht_cap;
5735
5736                 if (req->flags & ASSOC_REQ_DISABLE_HT)
5737                         override = true;
5738
5739                 memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
5740                 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
5741
5742                 /* check for 40 MHz disable override */
5743                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
5744                     sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
5745                     !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
5746                         override = true;
5747
5748                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
5749                     req->flags & ASSOC_REQ_DISABLE_VHT)
5750                         override = true;
5751         }
5752
5753         if (req->flags & ASSOC_REQ_DISABLE_HT) {
5754                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5755                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5756                 ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5757         }
5758
5759         if (req->flags & ASSOC_REQ_DISABLE_VHT)
5760                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5761
5762         if (req->flags & ASSOC_REQ_DISABLE_HE)
5763                 ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5764
5765         err = ieee80211_prep_connection(sdata, req->bss, true, override);
5766         if (err)
5767                 goto err_clear;
5768
5769         if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
5770                 if (ifmgd->powersave)
5771                         sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
5772                 else
5773                         sdata->smps_mode = IEEE80211_SMPS_OFF;
5774         } else {
5775                 sdata->smps_mode = ifmgd->req_smps;
5776         }
5777
5778         rcu_read_lock();
5779         beacon_ies = rcu_dereference(req->bss->beacon_ies);
5780
5781         if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
5782             !beacon_ies) {
5783                 /*
5784                  * Wait up to one beacon interval ...
5785                  * should this be more if we miss one?
5786                  */
5787                 sdata_info(sdata, "waiting for beacon from %pM\n",
5788                            ifmgd->bssid);
5789                 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
5790                 assoc_data->timeout_started = true;
5791                 assoc_data->need_beacon = true;
5792         } else if (beacon_ies) {
5793                 const struct element *elem;
5794                 u8 dtim_count = 0;
5795
5796                 ieee80211_get_dtim(beacon_ies, &dtim_count,
5797                                    &ifmgd->dtim_period);
5798
5799                 ifmgd->have_beacon = true;
5800                 assoc_data->timeout = jiffies;
5801                 assoc_data->timeout_started = true;
5802
5803                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5804                         sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
5805                         sdata->vif.bss_conf.sync_device_ts =
5806                                 bss->device_ts_beacon;
5807                         sdata->vif.bss_conf.sync_dtim_count = dtim_count;
5808                 }
5809
5810                 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
5811                                               beacon_ies->data, beacon_ies->len);
5812                 if (elem && elem->datalen >= 3)
5813                         sdata->vif.bss_conf.profile_periodicity = elem->data[2];
5814                 else
5815                         sdata->vif.bss_conf.profile_periodicity = 0;
5816
5817                 elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
5818                                           beacon_ies->data, beacon_ies->len);
5819                 if (elem && elem->datalen >= 11 &&
5820                     (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
5821                         sdata->vif.bss_conf.ema_ap = true;
5822                 else
5823                         sdata->vif.bss_conf.ema_ap = false;
5824         } else {
5825                 assoc_data->timeout = jiffies;
5826                 assoc_data->timeout_started = true;
5827         }
5828         rcu_read_unlock();
5829
5830         run_again(sdata, assoc_data->timeout);
5831
5832         if (bss->corrupt_data) {
5833                 char *corrupt_type = "data";
5834                 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
5835                         if (bss->corrupt_data &
5836                                         IEEE80211_BSS_CORRUPT_PROBE_RESP)
5837                                 corrupt_type = "beacon and probe response";
5838                         else
5839                                 corrupt_type = "beacon";
5840                 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
5841                         corrupt_type = "probe response";
5842                 sdata_info(sdata, "associating with AP with corrupt %s\n",
5843                            corrupt_type);
5844         }
5845
5846         return 0;
5847  err_clear:
5848         eth_zero_addr(ifmgd->bssid);
5849         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
5850         ifmgd->assoc_data = NULL;
5851  err_free:
5852         kfree(assoc_data);
5853         return err;
5854 }
5855
5856 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
5857                          struct cfg80211_deauth_request *req)
5858 {
5859         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5860         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5861         bool tx = !req->local_state_change;
5862         struct ieee80211_prep_tx_info info = {
5863                 .subtype = IEEE80211_STYPE_DEAUTH,
5864         };
5865
5866         if (ifmgd->auth_data &&
5867             ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
5868                 sdata_info(sdata,
5869                            "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
5870                            req->bssid, req->reason_code,
5871                            ieee80211_get_reason_code_string(req->reason_code));
5872
5873                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
5874                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5875                                                IEEE80211_STYPE_DEAUTH,
5876                                                req->reason_code, tx,
5877                                                frame_buf);
5878                 ieee80211_destroy_auth_data(sdata, false);
5879                 ieee80211_report_disconnect(sdata, frame_buf,
5880                                             sizeof(frame_buf), true,
5881                                             req->reason_code, false);
5882                 drv_mgd_complete_tx(sdata->local, sdata, &info);
5883                 return 0;
5884         }
5885
5886         if (ifmgd->assoc_data &&
5887             ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) {
5888                 sdata_info(sdata,
5889                            "aborting association with %pM by local choice (Reason: %u=%s)\n",
5890                            req->bssid, req->reason_code,
5891                            ieee80211_get_reason_code_string(req->reason_code));
5892
5893                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
5894                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5895                                                IEEE80211_STYPE_DEAUTH,
5896                                                req->reason_code, tx,
5897                                                frame_buf);
5898                 ieee80211_destroy_assoc_data(sdata, false, true);
5899                 ieee80211_report_disconnect(sdata, frame_buf,
5900                                             sizeof(frame_buf), true,
5901                                             req->reason_code, false);
5902                 return 0;
5903         }
5904
5905         if (ifmgd->associated &&
5906             ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
5907                 sdata_info(sdata,
5908                            "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
5909                            req->bssid, req->reason_code,
5910                            ieee80211_get_reason_code_string(req->reason_code));
5911
5912                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
5913                                        req->reason_code, tx, frame_buf);
5914                 ieee80211_report_disconnect(sdata, frame_buf,
5915                                             sizeof(frame_buf), true,
5916                                             req->reason_code, false);
5917                 drv_mgd_complete_tx(sdata->local, sdata, &info);
5918                 return 0;
5919         }
5920
5921         return -ENOTCONN;
5922 }
5923
5924 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
5925                            struct cfg80211_disassoc_request *req)
5926 {
5927         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5928         u8 bssid[ETH_ALEN];
5929         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5930
5931         /*
5932          * cfg80211 should catch this ... but it's racy since
5933          * we can receive a disassoc frame, process it, hand it
5934          * to cfg80211 while that's in a locked section already
5935          * trying to tell us that the user wants to disconnect.
5936          */
5937         if (ifmgd->associated != req->bss)
5938                 return -ENOLINK;
5939
5940         sdata_info(sdata,
5941                    "disassociating from %pM by local choice (Reason: %u=%s)\n",
5942                    req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
5943
5944         memcpy(bssid, req->bss->bssid, ETH_ALEN);
5945         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
5946                                req->reason_code, !req->local_state_change,
5947                                frame_buf);
5948
5949         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
5950                                     req->reason_code, false);
5951
5952         return 0;
5953 }
5954
5955 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
5956 {
5957         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5958
5959         /*
5960          * Make sure some work items will not run after this,
5961          * they will not do anything but might not have been
5962          * cancelled when disconnecting.
5963          */
5964         cancel_work_sync(&ifmgd->monitor_work);
5965         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
5966         cancel_work_sync(&ifmgd->request_smps_work);
5967         cancel_work_sync(&ifmgd->csa_connection_drop_work);
5968         cancel_work_sync(&ifmgd->chswitch_work);
5969         cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5970
5971         sdata_lock(sdata);
5972         if (ifmgd->assoc_data) {
5973                 struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5974                 ieee80211_destroy_assoc_data(sdata, false, false);
5975                 cfg80211_assoc_timeout(sdata->dev, bss);
5976         }
5977         if (ifmgd->auth_data)
5978                 ieee80211_destroy_auth_data(sdata, false);
5979         spin_lock_bh(&ifmgd->teardown_lock);
5980         if (ifmgd->teardown_skb) {
5981                 kfree_skb(ifmgd->teardown_skb);
5982                 ifmgd->teardown_skb = NULL;
5983                 ifmgd->orig_teardown_skb = NULL;
5984         }
5985         kfree(ifmgd->assoc_req_ies);
5986         ifmgd->assoc_req_ies = NULL;
5987         ifmgd->assoc_req_ies_len = 0;
5988         spin_unlock_bh(&ifmgd->teardown_lock);
5989         del_timer_sync(&ifmgd->timer);
5990         sdata_unlock(sdata);
5991 }
5992
5993 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
5994                                enum nl80211_cqm_rssi_threshold_event rssi_event,
5995                                s32 rssi_level,
5996                                gfp_t gfp)
5997 {
5998         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
5999
6000         trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
6001
6002         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
6003 }
6004 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
6005
6006 void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
6007 {
6008         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
6009
6010         trace_api_cqm_beacon_loss_notify(sdata->local, sdata);
6011
6012         cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
6013 }
6014 EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);