net/mac80211/mlme.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * BSS client mode implementation
   4  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
   5  * Copyright 2004, Instant802 Networks, Inc.
   6  * Copyright 2005, Devicescape Software, Inc.
   7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   9  * Copyright 2013-2014  Intel Mobile Communications GmbH
  10  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
  11  * Copyright (C) 2018 - 2023 Intel Corporation
  12  */
  13
  14 #include <linux/delay.h>
  15 #include <linux/fips.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/etherdevice.h>
  20 #include <linux/moduleparam.h>
  21 #include <linux/rtnetlink.h>
  22 #include <linux/crc32.h>
  23 #include <linux/slab.h>
  24 #include <linux/export.h>
  25 #include <net/mac80211.h>
  26 #include <asm/unaligned.h>
  27
  28 #include "ieee80211_i.h"
  29 #include "driver-ops.h"
  30 #include "rate.h"
  31 #include "led.h"
  32 #include "fils_aead.h"
  33
  34 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
  35 #define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
  36 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
  37 #define IEEE80211_AUTH_TIMEOUT_SAE      (HZ * 2)
  38 #define IEEE80211_AUTH_MAX_TRIES        3
  39 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
  40 #define IEEE80211_AUTH_WAIT_SAE_RETRY   (HZ * 2)
  41 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
  42 #define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
  43 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
  44 #define IEEE80211_ASSOC_MAX_TRIES       3
  45
  46 static int max_nullfunc_tries = 2;
  47 module_param(max_nullfunc_tries, int, 0644);
  48 MODULE_PARM_DESC(max_nullfunc_tries,
  49                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
  50
  51 static int max_probe_tries = 5;
  52 module_param(max_probe_tries, int, 0644);
  53 MODULE_PARM_DESC(max_probe_tries,
  54                  "Maximum probe tries before disconnecting (reason 4).");
  55
  56 /*
  57  * Beacon loss timeout is calculated as N frames times the
  58  * advertised beacon interval.  This may need to be somewhat
  59  * higher than what hardware might detect to account for
  60  * delays in the host processing frames. But since we also
  61  * probe on beacon miss before declaring the connection lost
  62  * default to what we want.
  63  */
  64 static int beacon_loss_count = 7;
  65 module_param(beacon_loss_count, int, 0644);
  66 MODULE_PARM_DESC(beacon_loss_count,
  67                  "Number of beacon intervals before we decide beacon was lost.");
  68
  69 /*
  70  * Time the connection can be idle before we probe
  71  * it to see if we can still talk to the AP.
  72  */
  73 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
  74 /*
  75  * Time we wait for a probe response after sending
  76  * a probe request because of beacon loss or for
  77  * checking the connection still works.
  78  */
  79 static int probe_wait_ms = 500;
  80 module_param(probe_wait_ms, int, 0644);
  81 MODULE_PARM_DESC(probe_wait_ms,
  82                  "Maximum time(ms) to wait for probe response"
  83                  " before disconnecting (reason 4).");
  84
  85 /*
  86  * How many Beacon frames need to have been used in average signal strength
  87  * before starting to indicate signal change events.
  88  */
  89 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
  90
  91 /*
  92  * Extract from the given disabled subchannel bitmap (raw format
  93  * from the EHT Operation Element) the bits for the subchannel
  94  * we're using right now.
  95  */
  96 static u16
  97 ieee80211_extract_dis_subch_bmap(const struct ieee80211_eht_operation *eht_oper,
  98                                  struct cfg80211_chan_def *chandef, u16 bitmap)
  99 {
 100         struct ieee80211_eht_operation_info *info = (void *)eht_oper->optional;
 101         struct cfg80211_chan_def ap_chandef = *chandef;
 102         u32 ap_center_freq, local_center_freq;
 103         u32 ap_bw, local_bw;
 104         int ap_start_freq, local_start_freq;
 105         u16 shift, mask;
 106
 107         if (!(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) ||
 108             !(eht_oper->params &
 109               IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT))
 110                 return 0;
 111
 112         /* set 160/320 supported to get the full AP definition */
 113         ieee80211_chandef_eht_oper(eht_oper, true, true, &ap_chandef);
 114         ap_center_freq = ap_chandef.center_freq1;
 115         ap_bw = 20 * BIT(u8_get_bits(info->control,
 116                                      IEEE80211_EHT_OPER_CHAN_WIDTH));
 117         ap_start_freq = ap_center_freq - ap_bw / 2;
 118         local_center_freq = chandef->center_freq1;
 119         local_bw = 20 * BIT(ieee80211_chan_width_to_rx_bw(chandef->width));
 120         local_start_freq = local_center_freq - local_bw / 2;
 121         shift = (local_start_freq - ap_start_freq) / 20;
 122         mask = BIT(local_bw / 20) - 1;
 123
 124         return (bitmap >> shift) & mask;
 125 }
 126
 127 /*
 128  * Handle the puncturing bitmap, possibly downgrading bandwidth to get a
 129  * valid bitmap.
 130  */
 131 static void
 132 ieee80211_handle_puncturing_bitmap(struct ieee80211_link_data *link,
 133                                    const struct ieee80211_eht_operation *eht_oper,
 134                                    u16 bitmap, u64 *changed)
 135 {
 136         struct cfg80211_chan_def *chandef = &link->conf->chandef;
 137         u16 extracted;
 138         u64 _changed = 0;
 139
 140         if (!changed)
 141                 changed = &_changed;
 142
 143         while (chandef->width > NL80211_CHAN_WIDTH_40) {
 144                 extracted =
 145                         ieee80211_extract_dis_subch_bmap(eht_oper, chandef,
 146                                                          bitmap);
 147
 148                 if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
 149                                                              chandef))
 150                         break;
 151                 link->u.mgd.conn_flags |=
 152                         ieee80211_chandef_downgrade(chandef);
 153                 *changed |= BSS_CHANGED_BANDWIDTH;
 154         }
 155
 156         if (chandef->width <= NL80211_CHAN_WIDTH_40)
 157                 extracted = 0;
 158
 159         if (link->conf->eht_puncturing != extracted) {
 160                 link->conf->eht_puncturing = extracted;
 161                 *changed |= BSS_CHANGED_EHT_PUNCTURING;
 162         }
 163 }
 164
 165 /*
 166  * We can have multiple work items (and connection probing)
 167  * scheduling this timer, but we need to take care to only
 168  * reschedule it when it should fire _earlier_ than it was
 169  * asked for before, or if it's not pending right now. This
 170  * function ensures that. Note that it then is required to
 171  * run this function for all timeouts after the first one
 172  * has happened -- the work that runs from this timer will
 173  * do that.
 174  */
 175 static void run_again(struct ieee80211_sub_if_data *sdata,
 176                       unsigned long timeout)
 177 {
 178         sdata_assert_lock(sdata);
 179
 180         if (!timer_pending(&sdata->u.mgd.timer) ||
 181             time_before(timeout, sdata->u.mgd.timer.expires))
 182                 mod_timer(&sdata->u.mgd.timer, timeout);
 183 }
 184
 185 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 186 {
 187         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
 188                 return;
 189
 190         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 191                 return;
 192
 193         mod_timer(&sdata->u.mgd.bcn_mon_timer,
 194                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 195 }
 196
 197 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 198 {
 199         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 200
 201         if (unlikely(!ifmgd->associated))
 202                 return;
 203
 204         if (ifmgd->probe_send_count)
 205                 ifmgd->probe_send_count = 0;
 206
 207         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 208                 return;
 209
 210         mod_timer(&ifmgd->conn_mon_timer,
 211                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 212 }
 213
 214 static int ecw2cw(int ecw)
 215 {
 216         return (1 << ecw) - 1;
 217 }
 218
 219 static ieee80211_conn_flags_t
 220 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 221                              struct ieee80211_link_data *link,
 222                              ieee80211_conn_flags_t conn_flags,
 223                              struct ieee80211_supported_band *sband,
 224                              struct ieee80211_channel *channel,
 225                              u32 vht_cap_info,
 226                              const struct ieee80211_ht_operation *ht_oper,
 227                              const struct ieee80211_vht_operation *vht_oper,
 228                              const struct ieee80211_he_operation *he_oper,
 229                              const struct ieee80211_eht_operation *eht_oper,
 230                              const struct ieee80211_s1g_oper_ie *s1g_oper,
 231                              struct cfg80211_chan_def *chandef, bool tracking)
 232 {
 233         struct cfg80211_chan_def vht_chandef;
 234         struct ieee80211_sta_ht_cap sta_ht_cap;
 235         ieee80211_conn_flags_t ret;
 236         u32 ht_cfreq;
 237
 238         memset(chandef, 0, sizeof(struct cfg80211_chan_def));
 239         chandef->chan = channel;
 240         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
 241         chandef->center_freq1 = channel->center_freq;
 242         chandef->freq1_offset = channel->freq_offset;
 243
 244         if (channel->band == NL80211_BAND_6GHZ) {
 245                 if (!ieee80211_chandef_he_6ghz_oper(sdata, he_oper, eht_oper,
 246                                                     chandef)) {
 247                         mlme_dbg(sdata,
 248                                  "bad 6 GHz operation, disabling HT/VHT/HE/EHT\n");
 249                         ret = IEEE80211_CONN_DISABLE_HT |
 250                               IEEE80211_CONN_DISABLE_VHT |
 251                               IEEE80211_CONN_DISABLE_HE |
 252                               IEEE80211_CONN_DISABLE_EHT;
 253                 } else {
 254                         ret = 0;
 255                 }
 256                 vht_chandef = *chandef;
 257                 goto out;
 258         } else if (sband->band == NL80211_BAND_S1GHZ) {
 259                 if (!ieee80211_chandef_s1g_oper(s1g_oper, chandef)) {
 260                         sdata_info(sdata,
 261                                    "Missing S1G Operation Element? Trying operating == primary\n");
 262                         chandef->width = ieee80211_s1g_channel_width(channel);
 263                 }
 264
 265                 ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_40MHZ |
 266                       IEEE80211_CONN_DISABLE_VHT |
 267                       IEEE80211_CONN_DISABLE_80P80MHZ |
 268                       IEEE80211_CONN_DISABLE_160MHZ;
 269                 goto out;
 270         }
 271
 272         memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
 273         ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
 274
 275         if (!ht_oper || !sta_ht_cap.ht_supported) {
 276                 mlme_dbg(sdata, "HT operation missing / HT not supported\n");
 277                 ret = IEEE80211_CONN_DISABLE_HT |
 278                       IEEE80211_CONN_DISABLE_VHT |
 279                       IEEE80211_CONN_DISABLE_HE |
 280                       IEEE80211_CONN_DISABLE_EHT;
 281                 goto out;
 282         }
 283
 284         chandef->width = NL80211_CHAN_WIDTH_20;
 285
 286         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
 287                                                   channel->band);
 288         /* check that channel matches the right operating channel */
 289         if (!tracking && channel->center_freq != ht_cfreq) {
 290                 /*
 291                  * It's possible that some APs are confused here;
 292                  * Netgear WNDR3700 sometimes reports 4 higher than
 293                  * the actual channel in association responses, but
 294                  * since we look at probe response/beacon data here
 295                  * it should be OK.
 296                  */
 297                 sdata_info(sdata,
 298                            "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
 299                            channel->center_freq, ht_cfreq,
 300                            ht_oper->primary_chan, channel->band);
 301                 ret = IEEE80211_CONN_DISABLE_HT |
 302                       IEEE80211_CONN_DISABLE_VHT |
 303                       IEEE80211_CONN_DISABLE_HE |
 304                       IEEE80211_CONN_DISABLE_EHT;
 305                 goto out;
 306         }
 307
 308         /* check 40 MHz support, if we have it */
 309         if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
 310                 ieee80211_chandef_ht_oper(ht_oper, chandef);
 311         } else {
 312                 mlme_dbg(sdata, "40 MHz not supported\n");
 313                 /* 40 MHz (and 80 MHz) must be supported for VHT */
 314                 ret = IEEE80211_CONN_DISABLE_VHT;
 315                 /* also mark 40 MHz disabled */
 316                 ret |= IEEE80211_CONN_DISABLE_40MHZ;
 317                 goto out;
 318         }
 319
 320         if (!vht_oper || !sband->vht_cap.vht_supported) {
 321                 mlme_dbg(sdata, "VHT operation missing / VHT not supported\n");
 322                 ret = IEEE80211_CONN_DISABLE_VHT;
 323                 goto out;
 324         }
 325
 326         vht_chandef = *chandef;
 327         if (!(conn_flags & IEEE80211_CONN_DISABLE_HE) &&
 328             he_oper &&
 329             (le32_to_cpu(he_oper->he_oper_params) &
 330              IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
 331                 struct ieee80211_vht_operation he_oper_vht_cap;
 332
 333                 /*
 334                  * Set only first 3 bytes (other 2 aren't used in
 335                  * ieee80211_chandef_vht_oper() anyway)
 336                  */
 337                 memcpy(&he_oper_vht_cap, he_oper->optional, 3);
 338                 he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);
 339
 340                 if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
 341                                                 &he_oper_vht_cap, ht_oper,
 342                                                 &vht_chandef)) {
 343                         if (!(conn_flags & IEEE80211_CONN_DISABLE_HE))
 344                                 sdata_info(sdata,
 345                                            "HE AP VHT information is invalid, disabling HE\n");
 346                         ret = IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
 347                         goto out;
 348                 }
 349         } else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
 350                                                vht_cap_info,
 351                                                vht_oper, ht_oper,
 352                                                &vht_chandef)) {
 353                 if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
 354                         sdata_info(sdata,
 355                                    "AP VHT information is invalid, disabling VHT\n");
 356                 ret = IEEE80211_CONN_DISABLE_VHT;
 357                 goto out;
 358         }
 359
 360         if (!cfg80211_chandef_valid(&vht_chandef)) {
 361                 if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
 362                         sdata_info(sdata,
 363                                    "AP VHT information is invalid, disabling VHT\n");
 364                 ret = IEEE80211_CONN_DISABLE_VHT;
 365                 goto out;
 366         }
 367
 368         if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
 369                 ret = 0;
 370                 goto out;
 371         }
 372
 373         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
 374                 if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
 375                         sdata_info(sdata,
 376                                    "AP VHT information doesn't match HT, disabling VHT\n");
 377                 ret = IEEE80211_CONN_DISABLE_VHT;
 378                 goto out;
 379         }
 380
 381         *chandef = vht_chandef;
 382
 383         /*
 384          * handle the case that the EHT operation indicates that it holds EHT
 385          * operation information (in case that the channel width differs from
 386          * the channel width reported in HT/VHT/HE).
 387          */
 388         if (eht_oper && (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT)) {
 389                 struct cfg80211_chan_def eht_chandef = *chandef;
 390
 391                 ieee80211_chandef_eht_oper(eht_oper,
 392                                            eht_chandef.width ==
 393                                            NL80211_CHAN_WIDTH_160,
 394                                            false, &eht_chandef);
 395
 396                 if (!cfg80211_chandef_valid(&eht_chandef)) {
 397                         if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
 398                                 sdata_info(sdata,
 399                                            "AP EHT information is invalid, disabling EHT\n");
 400                         ret = IEEE80211_CONN_DISABLE_EHT;
 401                         goto out;
 402                 }
 403
 404                 if (!cfg80211_chandef_compatible(chandef, &eht_chandef)) {
 405                         if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
 406                                 sdata_info(sdata,
 407                                            "AP EHT information is incompatible, disabling EHT\n");
 408                         ret = IEEE80211_CONN_DISABLE_EHT;
 409                         goto out;
 410                 }
 411
 412                 *chandef = eht_chandef;
 413         }
 414
 415         ret = 0;
 416
 417 out:
 418         /*
 419          * When tracking the current AP, don't do any further checks if the
 420          * new chandef is identical to the one we're currently using for the
 421          * connection. This keeps us from playing ping-pong with regulatory,
 422          * without it the following can happen (for example):
 423          *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
 424          *  - AP advertises regdom US
 425          *  - CRDA loads regdom US with 80 MHz prohibited (old database)
 426          *  - the code below detects an unsupported channel, downgrades, and
 427          *    we disconnect from the AP in the caller
 428          *  - disconnect causes CRDA to reload world regdomain and the game
 429          *    starts anew.
 430          * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
 431          *
 432          * It seems possible that there are still scenarios with CSA or real
 433          * bandwidth changes where a this could happen, but those cases are
 434          * less common and wouldn't completely prevent using the AP.
 435          */
 436         if (tracking &&
 437             cfg80211_chandef_identical(chandef, &link->conf->chandef))
 438                 return ret;
 439
 440         /* don't print the message below for VHT mismatch if VHT is disabled */
 441         if (ret & IEEE80211_CONN_DISABLE_VHT)
 442                 vht_chandef = *chandef;
 443
 444         /*
 445          * Ignore the DISABLED flag when we're already connected and only
 446          * tracking the APs beacon for bandwidth changes - otherwise we
 447          * might get disconnected here if we connect to an AP, update our
 448          * regulatory information based on the AP's country IE and the
 449          * information we have is wrong/outdated and disables the channel
 450          * that we're actually using for the connection to the AP.
 451          */
 452         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
 453                                         tracking ? 0 :
 454                                                    IEEE80211_CHAN_DISABLED)) {
 455                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
 456                         ret = IEEE80211_CONN_DISABLE_HT |
 457                               IEEE80211_CONN_DISABLE_VHT |
 458                               IEEE80211_CONN_DISABLE_HE |
 459                               IEEE80211_CONN_DISABLE_EHT;
 460                         break;
 461                 }
 462
 463                 ret |= ieee80211_chandef_downgrade(chandef);
 464         }
 465
 466         if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
 467                                                  IEEE80211_CHAN_NO_HE))
 468                 ret |= IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
 469
 470         if (!eht_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
 471                                                   IEEE80211_CHAN_NO_EHT))
 472                 ret |= IEEE80211_CONN_DISABLE_EHT;
 473
 474         if (chandef->width != vht_chandef.width && !tracking)
 475                 sdata_info(sdata,
 476                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 477
 478         WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
 479         return ret;
 480 }
 481
 482 static int ieee80211_config_bw(struct ieee80211_link_data *link,
 483                                const struct ieee80211_ht_cap *ht_cap,
 484                                const struct ieee80211_vht_cap *vht_cap,
 485                                const struct ieee80211_ht_operation *ht_oper,
 486                                const struct ieee80211_vht_operation *vht_oper,
 487                                const struct ieee80211_he_operation *he_oper,
 488                                const struct ieee80211_eht_operation *eht_oper,
 489                                const struct ieee80211_s1g_oper_ie *s1g_oper,
 490                                const u8 *bssid, u64 *changed)
 491 {
 492         struct ieee80211_sub_if_data *sdata = link->sdata;
 493         struct ieee80211_local *local = sdata->local;
 494         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 495         struct ieee80211_channel *chan = link->conf->chandef.chan;
 496         struct ieee80211_supported_band *sband =
 497                 local->hw.wiphy->bands[chan->band];
 498         struct cfg80211_chan_def chandef;
 499         u16 ht_opmode;
 500         ieee80211_conn_flags_t flags;
 501         u32 vht_cap_info = 0;
 502         int ret;
 503
 504         /* if HT was/is disabled, don't track any bandwidth changes */
 505         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT || !ht_oper)
 506                 return 0;
 507
 508         /* don't check VHT if we associated as non-VHT station */
 509         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
 510                 vht_oper = NULL;
 511
 512         /* don't check HE if we associated as non-HE station */
 513         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE ||
 514             !ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif)) {
 515                 he_oper = NULL;
 516                 eht_oper = NULL;
 517         }
 518
 519         /* don't check EHT if we associated as non-EHT station */
 520         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT ||
 521             !ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif))
 522                 eht_oper = NULL;
 523
 524         /*
 525          * if bss configuration changed store the new one -
 526          * this may be applicable even if channel is identical
 527          */
 528         ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 529         if (link->conf->ht_operation_mode != ht_opmode) {
 530                 *changed |= BSS_CHANGED_HT;
 531                 link->conf->ht_operation_mode = ht_opmode;
 532         }
 533
 534         if (vht_cap)
 535                 vht_cap_info = le32_to_cpu(vht_cap->vht_cap_info);
 536
 537         /* calculate new channel (type) based on HT/VHT/HE operation IEs */
 538         flags = ieee80211_determine_chantype(sdata, link,
 539                                              link->u.mgd.conn_flags,
 540                                              sband, chan, vht_cap_info,
 541                                              ht_oper, vht_oper,
 542                                              he_oper, eht_oper,
 543                                              s1g_oper, &chandef, true);
 544
 545         /*
 546          * Downgrade the new channel if we associated with restricted
 547          * capabilities. For example, if we associated as a 20 MHz STA
 548          * to a 40 MHz AP (due to regulatory, capabilities or config
 549          * reasons) then switching to a 40 MHz channel now won't do us
 550          * any good -- we couldn't use it with the AP.
 551          */
 552         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ &&
 553             chandef.width == NL80211_CHAN_WIDTH_80P80)
 554                 flags |= ieee80211_chandef_downgrade(&chandef);
 555         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_160MHZ &&
 556             chandef.width == NL80211_CHAN_WIDTH_160)
 557                 flags |= ieee80211_chandef_downgrade(&chandef);
 558         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_40MHZ &&
 559             chandef.width > NL80211_CHAN_WIDTH_20)
 560                 flags |= ieee80211_chandef_downgrade(&chandef);
 561
 562         if (cfg80211_chandef_identical(&chandef, &link->conf->chandef))
 563                 return 0;
 564
 565         link_info(link,
 566                   "AP %pM changed bandwidth, new config is %d.%03d MHz, width %d (%d.%03d/%d MHz)\n",
 567                   link->u.mgd.bssid, chandef.chan->center_freq,
 568                   chandef.chan->freq_offset, chandef.width,
 569                   chandef.center_freq1, chandef.freq1_offset,
 570                   chandef.center_freq2);
 571
 572         if (flags != (link->u.mgd.conn_flags &
 573                                 (IEEE80211_CONN_DISABLE_HT |
 574                                  IEEE80211_CONN_DISABLE_VHT |
 575                                  IEEE80211_CONN_DISABLE_HE |
 576                                  IEEE80211_CONN_DISABLE_EHT |
 577                                  IEEE80211_CONN_DISABLE_40MHZ |
 578                                  IEEE80211_CONN_DISABLE_80P80MHZ |
 579                                  IEEE80211_CONN_DISABLE_160MHZ |
 580                                  IEEE80211_CONN_DISABLE_320MHZ)) ||
 581             !cfg80211_chandef_valid(&chandef)) {
 582                 sdata_info(sdata,
 583                            "AP %pM changed caps/bw in a way we can't support (0x%x/0x%x) - disconnect\n",
 584                            link->u.mgd.bssid, flags, ifmgd->flags);
 585                 return -EINVAL;
 586         }
 587
 588         ret = ieee80211_link_change_bandwidth(link, &chandef, changed);
 589
 590         if (ret) {
 591                 sdata_info(sdata,
 592                            "AP %pM changed bandwidth to incompatible one - disconnect\n",
 593                            link->u.mgd.bssid);
 594                 return ret;
 595         }
 596
 597         return 0;
 598 }
 599
 600 /* frame sending functions */
 601
 602 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 603                                 struct sk_buff *skb, u8 ap_ht_param,
 604                                 struct ieee80211_supported_band *sband,
 605                                 struct ieee80211_channel *channel,
 606                                 enum ieee80211_smps_mode smps,
 607                                 ieee80211_conn_flags_t conn_flags)
 608 {
 609         u8 *pos;
 610         u32 flags = channel->flags;
 611         u16 cap;
 612         struct ieee80211_sta_ht_cap ht_cap;
 613
 614         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 615
 616         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
 617         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 618
 619         /* determine capability flags */
 620         cap = ht_cap.cap;
 621
 622         switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 623         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 624                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
 625                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 626                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 627                 }
 628                 break;
 629         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 630                 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
 631                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 632                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 633                 }
 634                 break;
 635         }
 636
 637         /*
 638          * If 40 MHz was disabled associate as though we weren't
 639          * capable of 40 MHz -- some broken APs will never fall
 640          * back to trying to transmit in 20 MHz.
 641          */
 642         if (conn_flags & IEEE80211_CONN_DISABLE_40MHZ) {
 643                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 644                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 645         }
 646
 647         /* set SM PS mode properly */
 648         cap &= ~IEEE80211_HT_CAP_SM_PS;
 649         switch (smps) {
 650         case IEEE80211_SMPS_AUTOMATIC:
 651         case IEEE80211_SMPS_NUM_MODES:
 652                 WARN_ON(1);
 653                 fallthrough;
 654         case IEEE80211_SMPS_OFF:
 655                 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
 656                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 657                 break;
 658         case IEEE80211_SMPS_STATIC:
 659                 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
 660                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 661                 break;
 662         case IEEE80211_SMPS_DYNAMIC:
 663                 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
 664                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 665                 break;
 666         }
 667
 668         /* reserve and fill IE */
 669         pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
 670         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 671 }
 672
 673 /* This function determines vht capability flags for the association
 674  * and builds the IE.
 675  * Note - the function returns true to own the MU-MIMO capability
 676  */
 677 static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
 678                                  struct sk_buff *skb,
 679                                  struct ieee80211_supported_band *sband,
 680                                  struct ieee80211_vht_cap *ap_vht_cap,
 681                                  ieee80211_conn_flags_t conn_flags)
 682 {
 683         struct ieee80211_local *local = sdata->local;
 684         u8 *pos;
 685         u32 cap;
 686         struct ieee80211_sta_vht_cap vht_cap;
 687         u32 mask, ap_bf_sts, our_bf_sts;
 688         bool mu_mimo_owner = false;
 689
 690         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 691
 692         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
 693         ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
 694
 695         /* determine capability flags */
 696         cap = vht_cap.cap;
 697
 698         if (conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ) {
 699                 u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 700
 701                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 702                 if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
 703                     bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
 704                         cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
 705         }
 706
 707         if (conn_flags & IEEE80211_CONN_DISABLE_160MHZ) {
 708                 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
 709                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 710         }
 711
 712         /*
 713          * Some APs apparently get confused if our capabilities are better
 714          * than theirs, so restrict what we advertise in the assoc request.
 715          */
 716         if (!(ap_vht_cap->vht_cap_info &
 717                         cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
 718                 cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
 719                          IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 720         else if (!(ap_vht_cap->vht_cap_info &
 721                         cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
 722                 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 723
 724         /*
 725          * If some other vif is using the MU-MIMO capability we cannot associate
 726          * using MU-MIMO - this will lead to contradictions in the group-id
 727          * mechanism.
 728          * Ownership is defined since association request, in order to avoid
 729          * simultaneous associations with MU-MIMO.
 730          */
 731         if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
 732                 bool disable_mu_mimo = false;
 733                 struct ieee80211_sub_if_data *other;
 734
 735                 list_for_each_entry_rcu(other, &local->interfaces, list) {
 736                         if (other->vif.bss_conf.mu_mimo_owner) {
 737                                 disable_mu_mimo = true;
 738                                 break;
 739                         }
 740                 }
 741                 if (disable_mu_mimo)
 742                         cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 743                 else
 744                         mu_mimo_owner = true;
 745         }
 746
 747         mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
 748
 749         ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
 750         our_bf_sts = cap & mask;
 751
 752         if (ap_bf_sts < our_bf_sts) {
 753                 cap &= ~mask;
 754                 cap |= ap_bf_sts;
 755         }
 756
 757         /* reserve and fill IE */
 758         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
 759         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
 760
 761         return mu_mimo_owner;
 762 }
 763
 764 /* This function determines HE capability flags for the association
 765  * and builds the IE.
 766  */
 767 static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
 768                                 struct sk_buff *skb,
 769                                 struct ieee80211_supported_band *sband,
 770                                 enum ieee80211_smps_mode smps_mode,
 771                                 ieee80211_conn_flags_t conn_flags)
 772 {
 773         u8 *pos, *pre_he_pos;
 774         const struct ieee80211_sta_he_cap *he_cap;
 775         u8 he_cap_size;
 776
 777         he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
 778         if (WARN_ON(!he_cap))
 779                 return;
 780
 781         /* get a max size estimate */
 782         he_cap_size =
 783                 2 + 1 + sizeof(he_cap->he_cap_elem) +
 784                 ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
 785                 ieee80211_he_ppe_size(he_cap->ppe_thres[0],
 786                                       he_cap->he_cap_elem.phy_cap_info);
 787         pos = skb_put(skb, he_cap_size);
 788         pre_he_pos = pos;
 789         pos = ieee80211_ie_build_he_cap(conn_flags,
 790                                         pos, he_cap, pos + he_cap_size);
 791         /* trim excess if any */
 792         skb_trim(skb, skb->len - (pre_he_pos + he_cap_size - pos));
 793
 794         ieee80211_ie_build_he_6ghz_cap(sdata, smps_mode, skb);
 795 }
 796
 797 static void ieee80211_add_eht_ie(struct ieee80211_sub_if_data *sdata,
 798                                  struct sk_buff *skb,
 799                                  struct ieee80211_supported_band *sband)
 800 {
 801         u8 *pos;
 802         const struct ieee80211_sta_he_cap *he_cap;
 803         const struct ieee80211_sta_eht_cap *eht_cap;
 804         u8 eht_cap_size;
 805
 806         he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
 807         eht_cap = ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
 808
 809         /*
 810          * EHT capabilities element is only added if the HE capabilities element
 811          * was added so assume that 'he_cap' is valid and don't check it.
 812          */
 813         if (WARN_ON(!he_cap || !eht_cap))
 814                 return;
 815
 816         eht_cap_size =
 817                 2 + 1 + sizeof(eht_cap->eht_cap_elem) +
 818                 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
 819                                            &eht_cap->eht_cap_elem,
 820                                            false) +
 821                 ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0],
 822                                        eht_cap->eht_cap_elem.phy_cap_info);
 823         pos = skb_put(skb, eht_cap_size);
 824         ieee80211_ie_build_eht_cap(pos, he_cap, eht_cap, pos + eht_cap_size,
 825                                    false);
 826 }
 827
 828 static void ieee80211_assoc_add_rates(struct sk_buff *skb,
 829                                       enum nl80211_chan_width width,
 830                                       struct ieee80211_supported_band *sband,
 831                                       struct ieee80211_mgd_assoc_data *assoc_data)
 832 {
 833         unsigned int shift = ieee80211_chanwidth_get_shift(width);
 834         unsigned int rates_len, supp_rates_len;
 835         u32 rates = 0;
 836         int i, count;
 837         u8 *pos;
 838
 839         if (assoc_data->supp_rates_len) {
 840                 /*
 841                  * Get all rates supported by the device and the AP as
 842                  * some APs don't like getting a superset of their rates
 843                  * in the association request (e.g. D-Link DAP 1353 in
 844                  * b-only mode)...
 845                  */
 846                 rates_len = ieee80211_parse_bitrates(width, sband,
 847                                                      assoc_data->supp_rates,
 848                                                      assoc_data->supp_rates_len,
 849                                                      &rates);
 850         } else {
 851                 /*
 852                  * In case AP not provide any supported rates information
 853                  * before association, we send information element(s) with
 854                  * all rates that we support.
 855                  */
 856                 rates_len = sband->n_bitrates;
 857                 for (i = 0; i < sband->n_bitrates; i++)
 858                         rates |= BIT(i);
 859         }
 860
 861         supp_rates_len = rates_len;
 862         if (supp_rates_len > 8)
 863                 supp_rates_len = 8;
 864
 865         pos = skb_put(skb, supp_rates_len + 2);
 866         *pos++ = WLAN_EID_SUPP_RATES;
 867         *pos++ = supp_rates_len;
 868
 869         count = 0;
 870         for (i = 0; i < sband->n_bitrates; i++) {
 871                 if (BIT(i) & rates) {
 872                         int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 873                                                 5 * (1 << shift));
 874                         *pos++ = (u8)rate;
 875                         if (++count == 8)
 876                                 break;
 877                 }
 878         }
 879
 880         if (rates_len > count) {
 881                 pos = skb_put(skb, rates_len - count + 2);
 882                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 883                 *pos++ = rates_len - count;
 884
 885                 for (i++; i < sband->n_bitrates; i++) {
 886                         if (BIT(i) & rates) {
 887                                 int rate;
 888
 889                                 rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 890                                                     5 * (1 << shift));
 891                                 *pos++ = (u8)rate;
 892                         }
 893                 }
 894         }
 895 }
 896
 897 static size_t ieee80211_add_before_ht_elems(struct sk_buff *skb,
 898                                             const u8 *elems,
 899                                             size_t elems_len,
 900                                             size_t offset)
 901 {
 902         size_t noffset;
 903
 904         static const u8 before_ht[] = {
 905                 WLAN_EID_SSID,
 906                 WLAN_EID_SUPP_RATES,
 907                 WLAN_EID_EXT_SUPP_RATES,
 908                 WLAN_EID_PWR_CAPABILITY,
 909                 WLAN_EID_SUPPORTED_CHANNELS,
 910                 WLAN_EID_RSN,
 911                 WLAN_EID_QOS_CAPA,
 912                 WLAN_EID_RRM_ENABLED_CAPABILITIES,
 913                 WLAN_EID_MOBILITY_DOMAIN,
 914                 WLAN_EID_FAST_BSS_TRANSITION,   /* reassoc only */
 915                 WLAN_EID_RIC_DATA,              /* reassoc only */
 916                 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 917         };
 918         static const u8 after_ric[] = {
 919                 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 920                 WLAN_EID_HT_CAPABILITY,
 921                 WLAN_EID_BSS_COEX_2040,
 922                 /* luckily this is almost always there */
 923                 WLAN_EID_EXT_CAPABILITY,
 924                 WLAN_EID_QOS_TRAFFIC_CAPA,
 925                 WLAN_EID_TIM_BCAST_REQ,
 926                 WLAN_EID_INTERWORKING,
 927                 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
 928                 WLAN_EID_VHT_CAPABILITY,
 929                 WLAN_EID_OPMODE_NOTIF,
 930         };
 931
 932         if (!elems_len)
 933                 return offset;
 934
 935         noffset = ieee80211_ie_split_ric(elems, elems_len,
 936                                          before_ht,
 937                                          ARRAY_SIZE(before_ht),
 938                                          after_ric,
 939                                          ARRAY_SIZE(after_ric),
 940                                          offset);
 941         skb_put_data(skb, elems + offset, noffset - offset);
 942
 943         return noffset;
 944 }
 945
 946 static size_t ieee80211_add_before_vht_elems(struct sk_buff *skb,
 947                                              const u8 *elems,
 948                                              size_t elems_len,
 949                                              size_t offset)
 950 {
 951         static const u8 before_vht[] = {
 952                 /*
 953                  * no need to list the ones split off before HT
 954                  * or generated here
 955                  */
 956                 WLAN_EID_BSS_COEX_2040,
 957                 WLAN_EID_EXT_CAPABILITY,
 958                 WLAN_EID_QOS_TRAFFIC_CAPA,
 959                 WLAN_EID_TIM_BCAST_REQ,
 960                 WLAN_EID_INTERWORKING,
 961                 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
 962         };
 963         size_t noffset;
 964
 965         if (!elems_len)
 966                 return offset;
 967
 968         /* RIC already taken care of in ieee80211_add_before_ht_elems() */
 969         noffset = ieee80211_ie_split(elems, elems_len,
 970                                      before_vht, ARRAY_SIZE(before_vht),
 971                                      offset);
 972         skb_put_data(skb, elems + offset, noffset - offset);
 973
 974         return noffset;
 975 }
 976
 977 static size_t ieee80211_add_before_he_elems(struct sk_buff *skb,
 978                                             const u8 *elems,
 979                                             size_t elems_len,
 980                                             size_t offset)
 981 {
 982         static const u8 before_he[] = {
 983                 /*
 984                  * no need to list the ones split off before VHT
 985                  * or generated here
 986                  */
 987                 WLAN_EID_OPMODE_NOTIF,
 988                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
 989                 /* 11ai elements */
 990                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
 991                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
 992                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
 993                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
 994                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
 995                 /* TODO: add 11ah/11aj/11ak elements */
 996         };
 997         size_t noffset;
 998
 999         if (!elems_len)
1000                 return offset;
1001
1002         /* RIC already taken care of in ieee80211_add_before_ht_elems() */
1003         noffset = ieee80211_ie_split(elems, elems_len,
1004                                      before_he, ARRAY_SIZE(before_he),
1005                                      offset);
1006         skb_put_data(skb, elems + offset, noffset - offset);
1007
1008         return noffset;
1009 }
1010
1011 #define PRESENT_ELEMS_MAX       8
1012 #define PRESENT_ELEM_EXT_OFFS   0x100
1013
1014 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1015                                         struct sk_buff *skb, u16 capab,
1016                                         const struct element *ext_capa,
1017                                         const u16 *present_elems);
1018
1019 static size_t ieee80211_assoc_link_elems(struct ieee80211_sub_if_data *sdata,
1020                                          struct sk_buff *skb, u16 *capab,
1021                                          const struct element *ext_capa,
1022                                          const u8 *extra_elems,
1023                                          size_t extra_elems_len,
1024                                          unsigned int link_id,
1025                                          struct ieee80211_link_data *link,
1026                                          u16 *present_elems)
1027 {
1028         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1029         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1030         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1031         struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1032         struct ieee80211_channel *chan = cbss->channel;
1033         const struct ieee80211_sband_iftype_data *iftd;
1034         struct ieee80211_local *local = sdata->local;
1035         struct ieee80211_supported_band *sband;
1036         enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20;
1037         struct ieee80211_chanctx_conf *chanctx_conf;
1038         enum ieee80211_smps_mode smps_mode;
1039         u16 orig_capab = *capab;
1040         size_t offset = 0;
1041         int present_elems_len = 0;
1042         u8 *pos;
1043         int i;
1044
1045 #define ADD_PRESENT_ELEM(id) do {                                       \
1046         /* need a last for termination - we use 0 == SSID */            \
1047         if (!WARN_ON(present_elems_len >= PRESENT_ELEMS_MAX - 1))       \
1048                 present_elems[present_elems_len++] = (id);              \
1049 } while (0)
1050 #define ADD_PRESENT_EXT_ELEM(id) ADD_PRESENT_ELEM(PRESENT_ELEM_EXT_OFFS | (id))
1051
1052         if (link)
1053                 smps_mode = link->smps_mode;
1054         else if (sdata->u.mgd.powersave)
1055                 smps_mode = IEEE80211_SMPS_DYNAMIC;
1056         else
1057                 smps_mode = IEEE80211_SMPS_OFF;
1058
1059         if (link) {
1060                 /*
1061                  * 5/10 MHz scenarios are only viable without MLO, in which
1062                  * case this pointer should be used ... All of this is a bit
1063                  * unclear though, not sure this even works at all.
1064                  */
1065                 rcu_read_lock();
1066                 chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
1067                 if (chanctx_conf)
1068                         width = chanctx_conf->def.width;
1069                 rcu_read_unlock();
1070         }
1071
1072         sband = local->hw.wiphy->bands[chan->band];
1073         iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1074
1075         if (sband->band == NL80211_BAND_2GHZ) {
1076                 *capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
1077                 *capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
1078         }
1079
1080         if ((cbss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
1081             ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
1082                 *capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
1083
1084         if (sband->band != NL80211_BAND_S1GHZ)
1085                 ieee80211_assoc_add_rates(skb, width, sband, assoc_data);
1086
1087         if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
1088             *capab & WLAN_CAPABILITY_RADIO_MEASURE) {
1089                 struct cfg80211_chan_def chandef = {
1090                         .width = width,
1091                         .chan = chan,
1092                 };
1093
1094                 pos = skb_put(skb, 4);
1095                 *pos++ = WLAN_EID_PWR_CAPABILITY;
1096                 *pos++ = 2;
1097                 *pos++ = 0; /* min tx power */
1098                  /* max tx power */
1099                 *pos++ = ieee80211_chandef_max_power(&chandef);
1100                 ADD_PRESENT_ELEM(WLAN_EID_PWR_CAPABILITY);
1101         }
1102
1103         /*
1104          * Per spec, we shouldn't include the list of channels if we advertise
1105          * support for extended channel switching, but we've always done that;
1106          * (for now?) apply this restriction only on the (new) 6 GHz band.
1107          */
1108         if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
1109             (sband->band != NL80211_BAND_6GHZ ||
1110              !ext_capa || ext_capa->datalen < 1 ||
1111              !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
1112                 /* TODO: get this in reg domain format */
1113                 pos = skb_put(skb, 2 * sband->n_channels + 2);
1114                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
1115                 *pos++ = 2 * sband->n_channels;
1116                 for (i = 0; i < sband->n_channels; i++) {
1117                         int cf = sband->channels[i].center_freq;
1118
1119                         *pos++ = ieee80211_frequency_to_channel(cf);
1120                         *pos++ = 1; /* one channel in the subband*/
1121                 }
1122                 ADD_PRESENT_ELEM(WLAN_EID_SUPPORTED_CHANNELS);
1123         }
1124
1125         /* if present, add any custom IEs that go before HT */
1126         offset = ieee80211_add_before_ht_elems(skb, extra_elems,
1127                                                extra_elems_len,
1128                                                offset);
1129
1130         if (sband->band != NL80211_BAND_6GHZ &&
1131             !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT)) {
1132                 ieee80211_add_ht_ie(sdata, skb,
1133                                     assoc_data->link[link_id].ap_ht_param,
1134                                     sband, chan, smps_mode,
1135                                     assoc_data->link[link_id].conn_flags);
1136                 ADD_PRESENT_ELEM(WLAN_EID_HT_CAPABILITY);
1137         }
1138
1139         /* if present, add any custom IEs that go before VHT */
1140         offset = ieee80211_add_before_vht_elems(skb, extra_elems,
1141                                                 extra_elems_len,
1142                                                 offset);
1143
1144         if (sband->band != NL80211_BAND_6GHZ &&
1145             !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
1146                 bool mu_mimo_owner =
1147                         ieee80211_add_vht_ie(sdata, skb, sband,
1148                                              &assoc_data->link[link_id].ap_vht_cap,
1149                                              assoc_data->link[link_id].conn_flags);
1150
1151                 if (link)
1152                         link->conf->mu_mimo_owner = mu_mimo_owner;
1153                 ADD_PRESENT_ELEM(WLAN_EID_VHT_CAPABILITY);
1154         }
1155
1156         /*
1157          * If AP doesn't support HT, mark HE and EHT as disabled.
1158          * If on the 5GHz band, make sure it supports VHT.
1159          */
1160         if (assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT ||
1161             (sband->band == NL80211_BAND_5GHZ &&
1162              assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT))
1163                 assoc_data->link[link_id].conn_flags |=
1164                         IEEE80211_CONN_DISABLE_HE |
1165                         IEEE80211_CONN_DISABLE_EHT;
1166
1167         /* if present, add any custom IEs that go before HE */
1168         offset = ieee80211_add_before_he_elems(skb, extra_elems,
1169                                                extra_elems_len,
1170                                                offset);
1171
1172         if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HE)) {
1173                 ieee80211_add_he_ie(sdata, skb, sband, smps_mode,
1174                                     assoc_data->link[link_id].conn_flags);
1175                 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY);
1176         }
1177
1178         /*
1179          * careful - need to know about all the present elems before
1180          * calling ieee80211_assoc_add_ml_elem(), so add this one if
1181          * we're going to put it after the ML element
1182          */
1183         if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
1184                 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_EHT_CAPABILITY);
1185
1186         if (link_id == assoc_data->assoc_link_id)
1187                 ieee80211_assoc_add_ml_elem(sdata, skb, orig_capab, ext_capa,
1188                                             present_elems);
1189
1190         /* crash if somebody gets it wrong */
1191         present_elems = NULL;
1192
1193         if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
1194                 ieee80211_add_eht_ie(sdata, skb, sband);
1195
1196         if (sband->band == NL80211_BAND_S1GHZ) {
1197                 ieee80211_add_aid_request_ie(sdata, skb);
1198                 ieee80211_add_s1g_capab_ie(sdata, &sband->s1g_cap, skb);
1199         }
1200
1201         if (iftd && iftd->vendor_elems.data && iftd->vendor_elems.len)
1202                 skb_put_data(skb, iftd->vendor_elems.data, iftd->vendor_elems.len);
1203
1204         if (link)
1205                 link->u.mgd.conn_flags = assoc_data->link[link_id].conn_flags;
1206
1207         return offset;
1208 }
1209
1210 static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb,
1211                                                const u16 *outer,
1212                                                const u16 *inner)
1213 {
1214         unsigned int skb_len = skb->len;
1215         bool at_extension = false;
1216         bool added = false;
1217         int i, j;
1218         u8 *len, *list_len = NULL;
1219
1220         skb_put_u8(skb, WLAN_EID_EXTENSION);
1221         len = skb_put(skb, 1);
1222         skb_put_u8(skb, WLAN_EID_EXT_NON_INHERITANCE);
1223
1224         for (i = 0; i < PRESENT_ELEMS_MAX && outer[i]; i++) {
1225                 u16 elem = outer[i];
1226                 bool have_inner = false;
1227
1228                 /* should at least be sorted in the sense of normal -> ext */
1229                 WARN_ON(at_extension && elem < PRESENT_ELEM_EXT_OFFS);
1230
1231                 /* switch to extension list */
1232                 if (!at_extension && elem >= PRESENT_ELEM_EXT_OFFS) {
1233                         at_extension = true;
1234                         if (!list_len)
1235                                 skb_put_u8(skb, 0);
1236                         list_len = NULL;
1237                 }
1238
1239                 for (j = 0; j < PRESENT_ELEMS_MAX && inner[j]; j++) {
1240                         if (elem == inner[j]) {
1241                                 have_inner = true;
1242                                 break;
1243                         }
1244                 }
1245
1246                 if (have_inner)
1247                         continue;
1248
1249                 if (!list_len) {
1250                         list_len = skb_put(skb, 1);
1251                         *list_len = 0;
1252                 }
1253                 *list_len += 1;
1254                 skb_put_u8(skb, (u8)elem);
1255                 added = true;
1256         }
1257
1258         /* if we added a list but no extension list, make a zero-len one */
1259         if (added && (!at_extension || !list_len))
1260                 skb_put_u8(skb, 0);
1261
1262         /* if nothing added remove extension element completely */
1263         if (!added)
1264                 skb_trim(skb, skb_len);
1265         else
1266                 *len = skb->len - skb_len - 2;
1267 }
1268
1269 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1270                                         struct sk_buff *skb, u16 capab,
1271                                         const struct element *ext_capa,
1272                                         const u16 *outer_present_elems)
1273 {
1274         struct ieee80211_local *local = sdata->local;
1275         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1276         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1277         struct ieee80211_multi_link_elem *ml_elem;
1278         struct ieee80211_mle_basic_common_info *common;
1279         const struct wiphy_iftype_ext_capab *ift_ext_capa;
1280         __le16 eml_capa = 0, mld_capa_ops = 0;
1281         unsigned int link_id;
1282         u8 *ml_elem_len;
1283         void *capab_pos;
1284
1285         if (!ieee80211_vif_is_mld(&sdata->vif))
1286                 return;
1287
1288         ift_ext_capa = cfg80211_get_iftype_ext_capa(local->hw.wiphy,
1289                                                     ieee80211_vif_type_p2p(&sdata->vif));
1290         if (ift_ext_capa) {
1291                 eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities);
1292                 mld_capa_ops = cpu_to_le16(ift_ext_capa->mld_capa_and_ops);
1293         }
1294
1295         skb_put_u8(skb, WLAN_EID_EXTENSION);
1296         ml_elem_len = skb_put(skb, 1);
1297         skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK);
1298         ml_elem = skb_put(skb, sizeof(*ml_elem));
1299         ml_elem->control =
1300                 cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC |
1301                             IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP);
1302         common = skb_put(skb, sizeof(*common));
1303         common->len = sizeof(*common) +
1304                       2;  /* MLD capa/ops */
1305         memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN);
1306
1307         /* add EML_CAPA only if needed, see Draft P802.11be_D2.1, 35.3.17 */
1308         if (eml_capa &
1309             cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |
1310                          IEEE80211_EML_CAP_EMLMR_SUPPORT))) {
1311                 common->len += 2; /* EML capabilities */
1312                 ml_elem->control |=
1313                         cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EML_CAPA);
1314                 skb_put_data(skb, &eml_capa, sizeof(eml_capa));
1315         }
1316         /* need indication from userspace to support this */
1317         mld_capa_ops &= ~cpu_to_le16(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP);
1318         skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops));
1319
1320         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1321                 u16 link_present_elems[PRESENT_ELEMS_MAX] = {};
1322                 const u8 *extra_elems;
1323                 size_t extra_elems_len;
1324                 size_t extra_used;
1325                 u8 *subelem_len = NULL;
1326                 __le16 ctrl;
1327
1328                 if (!assoc_data->link[link_id].bss ||
1329                     link_id == assoc_data->assoc_link_id)
1330                         continue;
1331
1332                 extra_elems = assoc_data->link[link_id].elems;
1333                 extra_elems_len = assoc_data->link[link_id].elems_len;
1334
1335                 skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE);
1336                 subelem_len = skb_put(skb, 1);
1337
1338                 ctrl = cpu_to_le16(link_id |
1339                                    IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE |
1340                                    IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT);
1341                 skb_put_data(skb, &ctrl, sizeof(ctrl));
1342                 skb_put_u8(skb, 1 + ETH_ALEN); /* STA Info Length */
1343                 skb_put_data(skb, assoc_data->link[link_id].addr,
1344                              ETH_ALEN);
1345                 /*
1346                  * Now add the contents of the (re)association request,
1347                  * but the "listen interval" and "current AP address"
1348                  * (if applicable) are skipped. So we only have
1349                  * the capability field (remember the position and fill
1350                  * later), followed by the elements added below by
1351                  * calling ieee80211_assoc_link_elems().
1352                  */
1353                 capab_pos = skb_put(skb, 2);
1354
1355                 extra_used = ieee80211_assoc_link_elems(sdata, skb, &capab,
1356                                                         ext_capa,
1357                                                         extra_elems,
1358                                                         extra_elems_len,
1359                                                         link_id, NULL,
1360                                                         link_present_elems);
1361                 if (extra_elems)
1362                         skb_put_data(skb, extra_elems + extra_used,
1363                                      extra_elems_len - extra_used);
1364
1365                 put_unaligned_le16(capab, capab_pos);
1366
1367                 ieee80211_add_non_inheritance_elem(skb, outer_present_elems,
1368                                                    link_present_elems);
1369
1370                 ieee80211_fragment_element(skb, subelem_len,
1371                                            IEEE80211_MLE_SUBELEM_FRAGMENT);
1372         }
1373
1374         ieee80211_fragment_element(skb, ml_elem_len, WLAN_EID_FRAGMENT);
1375 }
1376
1377 static int ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
1378 {
1379         struct ieee80211_local *local = sdata->local;
1380         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1381         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1382         struct ieee80211_link_data *link;
1383         struct sk_buff *skb;
1384         struct ieee80211_mgmt *mgmt;
1385         u8 *pos, qos_info, *ie_start;
1386         size_t offset, noffset;
1387         u16 capab = WLAN_CAPABILITY_ESS, link_capab;
1388         __le16 listen_int;
1389         struct element *ext_capa = NULL;
1390         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1391         struct ieee80211_prep_tx_info info = {};
1392         unsigned int link_id, n_links = 0;
1393         u16 present_elems[PRESENT_ELEMS_MAX] = {};
1394         void *capab_pos;
1395         size_t size;
1396         int ret;
1397
1398         /* we know it's writable, cast away the const */
1399         if (assoc_data->ie_len)
1400                 ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
1401                                                       assoc_data->ie,
1402                                                       assoc_data->ie_len);
1403
1404         sdata_assert_lock(sdata);
1405
1406         size = local->hw.extra_tx_headroom +
1407                sizeof(*mgmt) + /* bit too much but doesn't matter */
1408                2 + assoc_data->ssid_len + /* SSID */
1409                assoc_data->ie_len + /* extra IEs */
1410                (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
1411                9; /* WMM */
1412
1413         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1414                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1415                 const struct ieee80211_sband_iftype_data *iftd;
1416                 struct ieee80211_supported_band *sband;
1417
1418                 if (!cbss)
1419                         continue;
1420
1421                 sband = local->hw.wiphy->bands[cbss->channel->band];
1422
1423                 n_links++;
1424                 /* add STA profile elements length */
1425                 size += assoc_data->link[link_id].elems_len;
1426                 /* and supported rates length */
1427                 size += 4 + sband->n_bitrates;
1428                 /* supported channels */
1429                 size += 2 + 2 * sband->n_channels;
1430
1431                 iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1432                 if (iftd)
1433                         size += iftd->vendor_elems.len;
1434
1435                 /* power capability */
1436                 size += 4;
1437
1438                 /* HT, VHT, HE, EHT */
1439                 size += 2 + sizeof(struct ieee80211_ht_cap);
1440                 size += 2 + sizeof(struct ieee80211_vht_cap);
1441                 size += 2 + 1 + sizeof(struct ieee80211_he_cap_elem) +
1442                         sizeof(struct ieee80211_he_mcs_nss_supp) +
1443                         IEEE80211_HE_PPE_THRES_MAX_LEN;
1444
1445                 if (sband->band == NL80211_BAND_6GHZ)
1446                         size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa);
1447
1448                 size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) +
1449                         sizeof(struct ieee80211_eht_mcs_nss_supp) +
1450                         IEEE80211_EHT_PPE_THRES_MAX_LEN;
1451
1452                 /* non-inheritance element */
1453                 size += 2 + 2 + PRESENT_ELEMS_MAX;
1454
1455                 /* should be the same across all BSSes */
1456                 if (cbss->capability & WLAN_CAPABILITY_PRIVACY)
1457                         capab |= WLAN_CAPABILITY_PRIVACY;
1458         }
1459
1460         if (ieee80211_vif_is_mld(&sdata->vif)) {
1461                 /* consider the multi-link element with STA profile */
1462                 size += sizeof(struct ieee80211_multi_link_elem);
1463                 /* max common info field in basic multi-link element */
1464                 size += sizeof(struct ieee80211_mle_basic_common_info) +
1465                         2 + /* capa & op */
1466                         2; /* EML capa */
1467
1468                 /*
1469                  * The capability elements were already considered above;
1470                  * note this over-estimates a bit because there's no
1471                  * STA profile for the assoc link.
1472                  */
1473                 size += (n_links - 1) *
1474                         (1 + 1 + /* subelement ID/length */
1475                          2 + /* STA control */
1476                          1 + ETH_ALEN + 2 /* STA Info field */);
1477         }
1478
1479         link = sdata_dereference(sdata->link[assoc_data->assoc_link_id], sdata);
1480         if (WARN_ON(!link))
1481                 return -EINVAL;
1482
1483         if (WARN_ON(!assoc_data->link[assoc_data->assoc_link_id].bss))
1484                 return -EINVAL;
1485
1486         skb = alloc_skb(size, GFP_KERNEL);
1487         if (!skb)
1488                 return -ENOMEM;
1489
1490         skb_reserve(skb, local->hw.extra_tx_headroom);
1491
1492         if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
1493                 capab |= WLAN_CAPABILITY_RADIO_MEASURE;
1494
1495         /* Set MBSSID support for HE AP if needed */
1496         if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
1497             !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
1498             ext_capa && ext_capa->datalen >= 3)
1499                 ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
1500
1501         mgmt = skb_put_zero(skb, 24);
1502         memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
1503         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1504         memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
1505
1506         listen_int = cpu_to_le16(assoc_data->s1g ?
1507                         ieee80211_encode_usf(local->hw.conf.listen_interval) :
1508                         local->hw.conf.listen_interval);
1509         if (!is_zero_ether_addr(assoc_data->prev_ap_addr)) {
1510                 skb_put(skb, 10);
1511                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1512                                                   IEEE80211_STYPE_REASSOC_REQ);
1513                 capab_pos = &mgmt->u.reassoc_req.capab_info;
1514                 mgmt->u.reassoc_req.listen_interval = listen_int;
1515                 memcpy(mgmt->u.reassoc_req.current_ap,
1516                        assoc_data->prev_ap_addr, ETH_ALEN);
1517                 info.subtype = IEEE80211_STYPE_REASSOC_REQ;
1518         } else {
1519                 skb_put(skb, 4);
1520                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1521                                                   IEEE80211_STYPE_ASSOC_REQ);
1522                 capab_pos = &mgmt->u.assoc_req.capab_info;
1523                 mgmt->u.assoc_req.listen_interval = listen_int;
1524                 info.subtype = IEEE80211_STYPE_ASSOC_REQ;
1525         }
1526
1527         /* SSID */
1528         pos = skb_put(skb, 2 + assoc_data->ssid_len);
1529         ie_start = pos;
1530         *pos++ = WLAN_EID_SSID;
1531         *pos++ = assoc_data->ssid_len;
1532         memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
1533
1534         /* add the elements for the assoc (main) link */
1535         link_capab = capab;
1536         offset = ieee80211_assoc_link_elems(sdata, skb, &link_capab,
1537                                             ext_capa,
1538                                             assoc_data->ie,
1539                                             assoc_data->ie_len,
1540                                             assoc_data->assoc_link_id, link,
1541                                             present_elems);
1542         put_unaligned_le16(link_capab, capab_pos);
1543
1544         /* if present, add any custom non-vendor IEs */
1545         if (assoc_data->ie_len) {
1546                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
1547                                                     assoc_data->ie_len,
1548                                                     offset);
1549                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1550                 offset = noffset;
1551         }
1552
1553         if (assoc_data->wmm) {
1554                 if (assoc_data->uapsd) {
1555                         qos_info = ifmgd->uapsd_queues;
1556                         qos_info |= (ifmgd->uapsd_max_sp_len <<
1557                                      IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
1558                 } else {
1559                         qos_info = 0;
1560                 }
1561
1562                 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
1563         }
1564
1565         /* add any remaining custom (i.e. vendor specific here) IEs */
1566         if (assoc_data->ie_len) {
1567                 noffset = assoc_data->ie_len;
1568                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1569         }
1570
1571         if (assoc_data->fils_kek_len) {
1572                 ret = fils_encrypt_assoc_req(skb, assoc_data);
1573                 if (ret < 0) {
1574                         dev_kfree_skb(skb);
1575                         return ret;
1576                 }
1577         }
1578
1579         pos = skb_tail_pointer(skb);
1580         kfree(ifmgd->assoc_req_ies);
1581         ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
1582         if (!ifmgd->assoc_req_ies) {
1583                 dev_kfree_skb(skb);
1584                 return -ENOMEM;
1585         }
1586
1587         ifmgd->assoc_req_ies_len = pos - ie_start;
1588
1589         drv_mgd_prepare_tx(local, sdata, &info);
1590
1591         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1592         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1593                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
1594                                                 IEEE80211_TX_INTFL_MLME_CONN_TX;
1595         ieee80211_tx_skb(sdata, skb);
1596
1597         return 0;
1598 }
1599
1600 void ieee80211_send_pspoll(struct ieee80211_local *local,
1601                            struct ieee80211_sub_if_data *sdata)
1602 {
1603         struct ieee80211_pspoll *pspoll;
1604         struct sk_buff *skb;
1605
1606         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
1607         if (!skb)
1608                 return;
1609
1610         pspoll = (struct ieee80211_pspoll *) skb->data;
1611         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1612
1613         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1614         ieee80211_tx_skb(sdata, skb);
1615 }
1616
1617 void ieee80211_send_nullfunc(struct ieee80211_local *local,
1618                              struct ieee80211_sub_if_data *sdata,
1619                              bool powersave)
1620 {
1621         struct sk_buff *skb;
1622         struct ieee80211_hdr_3addr *nullfunc;
1623         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1624
1625         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, -1,
1626                                      !ieee80211_hw_check(&local->hw,
1627                                                          DOESNT_SUPPORT_QOS_NDP));
1628         if (!skb)
1629                 return;
1630
1631         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1632         if (powersave)
1633                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1634
1635         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1636                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1637
1638         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1639                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1640
1641         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1642                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1643
1644         ieee80211_tx_skb(sdata, skb);
1645 }
1646
1647 void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
1648                                    struct ieee80211_sub_if_data *sdata)
1649 {
1650         struct sk_buff *skb;
1651         struct ieee80211_hdr *nullfunc;
1652         __le16 fc;
1653
1654         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1655                 return;
1656
1657         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1658         if (!skb)
1659                 return;
1660
1661         skb_reserve(skb, local->hw.extra_tx_headroom);
1662
1663         nullfunc = skb_put_zero(skb, 30);
1664         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
1665                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
1666         nullfunc->frame_control = fc;
1667         memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1668         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1669         memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1670         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
1671
1672         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1673         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1674         ieee80211_tx_skb(sdata, skb);
1675 }
1676
1677 /* spectrum management related things */
1678 static void ieee80211_chswitch_work(struct wiphy *wiphy,
1679                                     struct wiphy_work *work)
1680 {
1681         struct ieee80211_link_data *link =
1682                 container_of(work, struct ieee80211_link_data,
1683                              u.mgd.chswitch_work.work);
1684         struct ieee80211_sub_if_data *sdata = link->sdata;
1685         struct ieee80211_local *local = sdata->local;
1686         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1687         int ret;
1688
1689         if (!ieee80211_sdata_running(sdata))
1690                 return;
1691
1692         sdata_lock(sdata);
1693         mutex_lock(&local->mtx);
1694         mutex_lock(&local->chanctx_mtx);
1695
1696         if (!ifmgd->associated)
1697                 goto out;
1698
1699         if (!link->conf->csa_active)
1700                 goto out;
1701
1702         /*
1703          * using reservation isn't immediate as it may be deferred until later
1704          * with multi-vif. once reservation is complete it will re-schedule the
1705          * work with no reserved_chanctx so verify chandef to check if it
1706          * completed successfully
1707          */
1708
1709         if (link->reserved_chanctx) {
1710                 /*
1711                  * with multi-vif csa driver may call ieee80211_csa_finish()
1712                  * many times while waiting for other interfaces to use their
1713                  * reservations
1714                  */
1715                 if (link->reserved_ready)
1716                         goto out;
1717
1718                 ret = ieee80211_link_use_reserved_context(link);
1719                 if (ret) {
1720                         sdata_info(sdata,
1721                                    "failed to use reserved channel context, disconnecting (err=%d)\n",
1722                                    ret);
1723                         wiphy_work_queue(sdata->local->hw.wiphy,
1724                                          &ifmgd->csa_connection_drop_work);
1725                         goto out;
1726                 }
1727
1728                 goto out;
1729         }
1730
1731         if (!cfg80211_chandef_identical(&link->conf->chandef,
1732                                         &link->csa_chandef)) {
1733                 sdata_info(sdata,
1734                            "failed to finalize channel switch, disconnecting\n");
1735                 wiphy_work_queue(sdata->local->hw.wiphy,
1736                                  &ifmgd->csa_connection_drop_work);
1737                 goto out;
1738         }
1739
1740         link->u.mgd.csa_waiting_bcn = true;
1741
1742         ieee80211_sta_reset_beacon_monitor(sdata);
1743         ieee80211_sta_reset_conn_monitor(sdata);
1744
1745 out:
1746         mutex_unlock(&local->chanctx_mtx);
1747         mutex_unlock(&local->mtx);
1748         sdata_unlock(sdata);
1749 }
1750
1751 static void ieee80211_chswitch_post_beacon(struct ieee80211_link_data *link)
1752 {
1753         struct ieee80211_sub_if_data *sdata = link->sdata;
1754         struct ieee80211_local *local = sdata->local;
1755         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1756         int ret;
1757
1758         sdata_assert_lock(sdata);
1759
1760         WARN_ON(!link->conf->csa_active);
1761
1762         if (link->csa_block_tx) {
1763                 ieee80211_wake_vif_queues(local, sdata,
1764                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1765                 link->csa_block_tx = false;
1766         }
1767
1768         link->conf->csa_active = false;
1769         link->u.mgd.csa_waiting_bcn = false;
1770         /*
1771          * If the CSA IE is still present on the beacon after the switch,
1772          * we need to consider it as a new CSA (possibly to self).
1773          */
1774         link->u.mgd.beacon_crc_valid = false;
1775
1776         ret = drv_post_channel_switch(sdata);
1777         if (ret) {
1778                 sdata_info(sdata,
1779                            "driver post channel switch failed, disconnecting\n");
1780                 wiphy_work_queue(sdata->local->hw.wiphy,
1781                                  &ifmgd->csa_connection_drop_work);
1782                 return;
1783         }
1784
1785         cfg80211_ch_switch_notify(sdata->dev, &link->reserved_chandef, 0, 0);
1786 }
1787
1788 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1789 {
1790         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1791         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1792
1793         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
1794                 success = false;
1795
1796         trace_api_chswitch_done(sdata, success);
1797         if (!success) {
1798                 sdata_info(sdata,
1799                            "driver channel switch failed, disconnecting\n");
1800                 wiphy_work_queue(sdata->local->hw.wiphy,
1801                                  &ifmgd->csa_connection_drop_work);
1802         } else {
1803                 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
1804                                          &sdata->deflink.u.mgd.chswitch_work,
1805                                          0);
1806         }
1807 }
1808 EXPORT_SYMBOL(ieee80211_chswitch_done);
1809
1810 static void
1811 ieee80211_sta_abort_chanswitch(struct ieee80211_link_data *link)
1812 {
1813         struct ieee80211_sub_if_data *sdata = link->sdata;
1814         struct ieee80211_local *local = sdata->local;
1815
1816         if (!local->ops->abort_channel_switch)
1817                 return;
1818
1819         mutex_lock(&local->mtx);
1820
1821         mutex_lock(&local->chanctx_mtx);
1822         ieee80211_link_unreserve_chanctx(link);
1823         mutex_unlock(&local->chanctx_mtx);
1824
1825         if (link->csa_block_tx)
1826                 ieee80211_wake_vif_queues(local, sdata,
1827                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1828
1829         link->csa_block_tx = false;
1830         link->conf->csa_active = false;
1831
1832         mutex_unlock(&local->mtx);
1833
1834         drv_abort_channel_switch(sdata);
1835 }
1836
1837 static void
1838 ieee80211_sta_process_chanswitch(struct ieee80211_link_data *link,
1839                                  u64 timestamp, u32 device_timestamp,
1840                                  struct ieee802_11_elems *elems,
1841                                  bool beacon)
1842 {
1843         struct ieee80211_sub_if_data *sdata = link->sdata;
1844         struct ieee80211_local *local = sdata->local;
1845         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1846         struct cfg80211_bss *cbss = link->u.mgd.bss;
1847         struct ieee80211_chanctx_conf *conf;
1848         struct ieee80211_chanctx *chanctx;
1849         enum nl80211_band current_band;
1850         struct ieee80211_csa_ie csa_ie;
1851         struct ieee80211_channel_switch ch_switch;
1852         struct ieee80211_bss *bss;
1853         unsigned long timeout;
1854         int res;
1855
1856         sdata_assert_lock(sdata);
1857
1858         if (!cbss)
1859                 return;
1860
1861         current_band = cbss->channel->band;
1862         bss = (void *)cbss->priv;
1863         res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1864                                            bss->vht_cap_info,
1865                                            link->u.mgd.conn_flags,
1866                                            link->u.mgd.bssid, &csa_ie);
1867
1868         if (!res) {
1869                 ch_switch.timestamp = timestamp;
1870                 ch_switch.device_timestamp = device_timestamp;
1871                 ch_switch.block_tx = csa_ie.mode;
1872                 ch_switch.chandef = csa_ie.chandef;
1873                 ch_switch.count = csa_ie.count;
1874                 ch_switch.delay = csa_ie.max_switch_time;
1875         }
1876
1877         if (res < 0)
1878                 goto lock_and_drop_connection;
1879
1880         if (beacon && link->conf->csa_active &&
1881             !link->u.mgd.csa_waiting_bcn) {
1882                 if (res)
1883                         ieee80211_sta_abort_chanswitch(link);
1884                 else
1885                         drv_channel_switch_rx_beacon(sdata, &ch_switch);
1886                 return;
1887         } else if (link->conf->csa_active || res) {
1888                 /* disregard subsequent announcements if already processing */
1889                 return;
1890         }
1891
1892         if (link->conf->chandef.chan->band !=
1893             csa_ie.chandef.chan->band) {
1894                 sdata_info(sdata,
1895                            "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1896                            link->u.mgd.bssid,
1897                            csa_ie.chandef.chan->center_freq,
1898                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1899                            csa_ie.chandef.center_freq2);
1900                 goto lock_and_drop_connection;
1901         }
1902
1903         if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1904                                      IEEE80211_CHAN_DISABLED)) {
1905                 sdata_info(sdata,
1906                            "AP %pM switches to unsupported channel "
1907                            "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
1908                            "disconnecting\n",
1909                            link->u.mgd.bssid,
1910                            csa_ie.chandef.chan->center_freq,
1911                            csa_ie.chandef.chan->freq_offset,
1912                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1913                            csa_ie.chandef.freq1_offset,
1914                            csa_ie.chandef.center_freq2);
1915                 goto lock_and_drop_connection;
1916         }
1917
1918         if (cfg80211_chandef_identical(&csa_ie.chandef,
1919                                        &link->conf->chandef) &&
1920             (!csa_ie.mode || !beacon)) {
1921                 if (link->u.mgd.csa_ignored_same_chan)
1922                         return;
1923                 sdata_info(sdata,
1924                            "AP %pM tries to chanswitch to same channel, ignore\n",
1925                            link->u.mgd.bssid);
1926                 link->u.mgd.csa_ignored_same_chan = true;
1927                 return;
1928         }
1929
1930         /*
1931          * Drop all TDLS peers - either we disconnect or move to a different
1932          * channel from this point on. There's no telling what our peer will do.
1933          * The TDLS WIDER_BW scenario is also problematic, as peers might now
1934          * have an incompatible wider chandef.
1935          */
1936         ieee80211_teardown_tdls_peers(sdata);
1937
1938         mutex_lock(&local->mtx);
1939         mutex_lock(&local->chanctx_mtx);
1940         conf = rcu_dereference_protected(link->conf->chanctx_conf,
1941                                          lockdep_is_held(&local->chanctx_mtx));
1942         if (!conf) {
1943                 sdata_info(sdata,
1944                            "no channel context assigned to vif?, disconnecting\n");
1945                 goto drop_connection;
1946         }
1947
1948         chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1949
1950         if (local->use_chanctx &&
1951             !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1952                 sdata_info(sdata,
1953                            "driver doesn't support chan-switch with channel contexts\n");
1954                 goto drop_connection;
1955         }
1956
1957         if (drv_pre_channel_switch(sdata, &ch_switch)) {
1958                 sdata_info(sdata,
1959                            "preparing for channel switch failed, disconnecting\n");
1960                 goto drop_connection;
1961         }
1962
1963         res = ieee80211_link_reserve_chanctx(link, &csa_ie.chandef,
1964                                              chanctx->mode, false);
1965         if (res) {
1966                 sdata_info(sdata,
1967                            "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1968                            res);
1969                 goto drop_connection;
1970         }
1971         mutex_unlock(&local->chanctx_mtx);
1972
1973         link->conf->csa_active = true;
1974         link->csa_chandef = csa_ie.chandef;
1975         link->csa_block_tx = csa_ie.mode;
1976         link->u.mgd.csa_ignored_same_chan = false;
1977         link->u.mgd.beacon_crc_valid = false;
1978
1979         if (link->csa_block_tx)
1980                 ieee80211_stop_vif_queues(local, sdata,
1981                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1982         mutex_unlock(&local->mtx);
1983
1984         cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
1985                                           link->link_id, csa_ie.count,
1986                                           csa_ie.mode, 0);
1987
1988         if (local->ops->channel_switch) {
1989                 /* use driver's channel switch callback */
1990                 drv_channel_switch(local, sdata, &ch_switch);
1991                 return;
1992         }
1993
1994         /* channel switch handled in software */
1995         timeout = TU_TO_JIFFIES((max_t(int, csa_ie.count, 1) - 1) *
1996                                 cbss->beacon_interval);
1997         wiphy_delayed_work_queue(local->hw.wiphy,
1998                                  &link->u.mgd.chswitch_work,
1999                                  timeout);
2000         return;
2001  lock_and_drop_connection:
2002         mutex_lock(&local->mtx);
2003         mutex_lock(&local->chanctx_mtx);
2004  drop_connection:
2005         /*
2006          * This is just so that the disconnect flow will know that
2007          * we were trying to switch channel and failed. In case the
2008          * mode is 1 (we are not allowed to Tx), we will know not to
2009          * send a deauthentication frame. Those two fields will be
2010          * reset when the disconnection worker runs.
2011          */
2012         link->conf->csa_active = true;
2013         link->csa_block_tx = csa_ie.mode;
2014
2015         wiphy_work_queue(sdata->local->hw.wiphy,
2016                          &ifmgd->csa_connection_drop_work);
2017         mutex_unlock(&local->chanctx_mtx);
2018         mutex_unlock(&local->mtx);
2019 }
2020
2021 static bool
2022 ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
2023                                  struct ieee80211_channel *channel,
2024                                  const u8 *country_ie, u8 country_ie_len,
2025                                  const u8 *pwr_constr_elem,
2026                                  int *chan_pwr, int *pwr_reduction)
2027 {
2028         struct ieee80211_country_ie_triplet *triplet;
2029         int chan = ieee80211_frequency_to_channel(channel->center_freq);
2030         int i, chan_increment;
2031         bool have_chan_pwr = false;
2032
2033         /* Invalid IE */
2034         if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
2035                 return false;
2036
2037         triplet = (void *)(country_ie + 3);
2038         country_ie_len -= 3;
2039
2040         switch (channel->band) {
2041         default:
2042                 WARN_ON_ONCE(1);
2043                 fallthrough;
2044         case NL80211_BAND_2GHZ:
2045         case NL80211_BAND_60GHZ:
2046         case NL80211_BAND_LC:
2047                 chan_increment = 1;
2048                 break;
2049         case NL80211_BAND_5GHZ:
2050                 chan_increment = 4;
2051                 break;
2052         case NL80211_BAND_6GHZ:
2053                 /*
2054                  * In the 6 GHz band, the "maximum transmit power level"
2055                  * field in the triplets is reserved, and thus will be
2056                  * zero and we shouldn't use it to control TX power.
2057                  * The actual TX power will be given in the transmit
2058                  * power envelope element instead.
2059                  */
2060                 return false;
2061         }
2062
2063         /* find channel */
2064         while (country_ie_len >= 3) {
2065                 u8 first_channel = triplet->chans.first_channel;
2066
2067                 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
2068                         goto next;
2069
2070                 for (i = 0; i < triplet->chans.num_channels; i++) {
2071                         if (first_channel + i * chan_increment == chan) {
2072                                 have_chan_pwr = true;
2073                                 *chan_pwr = triplet->chans.max_power;
2074                                 break;
2075                         }
2076                 }
2077                 if (have_chan_pwr)
2078                         break;
2079
2080  next:
2081                 triplet++;
2082                 country_ie_len -= 3;
2083         }
2084
2085         if (have_chan_pwr && pwr_constr_elem)
2086                 *pwr_reduction = *pwr_constr_elem;
2087         else
2088                 *pwr_reduction = 0;
2089
2090         return have_chan_pwr;
2091 }
2092
2093 static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
2094                                       struct ieee80211_channel *channel,
2095                                       const u8 *cisco_dtpc_ie,
2096                                       int *pwr_level)
2097 {
2098         /* From practical testing, the first data byte of the DTPC element
2099          * seems to contain the requested dBm level, and the CLI on Cisco
2100          * APs clearly state the range is -127 to 127 dBm, which indicates
2101          * a signed byte, although it seemingly never actually goes negative.
2102          * The other byte seems to always be zero.
2103          */
2104         *pwr_level = (__s8)cisco_dtpc_ie[4];
2105 }
2106
2107 static u64 ieee80211_handle_pwr_constr(struct ieee80211_link_data *link,
2108                                        struct ieee80211_channel *channel,
2109                                        struct ieee80211_mgmt *mgmt,
2110                                        const u8 *country_ie, u8 country_ie_len,
2111                                        const u8 *pwr_constr_ie,
2112                                        const u8 *cisco_dtpc_ie)
2113 {
2114         struct ieee80211_sub_if_data *sdata = link->sdata;
2115         bool has_80211h_pwr = false, has_cisco_pwr = false;
2116         int chan_pwr = 0, pwr_reduction_80211h = 0;
2117         int pwr_level_cisco, pwr_level_80211h;
2118         int new_ap_level;
2119         __le16 capab = mgmt->u.probe_resp.capab_info;
2120
2121         if (ieee80211_is_s1g_beacon(mgmt->frame_control))
2122                 return 0;       /* TODO */
2123
2124         if (country_ie &&
2125             (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
2126              capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
2127                 has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
2128                         sdata, channel, country_ie, country_ie_len,
2129                         pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
2130                 pwr_level_80211h =
2131                         max_t(int, 0, chan_pwr - pwr_reduction_80211h);
2132         }
2133
2134         if (cisco_dtpc_ie) {
2135                 ieee80211_find_cisco_dtpc(
2136                         sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
2137                 has_cisco_pwr = true;
2138         }
2139
2140         if (!has_80211h_pwr && !has_cisco_pwr)
2141                 return 0;
2142
2143         /* If we have both 802.11h and Cisco DTPC, apply both limits
2144          * by picking the smallest of the two power levels advertised.
2145          */
2146         if (has_80211h_pwr &&
2147             (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
2148                 new_ap_level = pwr_level_80211h;
2149
2150                 if (link->ap_power_level == new_ap_level)
2151                         return 0;
2152
2153                 sdata_dbg(sdata,
2154                           "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
2155                           pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
2156                           link->u.mgd.bssid);
2157         } else {  /* has_cisco_pwr is always true here. */
2158                 new_ap_level = pwr_level_cisco;
2159
2160                 if (link->ap_power_level == new_ap_level)
2161                         return 0;
2162
2163                 sdata_dbg(sdata,
2164                           "Limiting TX power to %d dBm as advertised by %pM\n",
2165                           pwr_level_cisco, link->u.mgd.bssid);
2166         }
2167
2168         link->ap_power_level = new_ap_level;
2169         if (__ieee80211_recalc_txpower(sdata))
2170                 return BSS_CHANGED_TXPOWER;
2171         return 0;
2172 }
2173
2174 /* powersave */
2175 static void ieee80211_enable_ps(struct ieee80211_local *local,
2176                                 struct ieee80211_sub_if_data *sdata)
2177 {
2178         struct ieee80211_conf *conf = &local->hw.conf;
2179
2180         /*
2181          * If we are scanning right now then the parameters will
2182          * take effect when scan finishes.
2183          */
2184         if (local->scanning)
2185                 return;
2186
2187         if (conf->dynamic_ps_timeout > 0 &&
2188             !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2189                 mod_timer(&local->dynamic_ps_timer, jiffies +
2190                           msecs_to_jiffies(conf->dynamic_ps_timeout));
2191         } else {
2192                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
2193                         ieee80211_send_nullfunc(local, sdata, true);
2194
2195                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2196                     ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2197                         return;
2198
2199                 conf->flags |= IEEE80211_CONF_PS;
2200                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2201         }
2202 }
2203
2204 static void ieee80211_change_ps(struct ieee80211_local *local)
2205 {
2206         struct ieee80211_conf *conf = &local->hw.conf;
2207
2208         if (local->ps_sdata) {
2209                 ieee80211_enable_ps(local, local->ps_sdata);
2210         } else if (conf->flags & IEEE80211_CONF_PS) {
2211                 conf->flags &= ~IEEE80211_CONF_PS;
2212                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2213                 del_timer_sync(&local->dynamic_ps_timer);
2214                 cancel_work_sync(&local->dynamic_ps_enable_work);
2215         }
2216 }
2217
2218 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
2219 {
2220         struct ieee80211_local *local = sdata->local;
2221         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
2222         struct sta_info *sta = NULL;
2223         bool authorized = false;
2224
2225         if (!mgd->powersave)
2226                 return false;
2227
2228         if (mgd->broken_ap)
2229                 return false;
2230
2231         if (!mgd->associated)
2232                 return false;
2233
2234         if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
2235                 return false;
2236
2237         if (!(local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO) &&
2238             !sdata->deflink.u.mgd.have_beacon)
2239                 return false;
2240
2241         rcu_read_lock();
2242         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
2243         if (sta)
2244                 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2245         rcu_read_unlock();
2246
2247         return authorized;
2248 }
2249
2250 /* need to hold RTNL or interface lock */
2251 void ieee80211_recalc_ps(struct ieee80211_local *local)
2252 {
2253         struct ieee80211_sub_if_data *sdata, *found = NULL;
2254         int count = 0;
2255         int timeout;
2256
2257         if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS) ||
2258             ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2259                 local->ps_sdata = NULL;
2260                 return;
2261         }
2262
2263         list_for_each_entry(sdata, &local->interfaces, list) {
2264                 if (!ieee80211_sdata_running(sdata))
2265                         continue;
2266                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
2267                         /* If an AP vif is found, then disable PS
2268                          * by setting the count to zero thereby setting
2269                          * ps_sdata to NULL.
2270                          */
2271                         count = 0;
2272                         break;
2273                 }
2274                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2275                         continue;
2276                 found = sdata;
2277                 count++;
2278         }
2279
2280         if (count == 1 && ieee80211_powersave_allowed(found)) {
2281                 u8 dtimper = found->deflink.u.mgd.dtim_period;
2282
2283                 timeout = local->dynamic_ps_forced_timeout;
2284                 if (timeout < 0)
2285                         timeout = 100;
2286                 local->hw.conf.dynamic_ps_timeout = timeout;
2287
2288                 /* If the TIM IE is invalid, pretend the value is 1 */
2289                 if (!dtimper)
2290                         dtimper = 1;
2291
2292                 local->hw.conf.ps_dtim_period = dtimper;
2293                 local->ps_sdata = found;
2294         } else {
2295                 local->ps_sdata = NULL;
2296         }
2297
2298         ieee80211_change_ps(local);
2299 }
2300
2301 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
2302 {
2303         bool ps_allowed = ieee80211_powersave_allowed(sdata);
2304
2305         if (sdata->vif.cfg.ps != ps_allowed) {
2306                 sdata->vif.cfg.ps = ps_allowed;
2307                 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_PS);
2308         }
2309 }
2310
2311 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
2312 {
2313         struct ieee80211_local *local =
2314                 container_of(work, struct ieee80211_local,
2315                              dynamic_ps_disable_work);
2316
2317         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2318                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2319                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2320         }
2321
2322         ieee80211_wake_queues_by_reason(&local->hw,
2323                                         IEEE80211_MAX_QUEUE_MAP,
2324                                         IEEE80211_QUEUE_STOP_REASON_PS,
2325                                         false);
2326 }
2327
2328 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
2329 {
2330         struct ieee80211_local *local =
2331                 container_of(work, struct ieee80211_local,
2332                              dynamic_ps_enable_work);
2333         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
2334         struct ieee80211_if_managed *ifmgd;
2335         unsigned long flags;
2336         int q;
2337
2338         /* can only happen when PS was just disabled anyway */
2339         if (!sdata)
2340                 return;
2341
2342         ifmgd = &sdata->u.mgd;
2343
2344         if (local->hw.conf.flags & IEEE80211_CONF_PS)
2345                 return;
2346
2347         if (local->hw.conf.dynamic_ps_timeout > 0) {
2348                 /* don't enter PS if TX frames are pending */
2349                 if (drv_tx_frames_pending(local)) {
2350                         mod_timer(&local->dynamic_ps_timer, jiffies +
2351                                   msecs_to_jiffies(
2352                                   local->hw.conf.dynamic_ps_timeout));
2353                         return;
2354                 }
2355
2356                 /*
2357                  * transmission can be stopped by others which leads to
2358                  * dynamic_ps_timer expiry. Postpone the ps timer if it
2359                  * is not the actual idle state.
2360                  */
2361                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2362                 for (q = 0; q < local->hw.queues; q++) {
2363                         if (local->queue_stop_reasons[q]) {
2364                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
2365                                                        flags);
2366                                 mod_timer(&local->dynamic_ps_timer, jiffies +
2367                                           msecs_to_jiffies(
2368                                           local->hw.conf.dynamic_ps_timeout));
2369                                 return;
2370                         }
2371                 }
2372                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2373         }
2374
2375         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2376             !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2377                 if (drv_tx_frames_pending(local)) {
2378                         mod_timer(&local->dynamic_ps_timer, jiffies +
2379                                   msecs_to_jiffies(
2380                                   local->hw.conf.dynamic_ps_timeout));
2381                 } else {
2382                         ieee80211_send_nullfunc(local, sdata, true);
2383                         /* Flush to get the tx status of nullfunc frame */
2384                         ieee80211_flush_queues(local, sdata, false);
2385                 }
2386         }
2387
2388         if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
2389               ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
2390             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2391                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
2392                 local->hw.conf.flags |= IEEE80211_CONF_PS;
2393                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2394         }
2395 }
2396
2397 void ieee80211_dynamic_ps_timer(struct timer_list *t)
2398 {
2399         struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
2400
2401         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
2402 }
2403
2404 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
2405 {
2406         struct delayed_work *delayed_work = to_delayed_work(work);
2407         struct ieee80211_link_data *link =
2408                 container_of(delayed_work, struct ieee80211_link_data,
2409                              dfs_cac_timer_work);
2410         struct cfg80211_chan_def chandef = link->conf->chandef;
2411         struct ieee80211_sub_if_data *sdata = link->sdata;
2412
2413         mutex_lock(&sdata->local->mtx);
2414         if (sdata->wdev.cac_started) {
2415                 ieee80211_link_release_channel(link);
2416                 cfg80211_cac_event(sdata->dev, &chandef,
2417                                    NL80211_RADAR_CAC_FINISHED,
2418                                    GFP_KERNEL);
2419         }
2420         mutex_unlock(&sdata->local->mtx);
2421 }
2422
2423 static bool
2424 __ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2425 {
2426         struct ieee80211_local *local = sdata->local;
2427         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2428         bool ret = false;
2429         int ac;
2430
2431         if (local->hw.queues < IEEE80211_NUM_ACS)
2432                 return false;
2433
2434         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2435                 struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
2436                 int non_acm_ac;
2437                 unsigned long now = jiffies;
2438
2439                 if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
2440                     tx_tspec->admitted_time &&
2441                     time_after(now, tx_tspec->time_slice_start + HZ)) {
2442                         tx_tspec->consumed_tx_time = 0;
2443                         tx_tspec->time_slice_start = now;
2444
2445                         if (tx_tspec->downgraded)
2446                                 tx_tspec->action =
2447                                         TX_TSPEC_ACTION_STOP_DOWNGRADE;
2448                 }
2449
2450                 switch (tx_tspec->action) {
2451                 case TX_TSPEC_ACTION_STOP_DOWNGRADE:
2452                         /* take the original parameters */
2453                         if (drv_conf_tx(local, &sdata->deflink, ac,
2454                                         &sdata->deflink.tx_conf[ac]))
2455                                 link_err(&sdata->deflink,
2456                                          "failed to set TX queue parameters for queue %d\n",
2457                                          ac);
2458                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
2459                         tx_tspec->downgraded = false;
2460                         ret = true;
2461                         break;
2462                 case TX_TSPEC_ACTION_DOWNGRADE:
2463                         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
2464                                 tx_tspec->action = TX_TSPEC_ACTION_NONE;
2465                                 ret = true;
2466                                 break;
2467                         }
2468                         /* downgrade next lower non-ACM AC */
2469                         for (non_acm_ac = ac + 1;
2470                              non_acm_ac < IEEE80211_NUM_ACS;
2471                              non_acm_ac++)
2472                                 if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
2473                                         break;
2474                         /* Usually the loop will result in using BK even if it
2475                          * requires admission control, but such a configuration
2476                          * makes no sense and we have to transmit somehow - the
2477                          * AC selection does the same thing.
2478                          * If we started out trying to downgrade from BK, then
2479                          * the extra condition here might be needed.
2480                          */
2481                         if (non_acm_ac >= IEEE80211_NUM_ACS)
2482                                 non_acm_ac = IEEE80211_AC_BK;
2483                         if (drv_conf_tx(local, &sdata->deflink, ac,
2484                                         &sdata->deflink.tx_conf[non_acm_ac]))
2485                                 link_err(&sdata->deflink,
2486                                          "failed to set TX queue parameters for queue %d\n",
2487                                          ac);
2488                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
2489                         ret = true;
2490                         schedule_delayed_work(&ifmgd->tx_tspec_wk,
2491                                 tx_tspec->time_slice_start + HZ - now + 1);
2492                         break;
2493                 case TX_TSPEC_ACTION_NONE:
2494                         /* nothing now */
2495                         break;
2496                 }
2497         }
2498
2499         return ret;
2500 }
2501
2502 void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2503 {
2504         if (__ieee80211_sta_handle_tspec_ac_params(sdata))
2505                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
2506                                                   BSS_CHANGED_QOS);
2507 }
2508
2509 static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
2510 {
2511         struct ieee80211_sub_if_data *sdata;
2512
2513         sdata = container_of(work, struct ieee80211_sub_if_data,
2514                              u.mgd.tx_tspec_wk.work);
2515         ieee80211_sta_handle_tspec_ac_params(sdata);
2516 }
2517
2518 void ieee80211_mgd_set_link_qos_params(struct ieee80211_link_data *link)
2519 {
2520         struct ieee80211_sub_if_data *sdata = link->sdata;
2521         struct ieee80211_local *local = sdata->local;
2522         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2523         struct ieee80211_tx_queue_params *params = link->tx_conf;
2524         u8 ac;
2525
2526         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2527                 mlme_dbg(sdata,
2528                          "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
2529                          ac, params[ac].acm,
2530                          params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
2531                          params[ac].txop, params[ac].uapsd,
2532                          ifmgd->tx_tspec[ac].downgraded);
2533                 if (!ifmgd->tx_tspec[ac].downgraded &&
2534                     drv_conf_tx(local, link, ac, &params[ac]))
2535                         link_err(link,
2536                                  "failed to set TX queue parameters for AC %d\n",
2537                                  ac);
2538         }
2539 }
2540
2541 /* MLME */
2542 static bool
2543 ieee80211_sta_wmm_params(struct ieee80211_local *local,
2544                          struct ieee80211_link_data *link,
2545                          const u8 *wmm_param, size_t wmm_param_len,
2546                          const struct ieee80211_mu_edca_param_set *mu_edca)
2547 {
2548         struct ieee80211_sub_if_data *sdata = link->sdata;
2549         struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
2550         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2551         size_t left;
2552         int count, mu_edca_count, ac;
2553         const u8 *pos;
2554         u8 uapsd_queues = 0;
2555
2556         if (!local->ops->conf_tx)
2557                 return false;
2558
2559         if (local->hw.queues < IEEE80211_NUM_ACS)
2560                 return false;
2561
2562         if (!wmm_param)
2563                 return false;
2564
2565         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
2566                 return false;
2567
2568         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
2569                 uapsd_queues = ifmgd->uapsd_queues;
2570
2571         count = wmm_param[6] & 0x0f;
2572         /* -1 is the initial value of ifmgd->mu_edca_last_param_set.
2573          * if mu_edca was preset before and now it disappeared tell
2574          * the driver about it.
2575          */
2576         mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
2577         if (count == link->u.mgd.wmm_last_param_set &&
2578             mu_edca_count == link->u.mgd.mu_edca_last_param_set)
2579                 return false;
2580         link->u.mgd.wmm_last_param_set = count;
2581         link->u.mgd.mu_edca_last_param_set = mu_edca_count;
2582
2583         pos = wmm_param + 8;
2584         left = wmm_param_len - 8;
2585
2586         memset(&params, 0, sizeof(params));
2587
2588         sdata->wmm_acm = 0;
2589         for (; left >= 4; left -= 4, pos += 4) {
2590                 int aci = (pos[0] >> 5) & 0x03;
2591                 int acm = (pos[0] >> 4) & 0x01;
2592                 bool uapsd = false;
2593
2594                 switch (aci) {
2595                 case 1: /* AC_BK */
2596                         ac = IEEE80211_AC_BK;
2597                         if (acm)
2598                                 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
2599                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
2600                                 uapsd = true;
2601                         params[ac].mu_edca = !!mu_edca;
2602                         if (mu_edca)
2603                                 params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2604                         break;
2605                 case 2: /* AC_VI */
2606                         ac = IEEE80211_AC_VI;
2607                         if (acm)
2608                                 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
2609                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
2610                                 uapsd = true;
2611                         params[ac].mu_edca = !!mu_edca;
2612                         if (mu_edca)
2613                                 params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2614                         break;
2615                 case 3: /* AC_VO */
2616                         ac = IEEE80211_AC_VO;
2617                         if (acm)
2618                                 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
2619                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
2620                                 uapsd = true;
2621                         params[ac].mu_edca = !!mu_edca;
2622                         if (mu_edca)
2623                                 params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2624                         break;
2625                 case 0: /* AC_BE */
2626                 default:
2627                         ac = IEEE80211_AC_BE;
2628                         if (acm)
2629                                 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
2630                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
2631                                 uapsd = true;
2632                         params[ac].mu_edca = !!mu_edca;
2633                         if (mu_edca)
2634                                 params[ac].mu_edca_param_rec = mu_edca->ac_be;
2635                         break;
2636                 }
2637
2638                 params[ac].aifs = pos[0] & 0x0f;
2639
2640                 if (params[ac].aifs < 2) {
2641                         link_info(link,
2642                                   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2643                                   params[ac].aifs, aci);
2644                         params[ac].aifs = 2;
2645                 }
2646                 params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
2647                 params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
2648                 params[ac].txop = get_unaligned_le16(pos + 2);
2649                 params[ac].acm = acm;
2650                 params[ac].uapsd = uapsd;
2651
2652                 if (params[ac].cw_min == 0 ||
2653                     params[ac].cw_min > params[ac].cw_max) {
2654                         link_info(link,
2655                                   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
2656                                   params[ac].cw_min, params[ac].cw_max, aci);
2657                         return false;
2658                 }
2659                 ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2660         }
2661
2662         /* WMM specification requires all 4 ACIs. */
2663         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2664                 if (params[ac].cw_min == 0) {
2665                         link_info(link,
2666                                   "AP has invalid WMM params (missing AC %d), using defaults\n",
2667                                   ac);
2668                         return false;
2669                 }
2670         }
2671
2672         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2673                 link->tx_conf[ac] = params[ac];
2674
2675         ieee80211_mgd_set_link_qos_params(link);
2676
2677         /* enable WMM or activate new settings */
2678         link->conf->qos = true;
2679         return true;
2680 }
2681
2682 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2683 {
2684         lockdep_assert_held(&sdata->local->mtx);
2685
2686         sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2687         ieee80211_run_deferred_scan(sdata->local);
2688 }
2689
2690 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2691 {
2692         mutex_lock(&sdata->local->mtx);
2693         __ieee80211_stop_poll(sdata);
2694         mutex_unlock(&sdata->local->mtx);
2695 }
2696
2697 static u64 ieee80211_handle_bss_capability(struct ieee80211_link_data *link,
2698                                            u16 capab, bool erp_valid, u8 erp)
2699 {
2700         struct ieee80211_bss_conf *bss_conf = link->conf;
2701         struct ieee80211_supported_band *sband;
2702         u64 changed = 0;
2703         bool use_protection;
2704         bool use_short_preamble;
2705         bool use_short_slot;
2706
2707         sband = ieee80211_get_link_sband(link);
2708         if (!sband)
2709                 return changed;
2710
2711         if (erp_valid) {
2712                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
2713                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
2714         } else {
2715                 use_protection = false;
2716                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
2717         }
2718
2719         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2720         if (sband->band == NL80211_BAND_5GHZ ||
2721             sband->band == NL80211_BAND_6GHZ)
2722                 use_short_slot = true;
2723
2724         if (use_protection != bss_conf->use_cts_prot) {
2725                 bss_conf->use_cts_prot = use_protection;
2726                 changed |= BSS_CHANGED_ERP_CTS_PROT;
2727         }
2728
2729         if (use_short_preamble != bss_conf->use_short_preamble) {
2730                 bss_conf->use_short_preamble = use_short_preamble;
2731                 changed |= BSS_CHANGED_ERP_PREAMBLE;
2732         }
2733
2734         if (use_short_slot != bss_conf->use_short_slot) {
2735                 bss_conf->use_short_slot = use_short_slot;
2736                 changed |= BSS_CHANGED_ERP_SLOT;
2737         }
2738
2739         return changed;
2740 }
2741
2742 static u64 ieee80211_link_set_associated(struct ieee80211_link_data *link,
2743                                          struct cfg80211_bss *cbss)
2744 {
2745         struct ieee80211_sub_if_data *sdata = link->sdata;
2746         struct ieee80211_bss_conf *bss_conf = link->conf;
2747         struct ieee80211_bss *bss = (void *)cbss->priv;
2748         u64 changed = BSS_CHANGED_QOS;
2749
2750         /* not really used in MLO */
2751         sdata->u.mgd.beacon_timeout =
2752                 usecs_to_jiffies(ieee80211_tu_to_usec(beacon_loss_count *
2753                                                       bss_conf->beacon_int));
2754
2755         changed |= ieee80211_handle_bss_capability(link,
2756                                                    bss_conf->assoc_capability,
2757                                                    bss->has_erp_value,
2758                                                    bss->erp_value);
2759
2760         ieee80211_check_rate_mask(link);
2761
2762         link->u.mgd.bss = cbss;
2763         memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2764
2765         if (sdata->vif.p2p ||
2766             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2767                 const struct cfg80211_bss_ies *ies;
2768
2769                 rcu_read_lock();
2770                 ies = rcu_dereference(cbss->ies);
2771                 if (ies) {
2772                         int ret;
2773
2774                         ret = cfg80211_get_p2p_attr(
2775                                         ies->data, ies->len,
2776                                         IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
2777                                         (u8 *) &bss_conf->p2p_noa_attr,
2778                                         sizeof(bss_conf->p2p_noa_attr));
2779                         if (ret >= 2) {
2780                                 link->u.mgd.p2p_noa_index =
2781                                         bss_conf->p2p_noa_attr.index;
2782                                 changed |= BSS_CHANGED_P2P_PS;
2783                         }
2784                 }
2785                 rcu_read_unlock();
2786         }
2787
2788         if (link->u.mgd.have_beacon) {
2789                 bss_conf->beacon_rate = bss->beacon_rate;
2790                 changed |= BSS_CHANGED_BEACON_INFO;
2791         } else {
2792                 bss_conf->beacon_rate = NULL;
2793         }
2794
2795         /* Tell the driver to monitor connection quality (if supported) */
2796         if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2797             bss_conf->cqm_rssi_thold)
2798                 changed |= BSS_CHANGED_CQM;
2799
2800         return changed;
2801 }
2802
2803 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2804                                      struct ieee80211_mgd_assoc_data *assoc_data,
2805                                      u64 changed[IEEE80211_MLD_MAX_NUM_LINKS])
2806 {
2807         struct ieee80211_local *local = sdata->local;
2808         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
2809         u64 vif_changed = BSS_CHANGED_ASSOC;
2810         unsigned int link_id;
2811
2812         sdata->u.mgd.associated = true;
2813
2814         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
2815                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
2816                 struct ieee80211_link_data *link;
2817
2818                 if (!cbss ||
2819                     assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
2820                         continue;
2821
2822                 if (ieee80211_vif_is_mld(&sdata->vif) &&
2823                     !(ieee80211_vif_usable_links(&sdata->vif) & BIT(link_id)))
2824                         continue;
2825
2826                 link = sdata_dereference(sdata->link[link_id], sdata);
2827                 if (WARN_ON(!link))
2828                         return;
2829
2830                 changed[link_id] |= ieee80211_link_set_associated(link, cbss);
2831         }
2832
2833         /* just to be sure */
2834         ieee80211_stop_poll(sdata);
2835
2836         ieee80211_led_assoc(local, 1);
2837
2838         vif_cfg->assoc = 1;
2839
2840         /* Enable ARP filtering */
2841         if (vif_cfg->arp_addr_cnt)
2842                 vif_changed |= BSS_CHANGED_ARP_FILTER;
2843
2844         if (ieee80211_vif_is_mld(&sdata->vif)) {
2845                 for (link_id = 0;
2846                      link_id < IEEE80211_MLD_MAX_NUM_LINKS;
2847                      link_id++) {
2848                         struct ieee80211_link_data *link;
2849                         struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
2850
2851                         if (!cbss ||
2852                             !(BIT(link_id) &
2853                               ieee80211_vif_usable_links(&sdata->vif)) ||
2854                             assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
2855                                 continue;
2856
2857                         link = sdata_dereference(sdata->link[link_id], sdata);
2858                         if (WARN_ON(!link))
2859                                 return;
2860
2861                         ieee80211_link_info_change_notify(sdata, link,
2862                                                           changed[link_id]);
2863
2864                         ieee80211_recalc_smps(sdata, link);
2865                 }
2866
2867                 ieee80211_vif_cfg_change_notify(sdata, vif_changed);
2868         } else {
2869                 ieee80211_bss_info_change_notify(sdata,
2870                                                  vif_changed | changed[0]);
2871         }
2872
2873         mutex_lock(&local->iflist_mtx);
2874         ieee80211_recalc_ps(local);
2875         mutex_unlock(&local->iflist_mtx);
2876
2877         /* leave this here to not change ordering in non-MLO cases */
2878         if (!ieee80211_vif_is_mld(&sdata->vif))
2879                 ieee80211_recalc_smps(sdata, &sdata->deflink);
2880         ieee80211_recalc_ps_vif(sdata);
2881
2882         netif_carrier_on(sdata->dev);
2883 }
2884
2885 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2886                                    u16 stype, u16 reason, bool tx,
2887                                    u8 *frame_buf)
2888 {
2889         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2890         struct ieee80211_local *local = sdata->local;
2891         unsigned int link_id;
2892         u64 changed = 0;
2893         struct ieee80211_prep_tx_info info = {
2894                 .subtype = stype,
2895         };
2896
2897         sdata_assert_lock(sdata);
2898
2899         if (WARN_ON_ONCE(tx && !frame_buf))
2900                 return;
2901
2902         if (WARN_ON(!ifmgd->associated))
2903                 return;
2904
2905         ieee80211_stop_poll(sdata);
2906
2907         ifmgd->associated = false;
2908
2909         /* other links will be destroyed */
2910         sdata->deflink.u.mgd.bss = NULL;
2911
2912         netif_carrier_off(sdata->dev);
2913
2914         /*
2915          * if we want to get out of ps before disassoc (why?) we have
2916          * to do it before sending disassoc, as otherwise the null-packet
2917          * won't be valid.
2918          */
2919         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2920                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2921                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2922         }
2923         local->ps_sdata = NULL;
2924
2925         /* disable per-vif ps */
2926         ieee80211_recalc_ps_vif(sdata);
2927
2928         /* make sure ongoing transmission finishes */
2929         synchronize_net();
2930
2931         /*
2932          * drop any frame before deauth/disassoc, this can be data or
2933          * management frame. Since we are disconnecting, we should not
2934          * insist sending these frames which can take time and delay
2935          * the disconnection and possible the roaming.
2936          */
2937         if (tx)
2938                 ieee80211_flush_queues(local, sdata, true);
2939
2940         /* deauthenticate/disassociate now */
2941         if (tx || frame_buf) {
2942                 /*
2943                  * In multi channel scenarios guarantee that the virtual
2944                  * interface is granted immediate airtime to transmit the
2945                  * deauthentication frame by calling mgd_prepare_tx, if the
2946                  * driver requested so.
2947                  */
2948                 if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
2949                     !sdata->deflink.u.mgd.have_beacon) {
2950                         drv_mgd_prepare_tx(sdata->local, sdata, &info);
2951                 }
2952
2953                 ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr,
2954                                                sdata->vif.cfg.ap_addr, stype,
2955                                                reason, tx, frame_buf);
2956         }
2957
2958         /* flush out frame - make sure the deauth was actually sent */
2959         if (tx)
2960                 ieee80211_flush_queues(local, sdata, false);
2961
2962         drv_mgd_complete_tx(sdata->local, sdata, &info);
2963
2964         /* clear AP addr only after building the needed mgmt frames */
2965         eth_zero_addr(sdata->deflink.u.mgd.bssid);
2966         eth_zero_addr(sdata->vif.cfg.ap_addr);
2967
2968         sdata->vif.cfg.ssid_len = 0;
2969
2970         /* remove AP and TDLS peers */
2971         sta_info_flush(sdata);
2972
2973         /* finally reset all BSS / config parameters */
2974         if (!ieee80211_vif_is_mld(&sdata->vif))
2975                 changed |= ieee80211_reset_erp_info(sdata);
2976
2977         ieee80211_led_assoc(local, 0);
2978         changed |= BSS_CHANGED_ASSOC;
2979         sdata->vif.cfg.assoc = false;
2980
2981         sdata->deflink.u.mgd.p2p_noa_index = -1;
2982         memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
2983                sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2984
2985         /* on the next assoc, re-program HT/VHT parameters */
2986         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
2987         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2988         memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
2989         memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2990
2991         /*
2992          * reset MU-MIMO ownership and group data in default link,
2993          * if used, other links are destroyed
2994          */
2995         memset(sdata->vif.bss_conf.mu_group.membership, 0,
2996                sizeof(sdata->vif.bss_conf.mu_group.membership));
2997         memset(sdata->vif.bss_conf.mu_group.position, 0,
2998                sizeof(sdata->vif.bss_conf.mu_group.position));
2999         if (!ieee80211_vif_is_mld(&sdata->vif))
3000                 changed |= BSS_CHANGED_MU_GROUPS;
3001         sdata->vif.bss_conf.mu_mimo_owner = false;
3002
3003         sdata->deflink.ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
3004
3005         del_timer_sync(&local->dynamic_ps_timer);
3006         cancel_work_sync(&local->dynamic_ps_enable_work);
3007
3008         /* Disable ARP filtering */
3009         if (sdata->vif.cfg.arp_addr_cnt)
3010                 changed |= BSS_CHANGED_ARP_FILTER;
3011
3012         sdata->vif.bss_conf.qos = false;
3013         if (!ieee80211_vif_is_mld(&sdata->vif)) {
3014                 changed |= BSS_CHANGED_QOS;
3015                 /* The BSSID (not really interesting) and HT changed */
3016                 changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
3017                 ieee80211_bss_info_change_notify(sdata, changed);
3018         } else {
3019                 ieee80211_vif_cfg_change_notify(sdata, changed);
3020         }
3021
3022         /* disassociated - set to defaults now */
3023         ieee80211_set_wmm_default(&sdata->deflink, false, false);
3024
3025         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
3026         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
3027         del_timer_sync(&sdata->u.mgd.timer);
3028
3029         sdata->vif.bss_conf.dtim_period = 0;
3030         sdata->vif.bss_conf.beacon_rate = NULL;
3031
3032         sdata->deflink.u.mgd.have_beacon = false;
3033         sdata->deflink.u.mgd.tracking_signal_avg = false;
3034         sdata->deflink.u.mgd.disable_wmm_tracking = false;
3035
3036         ifmgd->flags = 0;
3037         sdata->deflink.u.mgd.conn_flags = 0;
3038         mutex_lock(&local->mtx);
3039
3040         for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
3041                 struct ieee80211_link_data *link;
3042
3043                 link = sdata_dereference(sdata->link[link_id], sdata);
3044                 if (!link)
3045                         continue;
3046                 ieee80211_link_release_channel(link);
3047         }
3048
3049         sdata->vif.bss_conf.csa_active = false;
3050         sdata->deflink.u.mgd.csa_waiting_bcn = false;
3051         sdata->deflink.u.mgd.csa_ignored_same_chan = false;
3052         if (sdata->deflink.csa_block_tx) {
3053                 ieee80211_wake_vif_queues(local, sdata,
3054                                           IEEE80211_QUEUE_STOP_REASON_CSA);
3055                 sdata->deflink.csa_block_tx = false;
3056         }
3057         mutex_unlock(&local->mtx);
3058
3059         /* existing TX TSPEC sessions no longer exist */
3060         memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
3061         cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
3062
3063         sdata->vif.bss_conf.pwr_reduction = 0;
3064         sdata->vif.bss_conf.tx_pwr_env_num = 0;
3065         memset(sdata->vif.bss_conf.tx_pwr_env, 0,
3066                sizeof(sdata->vif.bss_conf.tx_pwr_env));
3067
3068         ieee80211_vif_set_links(sdata, 0, 0);
3069 }
3070
3071 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
3072 {
3073         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3074         struct ieee80211_local *local = sdata->local;
3075
3076         mutex_lock(&local->mtx);
3077         if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
3078                 goto out;
3079
3080         __ieee80211_stop_poll(sdata);
3081
3082         mutex_lock(&local->iflist_mtx);
3083         ieee80211_recalc_ps(local);
3084         mutex_unlock(&local->iflist_mtx);
3085
3086         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
3087                 goto out;
3088
3089         /*
3090          * We've received a probe response, but are not sure whether
3091          * we have or will be receiving any beacons or data, so let's
3092          * schedule the timers again, just in case.
3093          */
3094         ieee80211_sta_reset_beacon_monitor(sdata);
3095
3096         mod_timer(&ifmgd->conn_mon_timer,
3097                   round_jiffies_up(jiffies +
3098                                    IEEE80211_CONNECTION_IDLE_TIME));
3099 out:
3100         mutex_unlock(&local->mtx);
3101 }
3102
3103 static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
3104                                            struct ieee80211_hdr *hdr,
3105                                            u16 tx_time)
3106 {
3107         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3108         u16 tid;
3109         int ac;
3110         struct ieee80211_sta_tx_tspec *tx_tspec;
3111         unsigned long now = jiffies;
3112
3113         if (!ieee80211_is_data_qos(hdr->frame_control))
3114                 return;
3115
3116         tid = ieee80211_get_tid(hdr);
3117         ac = ieee80211_ac_from_tid(tid);
3118         tx_tspec = &ifmgd->tx_tspec[ac];
3119
3120         if (likely(!tx_tspec->admitted_time))
3121                 return;
3122
3123         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
3124                 tx_tspec->consumed_tx_time = 0;
3125                 tx_tspec->time_slice_start = now;
3126
3127                 if (tx_tspec->downgraded) {
3128                         tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
3129                         schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
3130                 }
3131         }
3132
3133         if (tx_tspec->downgraded)
3134                 return;
3135
3136         tx_tspec->consumed_tx_time += tx_time;
3137
3138         if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
3139                 tx_tspec->downgraded = true;
3140                 tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
3141                 schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
3142         }
3143 }
3144
3145 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
3146                              struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
3147 {
3148         ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
3149
3150         if (!ieee80211_is_any_nullfunc(hdr->frame_control) ||
3151             !sdata->u.mgd.probe_send_count)
3152                 return;
3153
3154         if (ack)
3155                 sdata->u.mgd.probe_send_count = 0;
3156         else
3157                 sdata->u.mgd.nullfunc_failed = true;
3158         wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
3159 }
3160
3161 static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
3162                                           const u8 *src, const u8 *dst,
3163                                           const u8 *ssid, size_t ssid_len,
3164                                           struct ieee80211_channel *channel)
3165 {
3166         struct sk_buff *skb;
3167
3168         skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
3169                                         ssid, ssid_len, NULL, 0,
3170                                         IEEE80211_PROBE_FLAG_DIRECTED);
3171         if (skb)
3172                 ieee80211_tx_skb(sdata, skb);
3173 }
3174
3175 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
3176 {
3177         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3178         u8 *dst = sdata->vif.cfg.ap_addr;
3179         u8 unicast_limit = max(1, max_probe_tries - 3);
3180         struct sta_info *sta;
3181
3182         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
3183                 return;
3184
3185         /*
3186          * Try sending broadcast probe requests for the last three
3187          * probe requests after the first ones failed since some
3188          * buggy APs only support broadcast probe requests.
3189          */
3190         if (ifmgd->probe_send_count >= unicast_limit)
3191                 dst = NULL;
3192
3193         /*
3194          * When the hardware reports an accurate Tx ACK status, it's
3195          * better to send a nullfunc frame instead of a probe request,
3196          * as it will kick us off the AP quickly if we aren't associated
3197          * anymore. The timeout will be reset if the frame is ACKed by
3198          * the AP.
3199          */
3200         ifmgd->probe_send_count++;
3201
3202         if (dst) {
3203                 mutex_lock(&sdata->local->sta_mtx);
3204                 sta = sta_info_get(sdata, dst);
3205                 if (!WARN_ON(!sta))
3206                         ieee80211_check_fast_rx(sta);
3207                 mutex_unlock(&sdata->local->sta_mtx);
3208         }
3209
3210         if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
3211                 ifmgd->nullfunc_failed = false;
3212                 ieee80211_send_nullfunc(sdata->local, sdata, false);
3213         } else {
3214                 ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
3215                                               sdata->vif.cfg.ssid,
3216                                               sdata->vif.cfg.ssid_len,
3217                                               sdata->deflink.u.mgd.bss->channel);
3218         }
3219
3220         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
3221         run_again(sdata, ifmgd->probe_timeout);
3222 }
3223
3224 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
3225                                    bool beacon)
3226 {
3227         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3228         bool already = false;
3229
3230         if (WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif)))
3231                 return;
3232
3233         if (!ieee80211_sdata_running(sdata))
3234                 return;
3235
3236         sdata_lock(sdata);
3237
3238         if (!ifmgd->associated)
3239                 goto out;
3240
3241         mutex_lock(&sdata->local->mtx);
3242
3243         if (sdata->local->tmp_channel || sdata->local->scanning) {
3244                 mutex_unlock(&sdata->local->mtx);
3245                 goto out;
3246         }
3247
3248         if (sdata->local->suspending) {
3249                 /* reschedule after resume */
3250                 mutex_unlock(&sdata->local->mtx);
3251                 ieee80211_reset_ap_probe(sdata);
3252                 goto out;
3253         }
3254
3255         if (beacon) {
3256                 mlme_dbg_ratelimited(sdata,
3257                                      "detected beacon loss from AP (missed %d beacons) - probing\n",
3258                                      beacon_loss_count);
3259
3260                 ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
3261         }
3262
3263         /*
3264          * The driver/our work has already reported this event or the
3265          * connection monitoring has kicked in and we have already sent
3266          * a probe request. Or maybe the AP died and the driver keeps
3267          * reporting until we disassociate...
3268          *
3269          * In either case we have to ignore the current call to this
3270          * function (except for setting the correct probe reason bit)
3271          * because otherwise we would reset the timer every time and
3272          * never check whether we received a probe response!
3273          */
3274         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
3275                 already = true;
3276
3277         ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
3278
3279         mutex_unlock(&sdata->local->mtx);
3280
3281         if (already)
3282                 goto out;
3283
3284         mutex_lock(&sdata->local->iflist_mtx);
3285         ieee80211_recalc_ps(sdata->local);
3286         mutex_unlock(&sdata->local->iflist_mtx);
3287
3288         ifmgd->probe_send_count = 0;
3289         ieee80211_mgd_probe_ap_send(sdata);
3290  out:
3291         sdata_unlock(sdata);
3292 }
3293
3294 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
3295                                           struct ieee80211_vif *vif)
3296 {
3297         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3298         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3299         struct cfg80211_bss *cbss;
3300         struct sk_buff *skb;
3301         const struct element *ssid;
3302         int ssid_len;
3303
3304         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
3305                     ieee80211_vif_is_mld(&sdata->vif)))
3306                 return NULL;
3307
3308         sdata_assert_lock(sdata);
3309
3310         if (ifmgd->associated)
3311                 cbss = sdata->deflink.u.mgd.bss;
3312         else if (ifmgd->auth_data)
3313                 cbss = ifmgd->auth_data->bss;
3314         else if (ifmgd->assoc_data && ifmgd->assoc_data->link[0].bss)
3315                 cbss = ifmgd->assoc_data->link[0].bss;
3316         else
3317                 return NULL;
3318
3319         rcu_read_lock();
3320         ssid = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
3321         if (WARN_ONCE(!ssid || ssid->datalen > IEEE80211_MAX_SSID_LEN,
3322                       "invalid SSID element (len=%d)",
3323                       ssid ? ssid->datalen : -1))
3324                 ssid_len = 0;
3325         else
3326                 ssid_len = ssid->datalen;
3327
3328         skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
3329                                         (u32) -1, cbss->channel,
3330                                         ssid->data, ssid_len,
3331                                         NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
3332         rcu_read_unlock();
3333
3334         return skb;
3335 }
3336 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
3337
3338 static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
3339                                         const u8 *buf, size_t len, bool tx,
3340                                         u16 reason, bool reconnect)
3341 {
3342         struct ieee80211_event event = {
3343                 .type = MLME_EVENT,
3344                 .u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
3345                 .u.mlme.reason = reason,
3346         };
3347
3348         if (tx)
3349                 cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
3350         else
3351                 cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
3352
3353         drv_event_callback(sdata->local, sdata, &event);
3354 }
3355
3356 static void ___ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
3357 {
3358         struct ieee80211_local *local = sdata->local;
3359         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3360         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3361         bool tx;
3362
3363         if (!ifmgd->associated)
3364                 return;
3365
3366         /* in MLO assume we have a link where we can TX the frame */
3367         tx = ieee80211_vif_is_mld(&sdata->vif) ||
3368                 !sdata->deflink.csa_block_tx;
3369
3370         if (!ifmgd->driver_disconnect) {
3371                 unsigned int link_id;
3372
3373                 /*
3374                  * AP is probably out of range (or not reachable for another
3375                  * reason) so remove the bss structs for that AP. In the case
3376                  * of multi-link, it's not clear that all of them really are
3377                  * out of range, but if they weren't the driver likely would
3378                  * have switched to just have a single link active?
3379                  */
3380                 for (link_id = 0;
3381                      link_id < ARRAY_SIZE(sdata->link);
3382                      link_id++) {
3383                         struct ieee80211_link_data *link;
3384
3385                         link = sdata_dereference(sdata->link[link_id], sdata);
3386                         if (!link)
3387                                 continue;
3388                         cfg80211_unlink_bss(local->hw.wiphy, link->u.mgd.bss);
3389                         link->u.mgd.bss = NULL;
3390                 }
3391         }
3392
3393         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3394                                ifmgd->driver_disconnect ?
3395                                         WLAN_REASON_DEAUTH_LEAVING :
3396                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3397                                tx, frame_buf);
3398         mutex_lock(&local->mtx);
3399         /* the other links will be destroyed */
3400         sdata->vif.bss_conf.csa_active = false;
3401         sdata->deflink.u.mgd.csa_waiting_bcn = false;
3402         if (sdata->deflink.csa_block_tx) {
3403                 ieee80211_wake_vif_queues(local, sdata,
3404                                           IEEE80211_QUEUE_STOP_REASON_CSA);
3405                 sdata->deflink.csa_block_tx = false;
3406         }
3407         mutex_unlock(&local->mtx);
3408
3409         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
3410                                     WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3411                                     ifmgd->reconnect);
3412         ifmgd->reconnect = false;
3413 }
3414
3415 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
3416 {
3417         sdata_lock(sdata);
3418         ___ieee80211_disconnect(sdata);
3419         sdata_unlock(sdata);
3420 }
3421
3422 static void ieee80211_beacon_connection_loss_work(struct wiphy *wiphy,
3423                                                   struct wiphy_work *work)
3424 {
3425         struct ieee80211_sub_if_data *sdata =
3426                 container_of(work, struct ieee80211_sub_if_data,
3427                              u.mgd.beacon_connection_loss_work);
3428         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3429
3430         if (ifmgd->connection_loss) {
3431                 sdata_info(sdata, "Connection to AP %pM lost\n",
3432                            sdata->vif.cfg.ap_addr);
3433                 __ieee80211_disconnect(sdata);
3434                 ifmgd->connection_loss = false;
3435         } else if (ifmgd->driver_disconnect) {
3436                 sdata_info(sdata,
3437                            "Driver requested disconnection from AP %pM\n",
3438                            sdata->vif.cfg.ap_addr);
3439                 __ieee80211_disconnect(sdata);
3440                 ifmgd->driver_disconnect = false;
3441         } else {
3442                 if (ifmgd->associated)
3443                         sdata->deflink.u.mgd.beacon_loss_count++;
3444                 ieee80211_mgd_probe_ap(sdata, true);
3445         }
3446 }
3447
3448 static void ieee80211_csa_connection_drop_work(struct wiphy *wiphy,
3449                                                struct wiphy_work *work)
3450 {
3451         struct ieee80211_sub_if_data *sdata =
3452                 container_of(work, struct ieee80211_sub_if_data,
3453                              u.mgd.csa_connection_drop_work);
3454
3455         __ieee80211_disconnect(sdata);
3456 }
3457
3458 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
3459 {
3460         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3461         struct ieee80211_hw *hw = &sdata->local->hw;
3462
3463         trace_api_beacon_loss(sdata);
3464
3465         sdata->u.mgd.connection_loss = false;
3466         wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3467 }
3468 EXPORT_SYMBOL(ieee80211_beacon_loss);
3469
3470 void ieee80211_connection_loss(struct ieee80211_vif *vif)
3471 {
3472         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3473         struct ieee80211_hw *hw = &sdata->local->hw;
3474
3475         trace_api_connection_loss(sdata);
3476
3477         sdata->u.mgd.connection_loss = true;
3478         wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3479 }
3480 EXPORT_SYMBOL(ieee80211_connection_loss);
3481
3482 void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
3483 {
3484         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3485         struct ieee80211_hw *hw = &sdata->local->hw;
3486
3487         trace_api_disconnect(sdata, reconnect);
3488
3489         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
3490                 return;
3491
3492         sdata->u.mgd.driver_disconnect = true;
3493         sdata->u.mgd.reconnect = reconnect;
3494         wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3495 }
3496 EXPORT_SYMBOL(ieee80211_disconnect);
3497
3498 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
3499                                         bool assoc)
3500 {
3501         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3502
3503         sdata_assert_lock(sdata);
3504
3505         if (!assoc) {
3506                 /*
3507                  * we are not authenticated yet, the only timer that could be
3508                  * running is the timeout for the authentication response which
3509                  * which is not relevant anymore.
3510                  */
3511                 del_timer_sync(&sdata->u.mgd.timer);
3512                 sta_info_destroy_addr(sdata, auth_data->ap_addr);
3513
3514                 /* other links are destroyed */
3515                 sdata->deflink.u.mgd.conn_flags = 0;
3516                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
3517                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3518                                                   BSS_CHANGED_BSSID);
3519                 sdata->u.mgd.flags = 0;
3520
3521                 mutex_lock(&sdata->local->mtx);
3522                 ieee80211_link_release_channel(&sdata->deflink);
3523                 ieee80211_vif_set_links(sdata, 0, 0);
3524                 mutex_unlock(&sdata->local->mtx);
3525         }
3526
3527         cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
3528         kfree(auth_data);
3529         sdata->u.mgd.auth_data = NULL;
3530 }
3531
3532 enum assoc_status {
3533         ASSOC_SUCCESS,
3534         ASSOC_REJECTED,
3535         ASSOC_TIMEOUT,
3536         ASSOC_ABANDON,
3537 };
3538
3539 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
3540                                          enum assoc_status status)
3541 {
3542         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3543
3544         sdata_assert_lock(sdata);
3545
3546         if (status != ASSOC_SUCCESS) {
3547                 /*
3548                  * we are not associated yet, the only timer that could be
3549                  * running is the timeout for the association response which
3550                  * which is not relevant anymore.
3551                  */
3552                 del_timer_sync(&sdata->u.mgd.timer);
3553                 sta_info_destroy_addr(sdata, assoc_data->ap_addr);
3554
3555                 sdata->deflink.u.mgd.conn_flags = 0;
3556                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
3557                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3558                                                   BSS_CHANGED_BSSID);
3559                 sdata->u.mgd.flags = 0;
3560                 sdata->vif.bss_conf.mu_mimo_owner = false;
3561
3562                 if (status != ASSOC_REJECTED) {
3563                         struct cfg80211_assoc_failure data = {
3564                                 .timeout = status == ASSOC_TIMEOUT,
3565                         };
3566                         int i;
3567
3568                         BUILD_BUG_ON(ARRAY_SIZE(data.bss) !=
3569                                      ARRAY_SIZE(assoc_data->link));
3570
3571                         for (i = 0; i < ARRAY_SIZE(data.bss); i++)
3572                                 data.bss[i] = assoc_data->link[i].bss;
3573
3574                         if (ieee80211_vif_is_mld(&sdata->vif))
3575                                 data.ap_mld_addr = assoc_data->ap_addr;
3576
3577                         cfg80211_assoc_failure(sdata->dev, &data);
3578                 }
3579
3580                 mutex_lock(&sdata->local->mtx);
3581                 ieee80211_link_release_channel(&sdata->deflink);
3582                 ieee80211_vif_set_links(sdata, 0, 0);
3583                 mutex_unlock(&sdata->local->mtx);
3584         }
3585
3586         kfree(assoc_data);
3587         sdata->u.mgd.assoc_data = NULL;
3588 }
3589
3590 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
3591                                      struct ieee80211_mgmt *mgmt, size_t len)
3592 {
3593         struct ieee80211_local *local = sdata->local;
3594         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3595         const struct element *challenge;
3596         u8 *pos;
3597         u32 tx_flags = 0;
3598         struct ieee80211_prep_tx_info info = {
3599                 .subtype = IEEE80211_STYPE_AUTH,
3600         };
3601
3602         pos = mgmt->u.auth.variable;
3603         challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
3604                                        len - (pos - (u8 *)mgmt));
3605         if (!challenge)
3606                 return;
3607         auth_data->expected_transaction = 4;
3608         drv_mgd_prepare_tx(sdata->local, sdata, &info);
3609         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3610                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3611                            IEEE80211_TX_INTFL_MLME_CONN_TX;
3612         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
3613                             (void *)challenge,
3614                             challenge->datalen + sizeof(*challenge),
3615                             auth_data->ap_addr, auth_data->ap_addr,
3616                             auth_data->key, auth_data->key_len,
3617                             auth_data->key_idx, tx_flags);
3618 }
3619
3620 static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata)
3621 {
3622         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3623         const u8 *ap_addr = ifmgd->auth_data->ap_addr;
3624         struct sta_info *sta;
3625         bool result = true;
3626
3627         sdata_info(sdata, "authenticated\n");
3628         ifmgd->auth_data->done = true;
3629         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
3630         ifmgd->auth_data->timeout_started = true;
3631         run_again(sdata, ifmgd->auth_data->timeout);
3632
3633         /* move station state to auth */
3634         mutex_lock(&sdata->local->sta_mtx);
3635         sta = sta_info_get(sdata, ap_addr);
3636         if (!sta) {
3637                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, ap_addr);
3638                 result = false;
3639                 goto out;
3640         }
3641         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
3642                 sdata_info(sdata, "failed moving %pM to auth\n", ap_addr);
3643                 result = false;
3644                 goto out;
3645         }
3646
3647 out:
3648         mutex_unlock(&sdata->local->sta_mtx);
3649         return result;
3650 }
3651
3652 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
3653                                    struct ieee80211_mgmt *mgmt, size_t len)
3654 {
3655         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3656         u16 auth_alg, auth_transaction, status_code;
3657         struct ieee80211_event event = {
3658                 .type = MLME_EVENT,
3659                 .u.mlme.data = AUTH_EVENT,
3660         };
3661         struct ieee80211_prep_tx_info info = {
3662                 .subtype = IEEE80211_STYPE_AUTH,
3663         };
3664
3665         sdata_assert_lock(sdata);
3666
3667         if (len < 24 + 6)
3668                 return;
3669
3670         if (!ifmgd->auth_data || ifmgd->auth_data->done)
3671                 return;
3672
3673         if (!ether_addr_equal(ifmgd->auth_data->ap_addr, mgmt->bssid))
3674                 return;
3675
3676         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
3677         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
3678         status_code = le16_to_cpu(mgmt->u.auth.status_code);
3679
3680         if (auth_alg != ifmgd->auth_data->algorithm ||
3681             (auth_alg != WLAN_AUTH_SAE &&
3682              auth_transaction != ifmgd->auth_data->expected_transaction) ||
3683             (auth_alg == WLAN_AUTH_SAE &&
3684              (auth_transaction < ifmgd->auth_data->expected_transaction ||
3685               auth_transaction > 2))) {
3686                 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
3687                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
3688                            auth_transaction,
3689                            ifmgd->auth_data->expected_transaction);
3690                 goto notify_driver;
3691         }
3692
3693         if (status_code != WLAN_STATUS_SUCCESS) {
3694                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3695
3696                 if (auth_alg == WLAN_AUTH_SAE &&
3697                     (status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED ||
3698                      (auth_transaction == 1 &&
3699                       (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
3700                        status_code == WLAN_STATUS_SAE_PK)))) {
3701                         /* waiting for userspace now */
3702                         ifmgd->auth_data->waiting = true;
3703                         ifmgd->auth_data->timeout =
3704                                 jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY;
3705                         ifmgd->auth_data->timeout_started = true;
3706                         run_again(sdata, ifmgd->auth_data->timeout);
3707                         goto notify_driver;
3708                 }
3709
3710                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
3711                            mgmt->sa, status_code);
3712                 ieee80211_destroy_auth_data(sdata, false);
3713                 event.u.mlme.status = MLME_DENIED;
3714                 event.u.mlme.reason = status_code;
3715                 drv_event_callback(sdata->local, sdata, &event);
3716                 goto notify_driver;
3717         }
3718
3719         switch (ifmgd->auth_data->algorithm) {
3720         case WLAN_AUTH_OPEN:
3721         case WLAN_AUTH_LEAP:
3722         case WLAN_AUTH_FT:
3723         case WLAN_AUTH_SAE:
3724         case WLAN_AUTH_FILS_SK:
3725         case WLAN_AUTH_FILS_SK_PFS:
3726         case WLAN_AUTH_FILS_PK:
3727                 break;
3728         case WLAN_AUTH_SHARED_KEY:
3729                 if (ifmgd->auth_data->expected_transaction != 4) {
3730                         ieee80211_auth_challenge(sdata, mgmt, len);
3731                         /* need another frame */
3732                         return;
3733                 }
3734                 break;
3735         default:
3736                 WARN_ONCE(1, "invalid auth alg %d",
3737                           ifmgd->auth_data->algorithm);
3738                 goto notify_driver;
3739         }
3740
3741         event.u.mlme.status = MLME_SUCCESS;
3742         info.success = 1;
3743         drv_event_callback(sdata->local, sdata, &event);
3744         if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
3745             (auth_transaction == 2 &&
3746              ifmgd->auth_data->expected_transaction == 2)) {
3747                 if (!ieee80211_mark_sta_auth(sdata))
3748                         return; /* ignore frame -- wait for timeout */
3749         } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
3750                    auth_transaction == 2) {
3751                 sdata_info(sdata, "SAE peer confirmed\n");
3752                 ifmgd->auth_data->peer_confirmed = true;
3753         }
3754
3755         cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3756 notify_driver:
3757         drv_mgd_complete_tx(sdata->local, sdata, &info);
3758 }
3759
3760 #define case_WLAN(type) \
3761         case WLAN_REASON_##type: return #type
3762
3763 const char *ieee80211_get_reason_code_string(u16 reason_code)
3764 {
3765         switch (reason_code) {
3766         case_WLAN(UNSPECIFIED);
3767         case_WLAN(PREV_AUTH_NOT_VALID);
3768         case_WLAN(DEAUTH_LEAVING);
3769         case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
3770         case_WLAN(DISASSOC_AP_BUSY);
3771         case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
3772         case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
3773         case_WLAN(DISASSOC_STA_HAS_LEFT);
3774         case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
3775         case_WLAN(DISASSOC_BAD_POWER);
3776         case_WLAN(DISASSOC_BAD_SUPP_CHAN);
3777         case_WLAN(INVALID_IE);
3778         case_WLAN(MIC_FAILURE);
3779         case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
3780         case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
3781         case_WLAN(IE_DIFFERENT);
3782         case_WLAN(INVALID_GROUP_CIPHER);
3783         case_WLAN(INVALID_PAIRWISE_CIPHER);
3784         case_WLAN(INVALID_AKMP);
3785         case_WLAN(UNSUPP_RSN_VERSION);
3786         case_WLAN(INVALID_RSN_IE_CAP);
3787         case_WLAN(IEEE8021X_FAILED);
3788         case_WLAN(CIPHER_SUITE_REJECTED);
3789         case_WLAN(DISASSOC_UNSPECIFIED_QOS);
3790         case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
3791         case_WLAN(DISASSOC_LOW_ACK);
3792         case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
3793         case_WLAN(QSTA_LEAVE_QBSS);
3794         case_WLAN(QSTA_NOT_USE);
3795         case_WLAN(QSTA_REQUIRE_SETUP);
3796         case_WLAN(QSTA_TIMEOUT);
3797         case_WLAN(QSTA_CIPHER_NOT_SUPP);
3798         case_WLAN(MESH_PEER_CANCELED);
3799         case_WLAN(MESH_MAX_PEERS);
3800         case_WLAN(MESH_CONFIG);
3801         case_WLAN(MESH_CLOSE);
3802         case_WLAN(MESH_MAX_RETRIES);
3803         case_WLAN(MESH_CONFIRM_TIMEOUT);
3804         case_WLAN(MESH_INVALID_GTK);
3805         case_WLAN(MESH_INCONSISTENT_PARAM);
3806         case_WLAN(MESH_INVALID_SECURITY);
3807         case_WLAN(MESH_PATH_ERROR);
3808         case_WLAN(MESH_PATH_NOFORWARD);
3809         case_WLAN(MESH_PATH_DEST_UNREACHABLE);
3810         case_WLAN(MAC_EXISTS_IN_MBSS);
3811         case_WLAN(MESH_CHAN_REGULATORY);
3812         case_WLAN(MESH_CHAN);
3813         default: return "<unknown>";
3814         }
3815 }
3816
3817 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
3818                                      struct ieee80211_mgmt *mgmt, size_t len)
3819 {
3820         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3821         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3822
3823         sdata_assert_lock(sdata);
3824
3825         if (len < 24 + 2)
3826                 return;
3827
3828         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3829                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3830                 return;
3831         }
3832
3833         if (ifmgd->associated &&
3834             ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {
3835                 sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
3836                            sdata->vif.cfg.ap_addr, reason_code,
3837                            ieee80211_get_reason_code_string(reason_code));
3838
3839                 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3840
3841                 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
3842                                             reason_code, false);
3843                 return;
3844         }
3845
3846         if (ifmgd->assoc_data &&
3847             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->ap_addr)) {
3848                 sdata_info(sdata,
3849                            "deauthenticated from %pM while associating (Reason: %u=%s)\n",
3850                            ifmgd->assoc_data->ap_addr, reason_code,
3851                            ieee80211_get_reason_code_string(reason_code));
3852
3853                 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
3854
3855                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3856                 return;
3857         }
3858 }
3859
3860
3861 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
3862                                        struct ieee80211_mgmt *mgmt, size_t len)
3863 {
3864         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3865         u16 reason_code;
3866
3867         sdata_assert_lock(sdata);
3868
3869         if (len < 24 + 2)
3870                 return;
3871
3872         if (!ifmgd->associated ||
3873             !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
3874                 return;
3875
3876         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
3877
3878         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3879                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3880                 return;
3881         }
3882
3883         sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
3884                    sdata->vif.cfg.ap_addr, reason_code,
3885                    ieee80211_get_reason_code_string(reason_code));
3886
3887         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3888
3889         ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
3890                                     false);
3891 }
3892
3893 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
3894                                 u8 *supp_rates, unsigned int supp_rates_len,
3895                                 u32 *rates, u32 *basic_rates,
3896                                 bool *have_higher_than_11mbit,
3897                                 int *min_rate, int *min_rate_index,
3898                                 int shift)
3899 {
3900         int i, j;
3901
3902         for (i = 0; i < supp_rates_len; i++) {
3903                 int rate = supp_rates[i] & 0x7f;
3904                 bool is_basic = !!(supp_rates[i] & 0x80);
3905
3906                 if ((rate * 5 * (1 << shift)) > 110)
3907                         *have_higher_than_11mbit = true;
3908
3909                 /*
3910                  * Skip HT, VHT, HE, EHT and SAE H2E only BSS membership
3911                  * selectors since they're not rates.
3912                  *
3913                  * Note: Even though the membership selector and the basic
3914                  *       rate flag share the same bit, they are not exactly
3915                  *       the same.
3916                  */
3917                 if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3918                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
3919                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY) ||
3920                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_EHT_PHY) ||
3921                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E))
3922                         continue;
3923
3924                 for (j = 0; j < sband->n_bitrates; j++) {
3925                         struct ieee80211_rate *br;
3926                         int brate;
3927
3928                         br = &sband->bitrates[j];
3929
3930                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
3931                         if (brate == rate) {
3932                                 *rates |= BIT(j);
3933                                 if (is_basic)
3934                                         *basic_rates |= BIT(j);
3935                                 if ((rate * 5) < *min_rate) {
3936                                         *min_rate = rate * 5;
3937                                         *min_rate_index = j;
3938                                 }
3939                                 break;
3940                         }
3941                 }
3942         }
3943 }
3944
3945 static bool ieee80211_twt_req_supported(struct ieee80211_sub_if_data *sdata,
3946                                         struct ieee80211_supported_band *sband,
3947                                         const struct link_sta_info *link_sta,
3948                                         const struct ieee802_11_elems *elems)
3949 {
3950         const struct ieee80211_sta_he_cap *own_he_cap =
3951                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
3952
3953         if (elems->ext_capab_len < 10)
3954                 return false;
3955
3956         if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
3957                 return false;
3958
3959         return link_sta->pub->he_cap.he_cap_elem.mac_cap_info[0] &
3960                 IEEE80211_HE_MAC_CAP0_TWT_RES &&
3961                 own_he_cap &&
3962                 (own_he_cap->he_cap_elem.mac_cap_info[0] &
3963                         IEEE80211_HE_MAC_CAP0_TWT_REQ);
3964 }
3965
3966 static u64 ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
3967                                     struct ieee80211_supported_band *sband,
3968                                     struct ieee80211_link_data *link,
3969                                     struct link_sta_info *link_sta,
3970                                     struct ieee802_11_elems *elems)
3971 {
3972         bool twt = ieee80211_twt_req_supported(sdata, sband, link_sta, elems);
3973
3974         if (link->conf->twt_requester != twt) {
3975                 link->conf->twt_requester = twt;
3976                 return BSS_CHANGED_TWT;
3977         }
3978         return 0;
3979 }
3980
3981 static bool ieee80211_twt_bcast_support(struct ieee80211_sub_if_data *sdata,
3982                                         struct ieee80211_bss_conf *bss_conf,
3983                                         struct ieee80211_supported_band *sband,
3984                                         struct link_sta_info *link_sta)
3985 {
3986         const struct ieee80211_sta_he_cap *own_he_cap =
3987                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
3988
3989         return bss_conf->he_support &&
3990                 (link_sta->pub->he_cap.he_cap_elem.mac_cap_info[2] &
3991                         IEEE80211_HE_MAC_CAP2_BCAST_TWT) &&
3992                 own_he_cap &&
3993                 (own_he_cap->he_cap_elem.mac_cap_info[2] &
3994                         IEEE80211_HE_MAC_CAP2_BCAST_TWT);
3995 }
3996
3997 static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
3998                                         struct link_sta_info *link_sta,
3999                                         struct cfg80211_bss *cbss,
4000                                         struct ieee80211_mgmt *mgmt,
4001                                         const u8 *elem_start,
4002                                         unsigned int elem_len,
4003                                         u64 *changed)
4004 {
4005         struct ieee80211_sub_if_data *sdata = link->sdata;
4006         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
4007         struct ieee80211_bss_conf *bss_conf = link->conf;
4008         struct ieee80211_local *local = sdata->local;
4009         unsigned int link_id = link->link_id;
4010         struct ieee80211_elems_parse_params parse_params = {
4011                 .start = elem_start,
4012                 .len = elem_len,
4013                 .link_id = link_id == assoc_data->assoc_link_id ? -1 : link_id,
4014                 .from_ap = true,
4015         };
4016         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4017         bool is_s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
4018         const struct cfg80211_bss_ies *bss_ies = NULL;
4019         struct ieee80211_supported_band *sband;
4020         struct ieee802_11_elems *elems;
4021         const __le16 prof_bss_param_ch_present =
4022                 cpu_to_le16(IEEE80211_MLE_STA_CONTROL_BSS_PARAM_CHANGE_CNT_PRESENT);
4023         u16 capab_info;
4024         bool ret;
4025
4026         elems = ieee802_11_parse_elems_full(&parse_params);
4027         if (!elems)
4028                 return false;
4029
4030         if (link_id == assoc_data->assoc_link_id) {
4031                 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
4032
4033                 /*
4034                  * we should not get to this flow unless the association was
4035                  * successful, so set the status directly to success
4036                  */
4037                 assoc_data->link[link_id].status = WLAN_STATUS_SUCCESS;
4038                 if (elems->ml_basic) {
4039                         if (!(elems->ml_basic->control &
4040                                         cpu_to_le16(IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT))) {
4041                                 ret = false;
4042                                 goto out;
4043                         }
4044                         link->u.mgd.bss_param_ch_cnt =
4045                                 ieee80211_mle_get_bss_param_ch_cnt(elems->ml_basic);
4046                 }
4047         } else if (!elems->prof ||
4048                    !(elems->prof->control & prof_bss_param_ch_present)) {
4049                 ret = false;
4050                 goto out;
4051         } else {
4052                 const u8 *ptr = elems->prof->variable +
4053                                 elems->prof->sta_info_len - 1;
4054
4055                 /*
4056                  * During parsing, we validated that these fields exist,
4057                  * otherwise elems->prof would have been set to NULL.
4058                  */
4059                 capab_info = get_unaligned_le16(ptr);
4060                 assoc_data->link[link_id].status = get_unaligned_le16(ptr + 2);
4061                 link->u.mgd.bss_param_ch_cnt =
4062                         ieee80211_mle_basic_sta_prof_bss_param_ch_cnt(elems->prof);
4063
4064                 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
4065                         link_info(link, "association response status code=%u\n",
4066                                   assoc_data->link[link_id].status);
4067                         ret = true;
4068                         goto out;
4069                 }
4070         }
4071
4072         if (!is_s1g && !elems->supp_rates) {
4073                 sdata_info(sdata, "no SuppRates element in AssocResp\n");
4074                 ret = false;
4075                 goto out;
4076         }
4077
4078         link->u.mgd.tdls_chan_switch_prohibited =
4079                 elems->ext_capab && elems->ext_capab_len >= 5 &&
4080                 (elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
4081
4082         /*
4083          * Some APs are erroneously not including some information in their
4084          * (re)association response frames. Try to recover by using the data
4085          * from the beacon or probe response. This seems to afflict mobile
4086          * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
4087          * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
4088          */
4089         if (!is_6ghz &&
4090             ((assoc_data->wmm && !elems->wmm_param) ||
4091              (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
4092               (!elems->ht_cap_elem || !elems->ht_operation)) ||
4093              (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
4094               (!elems->vht_cap_elem || !elems->vht_operation)))) {
4095                 const struct cfg80211_bss_ies *ies;
4096                 struct ieee802_11_elems *bss_elems;
4097
4098                 rcu_read_lock();
4099                 ies = rcu_dereference(cbss->ies);
4100                 if (ies)
4101                         bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
4102                                           GFP_ATOMIC);
4103                 rcu_read_unlock();
4104                 if (!bss_ies) {
4105                         ret = false;
4106                         goto out;
4107                 }
4108
4109                 parse_params.start = bss_ies->data;
4110                 parse_params.len = bss_ies->len;
4111                 parse_params.bss = cbss;
4112                 bss_elems = ieee802_11_parse_elems_full(&parse_params);
4113                 if (!bss_elems) {
4114                         ret = false;
4115                         goto out;
4116                 }
4117
4118                 if (assoc_data->wmm &&
4119                     !elems->wmm_param && bss_elems->wmm_param) {
4120                         elems->wmm_param = bss_elems->wmm_param;
4121                         sdata_info(sdata,
4122                                    "AP bug: WMM param missing from AssocResp\n");
4123                 }
4124
4125                 /*
4126                  * Also check if we requested HT/VHT, otherwise the AP doesn't
4127                  * have to include the IEs in the (re)association response.
4128                  */
4129                 if (!elems->ht_cap_elem && bss_elems->ht_cap_elem &&
4130                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
4131                         elems->ht_cap_elem = bss_elems->ht_cap_elem;
4132                         sdata_info(sdata,
4133                                    "AP bug: HT capability missing from AssocResp\n");
4134                 }
4135                 if (!elems->ht_operation && bss_elems->ht_operation &&
4136                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
4137                         elems->ht_operation = bss_elems->ht_operation;
4138                         sdata_info(sdata,
4139                                    "AP bug: HT operation missing from AssocResp\n");
4140                 }
4141                 if (!elems->vht_cap_elem && bss_elems->vht_cap_elem &&
4142                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4143                         elems->vht_cap_elem = bss_elems->vht_cap_elem;
4144                         sdata_info(sdata,
4145                                    "AP bug: VHT capa missing from AssocResp\n");
4146                 }
4147                 if (!elems->vht_operation && bss_elems->vht_operation &&
4148                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4149                         elems->vht_operation = bss_elems->vht_operation;
4150                         sdata_info(sdata,
4151                                    "AP bug: VHT operation missing from AssocResp\n");
4152                 }
4153
4154                 kfree(bss_elems);
4155         }
4156
4157         /*
4158          * We previously checked these in the beacon/probe response, so
4159          * they should be present here. This is just a safety net.
4160          */
4161         if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
4162             (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
4163                 sdata_info(sdata,
4164                            "HT AP is missing WMM params or HT capability/operation\n");
4165                 ret = false;
4166                 goto out;
4167         }
4168
4169         if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
4170             (!elems->vht_cap_elem || !elems->vht_operation)) {
4171                 sdata_info(sdata,
4172                            "VHT AP is missing VHT capability/operation\n");
4173                 ret = false;
4174                 goto out;
4175         }
4176
4177         if (is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4178             !elems->he_6ghz_capa) {
4179                 sdata_info(sdata,
4180                            "HE 6 GHz AP is missing HE 6 GHz band capability\n");
4181                 ret = false;
4182                 goto out;
4183         }
4184
4185         if (WARN_ON(!link->conf->chandef.chan)) {
4186                 ret = false;
4187                 goto out;
4188         }
4189         sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
4190
4191         if (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4192             (!elems->he_cap || !elems->he_operation)) {
4193                 sdata_info(sdata,
4194                            "HE AP is missing HE capability/operation\n");
4195                 ret = false;
4196                 goto out;
4197         }
4198
4199         /* Set up internal HT/VHT capabilities */
4200         if (elems->ht_cap_elem && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT))
4201                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
4202                                                   elems->ht_cap_elem,
4203                                                   link_sta);
4204
4205         if (elems->vht_cap_elem && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT))
4206                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
4207                                                     elems->vht_cap_elem,
4208                                                     link_sta);
4209
4210         if (elems->he_operation && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4211             elems->he_cap) {
4212                 ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
4213                                                   elems->he_cap,
4214                                                   elems->he_cap_len,
4215                                                   elems->he_6ghz_capa,
4216                                                   link_sta);
4217
4218                 bss_conf->he_support = link_sta->pub->he_cap.has_he;
4219                 if (elems->rsnx && elems->rsnx_len &&
4220                     (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
4221                     wiphy_ext_feature_isset(local->hw.wiphy,
4222                                             NL80211_EXT_FEATURE_PROTECTED_TWT))
4223                         bss_conf->twt_protected = true;
4224                 else
4225                         bss_conf->twt_protected = false;
4226
4227                 *changed |= ieee80211_recalc_twt_req(sdata, sband, link,
4228                                                      link_sta, elems);
4229
4230                 if (elems->eht_operation && elems->eht_cap &&
4231                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
4232                         ieee80211_eht_cap_ie_to_sta_eht_cap(sdata, sband,
4233                                                             elems->he_cap,
4234                                                             elems->he_cap_len,
4235                                                             elems->eht_cap,
4236                                                             elems->eht_cap_len,
4237                                                             link_sta);
4238
4239                         bss_conf->eht_support = link_sta->pub->eht_cap.has_eht;
4240                         *changed |= BSS_CHANGED_EHT_PUNCTURING;
4241                 } else {
4242                         bss_conf->eht_support = false;
4243                 }
4244         } else {
4245                 bss_conf->he_support = false;
4246                 bss_conf->twt_requester = false;
4247                 bss_conf->twt_protected = false;
4248                 bss_conf->eht_support = false;
4249         }
4250
4251         bss_conf->twt_broadcast =
4252                 ieee80211_twt_bcast_support(sdata, bss_conf, sband, link_sta);
4253
4254         if (bss_conf->he_support) {
4255                 bss_conf->he_bss_color.color =
4256                         le32_get_bits(elems->he_operation->he_oper_params,
4257                                       IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
4258                 bss_conf->he_bss_color.partial =
4259                         le32_get_bits(elems->he_operation->he_oper_params,
4260                                       IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
4261                 bss_conf->he_bss_color.enabled =
4262                         !le32_get_bits(elems->he_operation->he_oper_params,
4263                                        IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
4264
4265                 if (bss_conf->he_bss_color.enabled)
4266                         *changed |= BSS_CHANGED_HE_BSS_COLOR;
4267
4268                 bss_conf->htc_trig_based_pkt_ext =
4269                         le32_get_bits(elems->he_operation->he_oper_params,
4270                                       IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
4271                 bss_conf->frame_time_rts_th =
4272                         le32_get_bits(elems->he_operation->he_oper_params,
4273                                       IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
4274
4275                 bss_conf->uora_exists = !!elems->uora_element;
4276                 if (elems->uora_element)
4277                         bss_conf->uora_ocw_range = elems->uora_element[0];
4278
4279                 ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
4280                 ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
4281                 /* TODO: OPEN: what happens if BSS color disable is set? */
4282         }
4283
4284         if (cbss->transmitted_bss) {
4285                 bss_conf->nontransmitted = true;
4286                 ether_addr_copy(bss_conf->transmitter_bssid,
4287                                 cbss->transmitted_bss->bssid);
4288                 bss_conf->bssid_indicator = cbss->max_bssid_indicator;
4289                 bss_conf->bssid_index = cbss->bssid_index;
4290         }
4291
4292         /*
4293          * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
4294          * in their association response, so ignore that data for our own
4295          * configuration. If it changed since the last beacon, we'll get the
4296          * next beacon and update then.
4297          */
4298
4299         /*
4300          * If an operating mode notification IE is present, override the
4301          * NSS calculation (that would be done in rate_control_rate_init())
4302          * and use the # of streams from that element.
4303          */
4304         if (elems->opmode_notif &&
4305             !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
4306                 u8 nss;
4307
4308                 nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
4309                 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
4310                 nss += 1;
4311                 link_sta->pub->rx_nss = nss;
4312         }
4313
4314         /*
4315          * Always handle WMM once after association regardless
4316          * of the first value the AP uses. Setting -1 here has
4317          * that effect because the AP values is an unsigned
4318          * 4-bit value.
4319          */
4320         link->u.mgd.wmm_last_param_set = -1;
4321         link->u.mgd.mu_edca_last_param_set = -1;
4322
4323         if (link->u.mgd.disable_wmm_tracking) {
4324                 ieee80211_set_wmm_default(link, false, false);
4325         } else if (!ieee80211_sta_wmm_params(local, link, elems->wmm_param,
4326                                              elems->wmm_param_len,
4327                                              elems->mu_edca_param_set)) {
4328                 /* still enable QoS since we might have HT/VHT */
4329                 ieee80211_set_wmm_default(link, false, true);
4330                 /* disable WMM tracking in this case to disable
4331                  * tracking WMM parameter changes in the beacon if
4332                  * the parameters weren't actually valid. Doing so
4333                  * avoids changing parameters very strangely when
4334                  * the AP is going back and forth between valid and
4335                  * invalid parameters.
4336                  */
4337                 link->u.mgd.disable_wmm_tracking = true;
4338         }
4339
4340         if (elems->max_idle_period_ie) {
4341                 bss_conf->max_idle_period =
4342                         le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
4343                 bss_conf->protected_keep_alive =
4344                         !!(elems->max_idle_period_ie->idle_options &
4345                            WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
4346                 *changed |= BSS_CHANGED_KEEP_ALIVE;
4347         } else {
4348                 bss_conf->max_idle_period = 0;
4349                 bss_conf->protected_keep_alive = false;
4350         }
4351
4352         /* set assoc capability (AID was already set earlier),
4353          * ieee80211_set_associated() will tell the driver */
4354         bss_conf->assoc_capability = capab_info;
4355
4356         ret = true;
4357 out:
4358         kfree(elems);
4359         kfree(bss_ies);
4360         return ret;
4361 }
4362
4363 static int ieee80211_mgd_setup_link_sta(struct ieee80211_link_data *link,
4364                                         struct sta_info *sta,
4365                                         struct link_sta_info *link_sta,
4366                                         struct cfg80211_bss *cbss)
4367 {
4368         struct ieee80211_sub_if_data *sdata = link->sdata;
4369         struct ieee80211_local *local = sdata->local;
4370         struct ieee80211_bss *bss = (void *)cbss->priv;
4371         u32 rates = 0, basic_rates = 0;
4372         bool have_higher_than_11mbit = false;
4373         int min_rate = INT_MAX, min_rate_index = -1;
4374         /* this is clearly wrong for MLO but we'll just remove it later */
4375         int shift = ieee80211_vif_get_shift(&sdata->vif);
4376         struct ieee80211_supported_band *sband;
4377
4378         memcpy(link_sta->addr, cbss->bssid, ETH_ALEN);
4379         memcpy(link_sta->pub->addr, cbss->bssid, ETH_ALEN);
4380
4381         /* TODO: S1G Basic Rate Set is expressed elsewhere */
4382         if (cbss->channel->band == NL80211_BAND_S1GHZ) {
4383                 ieee80211_s1g_sta_rate_init(sta);
4384                 return 0;
4385         }
4386
4387         sband = local->hw.wiphy->bands[cbss->channel->band];
4388
4389         ieee80211_get_rates(sband, bss->supp_rates, bss->supp_rates_len,
4390                             &rates, &basic_rates, &have_higher_than_11mbit,
4391                             &min_rate, &min_rate_index, shift);
4392
4393         /*
4394          * This used to be a workaround for basic rates missing
4395          * in the association response frame. Now that we no
4396          * longer use the basic rates from there, it probably
4397          * doesn't happen any more, but keep the workaround so
4398          * in case some *other* APs are buggy in different ways
4399          * we can connect -- with a warning.
4400          * Allow this workaround only in case the AP provided at least
4401          * one rate.
4402          */
4403         if (min_rate_index < 0) {
4404                 link_info(link, "No legacy rates in association response\n");
4405                 return -EINVAL;
4406         } else if (!basic_rates) {
4407                 link_info(link, "No basic rates, using min rate instead\n");
4408                 basic_rates = BIT(min_rate_index);
4409         }
4410
4411         if (rates)
4412                 link_sta->pub->supp_rates[cbss->channel->band] = rates;
4413         else
4414                 link_info(link, "No rates found, keeping mandatory only\n");
4415
4416         link->conf->basic_rates = basic_rates;
4417
4418         /* cf. IEEE 802.11 9.2.12 */
4419         link->operating_11g_mode = sband->band == NL80211_BAND_2GHZ &&
4420                                    have_higher_than_11mbit;
4421
4422         return 0;
4423 }
4424
4425 static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
4426                                   struct cfg80211_bss *cbss)
4427 {
4428         struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
4429         const struct element *ht_cap_elem, *vht_cap_elem;
4430         const struct cfg80211_bss_ies *ies;
4431         const struct ieee80211_ht_cap *ht_cap;
4432         const struct ieee80211_vht_cap *vht_cap;
4433         const struct ieee80211_he_cap_elem *he_cap;
4434         const struct element *he_cap_elem;
4435         u16 mcs_80_map, mcs_160_map;
4436         int i, mcs_nss_size;
4437         bool support_160;
4438         u8 chains = 1;
4439
4440         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)
4441                 return chains;
4442
4443         ht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_CAPABILITY);
4444         if (ht_cap_elem && ht_cap_elem->datalen >= sizeof(*ht_cap)) {
4445                 ht_cap = (void *)ht_cap_elem->data;
4446                 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
4447                 /*
4448                  * TODO: use "Tx Maximum Number Spatial Streams Supported" and
4449                  *       "Tx Unequal Modulation Supported" fields.
4450                  */
4451         }
4452
4453         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
4454                 return chains;
4455
4456         vht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
4457         if (vht_cap_elem && vht_cap_elem->datalen >= sizeof(*vht_cap)) {
4458                 u8 nss;
4459                 u16 tx_mcs_map;
4460
4461                 vht_cap = (void *)vht_cap_elem->data;
4462                 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
4463                 for (nss = 8; nss > 0; nss--) {
4464                         if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
4465                                         IEEE80211_VHT_MCS_NOT_SUPPORTED)
4466                                 break;
4467                 }
4468                 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
4469                 chains = max(chains, nss);
4470         }
4471
4472         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE)
4473                 return chains;
4474
4475         ies = rcu_dereference(cbss->ies);
4476         he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
4477                                              ies->data, ies->len);
4478
4479         if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
4480                 return chains;
4481
4482         /* skip one byte ext_tag_id */
4483         he_cap = (void *)(he_cap_elem->data + 1);
4484         mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
4485
4486         /* invalid HE IE */
4487         if (he_cap_elem->datalen < 1 + mcs_nss_size + sizeof(*he_cap))
4488                 return chains;
4489
4490         /* mcs_nss is right after he_cap info */
4491         he_mcs_nss_supp = (void *)(he_cap + 1);
4492
4493         mcs_80_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
4494
4495         for (i = 7; i >= 0; i--) {
4496                 u8 mcs_80 = mcs_80_map >> (2 * i) & 3;
4497
4498                 if (mcs_80 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4499                         chains = max_t(u8, chains, i + 1);
4500                         break;
4501                 }
4502         }
4503
4504         support_160 = he_cap->phy_cap_info[0] &
4505                       IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
4506
4507         if (!support_160)
4508                 return chains;
4509
4510         mcs_160_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_160);
4511         for (i = 7; i >= 0; i--) {
4512                 u8 mcs_160 = mcs_160_map >> (2 * i) & 3;
4513
4514                 if (mcs_160 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4515                         chains = max_t(u8, chains, i + 1);
4516                         break;
4517                 }
4518         }
4519
4520         return chains;
4521 }
4522
4523 static bool
4524 ieee80211_verify_peer_he_mcs_support(struct ieee80211_sub_if_data *sdata,
4525                                      const struct cfg80211_bss_ies *ies,
4526                                      const struct ieee80211_he_operation *he_op)
4527 {
4528         const struct element *he_cap_elem;
4529         const struct ieee80211_he_cap_elem *he_cap;
4530         struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
4531         u16 mcs_80_map_tx, mcs_80_map_rx;
4532         u16 ap_min_req_set;
4533         int mcs_nss_size;
4534         int nss;
4535
4536         he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
4537                                              ies->data, ies->len);
4538
4539         if (!he_cap_elem)
4540                 return false;
4541
4542         /* invalid HE IE */
4543         if (he_cap_elem->datalen < 1 + sizeof(*he_cap)) {
4544                 sdata_info(sdata,
4545                            "Invalid HE elem, Disable HE\n");
4546                 return false;
4547         }
4548
4549         /* skip one byte ext_tag_id */
4550         he_cap = (void *)(he_cap_elem->data + 1);
4551         mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
4552
4553         /* invalid HE IE */
4554         if (he_cap_elem->datalen < 1 + sizeof(*he_cap) + mcs_nss_size) {
4555                 sdata_info(sdata,
4556                            "Invalid HE elem with nss size, Disable HE\n");
4557                 return false;
4558         }
4559
4560         /* mcs_nss is right after he_cap info */
4561         he_mcs_nss_supp = (void *)(he_cap + 1);
4562
4563         mcs_80_map_tx = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
4564         mcs_80_map_rx = le16_to_cpu(he_mcs_nss_supp->rx_mcs_80);
4565
4566         /* P802.11-REVme/D0.3
4567          * 27.1.1 Introduction to the HE PHY
4568          * ...
4569          * An HE STA shall support the following features:
4570          * ...
4571          * Single spatial stream HE-MCSs 0 to 7 (transmit and receive) in all
4572          * supported channel widths for HE SU PPDUs
4573          */
4574         if ((mcs_80_map_tx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4575             (mcs_80_map_rx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED) {
4576                 sdata_info(sdata,
4577                            "Missing mandatory rates for 1 Nss, rx 0x%x, tx 0x%x, disable HE\n",
4578                            mcs_80_map_tx, mcs_80_map_rx);
4579                 return false;
4580         }
4581
4582         if (!he_op)
4583                 return true;
4584
4585         ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
4586
4587         /*
4588          * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
4589          * zeroes, which is nonsense, and completely inconsistent with itself
4590          * (it doesn't have 8 streams). Accept the settings in this case anyway.
4591          */
4592         if (!ap_min_req_set)
4593                 return true;
4594
4595         /* make sure the AP is consistent with itself
4596          *
4597          * P802.11-REVme/D0.3
4598          * 26.17.1 Basic HE BSS operation
4599          *
4600          * A STA that is operating in an HE BSS shall be able to receive and
4601          * transmit at each of the <HE-MCS, NSS> tuple values indicated by the
4602          * Basic HE-MCS And NSS Set field of the HE Operation parameter of the
4603          * MLME-START.request primitive and shall be able to receive at each of
4604          * the <HE-MCS, NSS> tuple values indicated by the Supported HE-MCS and
4605          * NSS Set field in the HE Capabilities parameter of the MLMESTART.request
4606          * primitive
4607          */
4608         for (nss = 8; nss > 0; nss--) {
4609                 u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
4610                 u8 ap_rx_val;
4611                 u8 ap_tx_val;
4612
4613                 if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
4614                         continue;
4615
4616                 ap_rx_val = (mcs_80_map_rx >> (2 * (nss - 1))) & 3;
4617                 ap_tx_val = (mcs_80_map_tx >> (2 * (nss - 1))) & 3;
4618
4619                 if (ap_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4620                     ap_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4621                     ap_rx_val < ap_op_val || ap_tx_val < ap_op_val) {
4622                         sdata_info(sdata,
4623                                    "Invalid rates for %d Nss, rx %d, tx %d oper %d, disable HE\n",
4624                                    nss, ap_rx_val, ap_rx_val, ap_op_val);
4625                         return false;
4626                 }
4627         }
4628
4629         return true;
4630 }
4631
4632 static bool
4633 ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
4634                                     struct ieee80211_supported_band *sband,
4635                                     const struct ieee80211_he_operation *he_op)
4636 {
4637         const struct ieee80211_sta_he_cap *sta_he_cap =
4638                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
4639         u16 ap_min_req_set;
4640         int i;
4641
4642         if (!sta_he_cap || !he_op)
4643                 return false;
4644
4645         ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
4646
4647         /*
4648          * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
4649          * zeroes, which is nonsense, and completely inconsistent with itself
4650          * (it doesn't have 8 streams). Accept the settings in this case anyway.
4651          */
4652         if (!ap_min_req_set)
4653                 return true;
4654
4655         /* Need to go over for 80MHz, 160MHz and for 80+80 */
4656         for (i = 0; i < 3; i++) {
4657                 const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
4658                         &sta_he_cap->he_mcs_nss_supp;
4659                 u16 sta_mcs_map_rx =
4660                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
4661                 u16 sta_mcs_map_tx =
4662                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
4663                 u8 nss;
4664                 bool verified = true;
4665
4666                 /*
4667                  * For each band there is a maximum of 8 spatial streams
4668                  * possible. Each of the sta_mcs_map_* is a 16-bit struct built
4669                  * of 2 bits per NSS (1-8), with the values defined in enum
4670                  * ieee80211_he_mcs_support. Need to make sure STA TX and RX
4671                  * capabilities aren't less than the AP's minimum requirements
4672                  * for this HE BSS per SS.
4673                  * It is enough to find one such band that meets the reqs.
4674                  */
4675                 for (nss = 8; nss > 0; nss--) {
4676                         u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
4677                         u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
4678                         u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
4679
4680                         if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
4681                                 continue;
4682
4683                         /*
4684                          * Make sure the HE AP doesn't require MCSs that aren't
4685                          * supported by the client as required by spec
4686                          *
4687                          * P802.11-REVme/D0.3
4688                          * 26.17.1 Basic HE BSS operation
4689                          *
4690                          * An HE STA shall not attempt to join * (MLME-JOIN.request primitive)
4691                          * a BSS, unless it supports (i.e., is able to both transmit and
4692                          * receive using) all of the <HE-MCS, NSS> tuples in the basic
4693                          * HE-MCS and NSS set.
4694                          */
4695                         if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4696                             sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4697                             (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
4698                                 verified = false;
4699                                 break;
4700                         }
4701                 }
4702
4703                 if (verified)
4704                         return true;
4705         }
4706
4707         /* If here, STA doesn't meet AP's HE min requirements */
4708         return false;
4709 }
4710
4711 static u8
4712 ieee80211_get_eht_cap_mcs_nss(const struct ieee80211_sta_he_cap *sta_he_cap,
4713                               const struct ieee80211_sta_eht_cap *sta_eht_cap,
4714                               unsigned int idx, int bw)
4715 {
4716         u8 he_phy_cap0 = sta_he_cap->he_cap_elem.phy_cap_info[0];
4717         u8 eht_phy_cap0 = sta_eht_cap->eht_cap_elem.phy_cap_info[0];
4718
4719         /* handle us being a 20 MHz-only EHT STA - with four values
4720          * for MCS 0-7, 8-9, 10-11, 12-13.
4721          */
4722         if (!(he_phy_cap0 & IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK_ALL))
4723                 return sta_eht_cap->eht_mcs_nss_supp.only_20mhz.rx_tx_max_nss[idx];
4724
4725         /* the others have MCS 0-9 together, rather than separately from 0-7 */
4726         if (idx > 0)
4727                 idx--;
4728
4729         switch (bw) {
4730         case 0:
4731                 return sta_eht_cap->eht_mcs_nss_supp.bw._80.rx_tx_max_nss[idx];
4732         case 1:
4733                 if (!(he_phy_cap0 &
4734                       (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4735                        IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)))
4736                         return 0xff; /* pass check */
4737                 return sta_eht_cap->eht_mcs_nss_supp.bw._160.rx_tx_max_nss[idx];
4738         case 2:
4739                 if (!(eht_phy_cap0 & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ))
4740                         return 0xff; /* pass check */
4741                 return sta_eht_cap->eht_mcs_nss_supp.bw._320.rx_tx_max_nss[idx];
4742         }
4743
4744         WARN_ON(1);
4745         return 0;
4746 }
4747
4748 static bool
4749 ieee80211_verify_sta_eht_mcs_support(struct ieee80211_sub_if_data *sdata,
4750                                      struct ieee80211_supported_band *sband,
4751                                      const struct ieee80211_eht_operation *eht_op)
4752 {
4753         const struct ieee80211_sta_he_cap *sta_he_cap =
4754                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
4755         const struct ieee80211_sta_eht_cap *sta_eht_cap =
4756                 ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
4757         const struct ieee80211_eht_mcs_nss_supp_20mhz_only *req;
4758         unsigned int i;
4759
4760         if (!sta_he_cap || !sta_eht_cap || !eht_op)
4761                 return false;
4762
4763         req = &eht_op->basic_mcs_nss;
4764
4765         for (i = 0; i < ARRAY_SIZE(req->rx_tx_max_nss); i++) {
4766                 u8 req_rx_nss, req_tx_nss;
4767                 unsigned int bw;
4768
4769                 req_rx_nss = u8_get_bits(req->rx_tx_max_nss[i],
4770                                          IEEE80211_EHT_MCS_NSS_RX);
4771                 req_tx_nss = u8_get_bits(req->rx_tx_max_nss[i],
4772                                          IEEE80211_EHT_MCS_NSS_TX);
4773
4774                 for (bw = 0; bw < 3; bw++) {
4775                         u8 have, have_rx_nss, have_tx_nss;
4776
4777                         have = ieee80211_get_eht_cap_mcs_nss(sta_he_cap,
4778                                                              sta_eht_cap,
4779                                                              i, bw);
4780                         have_rx_nss = u8_get_bits(have,
4781                                                   IEEE80211_EHT_MCS_NSS_RX);
4782                         have_tx_nss = u8_get_bits(have,
4783                                                   IEEE80211_EHT_MCS_NSS_TX);
4784
4785                         if (req_rx_nss > have_rx_nss ||
4786                             req_tx_nss > have_tx_nss)
4787                                 return false;
4788                 }
4789         }
4790
4791         return true;
4792 }
4793
4794 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
4795                                   struct ieee80211_link_data *link,
4796                                   struct cfg80211_bss *cbss,
4797                                   ieee80211_conn_flags_t *conn_flags)
4798 {
4799         struct ieee80211_local *local = sdata->local;
4800         const struct ieee80211_ht_cap *ht_cap = NULL;
4801         const struct ieee80211_ht_operation *ht_oper = NULL;
4802         const struct ieee80211_vht_operation *vht_oper = NULL;
4803         const struct ieee80211_he_operation *he_oper = NULL;
4804         const struct ieee80211_eht_operation *eht_oper = NULL;
4805         const struct ieee80211_s1g_oper_ie *s1g_oper = NULL;
4806         struct ieee80211_supported_band *sband;
4807         struct cfg80211_chan_def chandef;
4808         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4809         bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
4810         struct ieee80211_bss *bss = (void *)cbss->priv;
4811         struct ieee80211_elems_parse_params parse_params = {
4812                 .link_id = -1,
4813                 .from_ap = true,
4814         };
4815         struct ieee802_11_elems *elems;
4816         const struct cfg80211_bss_ies *ies;
4817         int ret;
4818         u32 i;
4819         bool have_80mhz;
4820
4821         rcu_read_lock();
4822
4823         ies = rcu_dereference(cbss->ies);
4824         parse_params.start = ies->data;
4825         parse_params.len = ies->len;
4826         elems = ieee802_11_parse_elems_full(&parse_params);
4827         if (!elems) {
4828                 rcu_read_unlock();
4829                 return -ENOMEM;
4830         }
4831
4832         sband = local->hw.wiphy->bands[cbss->channel->band];
4833
4834         *conn_flags &= ~(IEEE80211_CONN_DISABLE_40MHZ |
4835                          IEEE80211_CONN_DISABLE_80P80MHZ |
4836                          IEEE80211_CONN_DISABLE_160MHZ);
4837
4838         /* disable HT/VHT/HE if we don't support them */
4839         if (!sband->ht_cap.ht_supported && !is_6ghz) {
4840                 mlme_dbg(sdata, "HT not supported, disabling HT/VHT/HE/EHT\n");
4841                 *conn_flags |= IEEE80211_CONN_DISABLE_HT;
4842                 *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4843                 *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4844                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4845         }
4846
4847         if (!sband->vht_cap.vht_supported && is_5ghz) {
4848                 mlme_dbg(sdata, "VHT not supported, disabling VHT/HE/EHT\n");
4849                 *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4850                 *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4851                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4852         }
4853
4854         if (!ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif)) {
4855                 mlme_dbg(sdata, "HE not supported, disabling HE and EHT\n");
4856                 *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4857                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4858         }
4859
4860         if (!ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif)) {
4861                 mlme_dbg(sdata, "EHT not supported, disabling EHT\n");
4862                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4863         }
4864
4865         if (!(*conn_flags & IEEE80211_CONN_DISABLE_HT) && !is_6ghz) {
4866                 ht_oper = elems->ht_operation;
4867                 ht_cap = elems->ht_cap_elem;
4868
4869                 if (!ht_cap) {
4870                         *conn_flags |= IEEE80211_CONN_DISABLE_HT;
4871                         ht_oper = NULL;
4872                 }
4873         }
4874
4875         if (!(*conn_flags & IEEE80211_CONN_DISABLE_VHT) && !is_6ghz) {
4876                 vht_oper = elems->vht_operation;
4877                 if (vht_oper && !ht_oper) {
4878                         vht_oper = NULL;
4879                         sdata_info(sdata,
4880                                    "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4881                         *conn_flags |= IEEE80211_CONN_DISABLE_HT;
4882                         *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4883                         *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4884                         *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4885                 }
4886
4887                 if (!elems->vht_cap_elem) {
4888                         *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4889                         vht_oper = NULL;
4890                 }
4891         }
4892
4893         if (!(*conn_flags & IEEE80211_CONN_DISABLE_HE)) {
4894                 he_oper = elems->he_operation;
4895
4896                 if (link && is_6ghz) {
4897                         struct ieee80211_bss_conf *bss_conf;
4898                         u8 j = 0;
4899
4900                         bss_conf = link->conf;
4901
4902                         if (elems->pwr_constr_elem)
4903                                 bss_conf->pwr_reduction = *elems->pwr_constr_elem;
4904
4905                         BUILD_BUG_ON(ARRAY_SIZE(bss_conf->tx_pwr_env) !=
4906                                      ARRAY_SIZE(elems->tx_pwr_env));
4907
4908                         for (i = 0; i < elems->tx_pwr_env_num; i++) {
4909                                 if (elems->tx_pwr_env_len[i] >
4910                                     sizeof(bss_conf->tx_pwr_env[j]))
4911                                         continue;
4912
4913                                 bss_conf->tx_pwr_env_num++;
4914                                 memcpy(&bss_conf->tx_pwr_env[j], elems->tx_pwr_env[i],
4915                                        elems->tx_pwr_env_len[i]);
4916                                 j++;
4917                         }
4918                 }
4919
4920                 if (!ieee80211_verify_peer_he_mcs_support(sdata, ies, he_oper) ||
4921                     !ieee80211_verify_sta_he_mcs_support(sdata, sband, he_oper))
4922                         *conn_flags |= IEEE80211_CONN_DISABLE_HE |
4923                                        IEEE80211_CONN_DISABLE_EHT;
4924         }
4925
4926         /*
4927          * EHT requires HE to be supported as well. Specifically for 6 GHz
4928          * channels, the operation channel information can only be deduced from
4929          * both the 6 GHz operation information (from the HE operation IE) and
4930          * EHT operation.
4931          */
4932         if (!(*conn_flags &
4933                         (IEEE80211_CONN_DISABLE_HE |
4934                          IEEE80211_CONN_DISABLE_EHT)) &&
4935             he_oper) {
4936                 const struct cfg80211_bss_ies *cbss_ies;
4937                 const struct element *eht_ml_elem;
4938                 const u8 *eht_oper_ie;
4939
4940                 cbss_ies = rcu_dereference(cbss->ies);
4941                 eht_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_EHT_OPERATION,
4942                                                    cbss_ies->data, cbss_ies->len);
4943                 if (eht_oper_ie && eht_oper_ie[1] >=
4944                     1 + sizeof(struct ieee80211_eht_operation))
4945                         eht_oper = (void *)(eht_oper_ie + 3);
4946                 else
4947                         eht_oper = NULL;
4948
4949                 if (!ieee80211_verify_sta_eht_mcs_support(sdata, sband, eht_oper))
4950                         *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4951
4952                 eht_ml_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_MULTI_LINK,
4953                                                      cbss_ies->data, cbss_ies->len);
4954
4955                 /* data + 1 / datalen - 1 since it's an extended element */
4956                 if (!(*conn_flags & IEEE80211_CONN_DISABLE_EHT) &&
4957                     eht_ml_elem &&
4958                     ieee80211_mle_type_ok(eht_ml_elem->data + 1,
4959                                           IEEE80211_ML_CONTROL_TYPE_BASIC,
4960                                           eht_ml_elem->datalen - 1)) {
4961                         sdata->vif.cfg.eml_cap =
4962                                 ieee80211_mle_get_eml_cap(eht_ml_elem->data + 1);
4963                         sdata->vif.cfg.eml_med_sync_delay =
4964                                 ieee80211_mle_get_eml_med_sync_delay(eht_ml_elem->data + 1);
4965                 }
4966         }
4967
4968         /* Allow VHT if at least one channel on the sband supports 80 MHz */
4969         have_80mhz = false;
4970         for (i = 0; i < sband->n_channels; i++) {
4971                 if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
4972                                                 IEEE80211_CHAN_NO_80MHZ))
4973                         continue;
4974
4975                 have_80mhz = true;
4976                 break;
4977         }
4978
4979         if (!have_80mhz) {
4980                 sdata_info(sdata, "80 MHz not supported, disabling VHT\n");
4981                 *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4982         }
4983
4984         if (sband->band == NL80211_BAND_S1GHZ) {
4985                 s1g_oper = elems->s1g_oper;
4986                 if (!s1g_oper)
4987                         sdata_info(sdata,
4988                                    "AP missing S1G operation element?\n");
4989         }
4990
4991         *conn_flags |=
4992                 ieee80211_determine_chantype(sdata, link, *conn_flags,
4993                                              sband,
4994                                              cbss->channel,
4995                                              bss->vht_cap_info,
4996                                              ht_oper, vht_oper,
4997                                              he_oper, eht_oper,
4998                                              s1g_oper,
4999                                              &chandef, false);
5000
5001         if (link)
5002                 link->needed_rx_chains =
5003                         min(ieee80211_max_rx_chains(link, cbss),
5004                             local->rx_chains);
5005
5006         rcu_read_unlock();
5007         /* the element data was RCU protected so no longer valid anyway */
5008         kfree(elems);
5009         elems = NULL;
5010
5011         if (*conn_flags & IEEE80211_CONN_DISABLE_HE && is_6ghz) {
5012                 sdata_info(sdata, "Rejecting non-HE 6/7 GHz connection");
5013                 return -EINVAL;
5014         }
5015
5016         if (!link)
5017                 return 0;
5018
5019         /* will change later if needed */
5020         link->smps_mode = IEEE80211_SMPS_OFF;
5021
5022         mutex_lock(&local->mtx);
5023         /*
5024          * If this fails (possibly due to channel context sharing
5025          * on incompatible channels, e.g. 80+80 and 160 sharing the
5026          * same control channel) try to use a smaller bandwidth.
5027          */
5028         ret = ieee80211_link_use_channel(link, &chandef,
5029                                          IEEE80211_CHANCTX_SHARED);
5030
5031         /* don't downgrade for 5 and 10 MHz channels, though. */
5032         if (chandef.width == NL80211_CHAN_WIDTH_5 ||
5033             chandef.width == NL80211_CHAN_WIDTH_10)
5034                 goto out;
5035
5036         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
5037                 *conn_flags |=
5038                         ieee80211_chandef_downgrade(&chandef);
5039                 ret = ieee80211_link_use_channel(link, &chandef,
5040                                                  IEEE80211_CHANCTX_SHARED);
5041         }
5042  out:
5043         mutex_unlock(&local->mtx);
5044         return ret;
5045 }
5046
5047 static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
5048                                u8 *dtim_count, u8 *dtim_period)
5049 {
5050         const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
5051         const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
5052                                          ies->len);
5053         const struct ieee80211_tim_ie *tim = NULL;
5054         const struct ieee80211_bssid_index *idx;
5055         bool valid = tim_ie && tim_ie[1] >= 2;
5056
5057         if (valid)
5058                 tim = (void *)(tim_ie + 2);
5059
5060         if (dtim_count)
5061                 *dtim_count = valid ? tim->dtim_count : 0;
5062
5063         if (dtim_period)
5064                 *dtim_period = valid ? tim->dtim_period : 0;
5065
5066         /* Check if value is overridden by non-transmitted profile */
5067         if (!idx_ie || idx_ie[1] < 3)
5068                 return valid;
5069
5070         idx = (void *)(idx_ie + 2);
5071
5072         if (dtim_count)
5073                 *dtim_count = idx->dtim_count;
5074
5075         if (dtim_period)
5076                 *dtim_period = idx->dtim_period;
5077
5078         return true;
5079 }
5080
5081 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
5082                                     struct ieee80211_mgmt *mgmt,
5083                                     struct ieee802_11_elems *elems,
5084                                     const u8 *elem_start, unsigned int elem_len)
5085 {
5086         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5087         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
5088         struct ieee80211_local *local = sdata->local;
5089         unsigned int link_id;
5090         struct sta_info *sta;
5091         u64 changed[IEEE80211_MLD_MAX_NUM_LINKS] = {};
5092         u16 valid_links = 0, dormant_links = 0;
5093         int err;
5094
5095         mutex_lock(&sdata->local->sta_mtx);
5096         /*
5097          * station info was already allocated and inserted before
5098          * the association and should be available to us
5099          */
5100         sta = sta_info_get(sdata, assoc_data->ap_addr);
5101         if (WARN_ON(!sta))
5102                 goto out_err;
5103
5104         if (ieee80211_vif_is_mld(&sdata->vif)) {
5105                 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5106                         if (!assoc_data->link[link_id].bss)
5107                                 continue;
5108
5109                         valid_links |= BIT(link_id);
5110                         if (assoc_data->link[link_id].disabled) {
5111                                 dormant_links |= BIT(link_id);
5112                         } else if (link_id != assoc_data->assoc_link_id) {
5113                                 err = ieee80211_sta_allocate_link(sta, link_id);
5114                                 if (err)
5115                                         goto out_err;
5116                         }
5117                 }
5118
5119                 ieee80211_vif_set_links(sdata, valid_links, dormant_links);
5120         }
5121
5122         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5123                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
5124                 struct ieee80211_link_data *link;
5125                 struct link_sta_info *link_sta;
5126
5127                 if (!cbss || assoc_data->link[link_id].disabled)
5128                         continue;
5129
5130                 link = sdata_dereference(sdata->link[link_id], sdata);
5131                 if (WARN_ON(!link))
5132                         goto out_err;
5133
5134                 if (ieee80211_vif_is_mld(&sdata->vif))
5135                         link_info(link,
5136                                   "local address %pM, AP link address %pM%s\n",
5137                                   link->conf->addr,
5138                                   assoc_data->link[link_id].bss->bssid,
5139                                   link_id == assoc_data->assoc_link_id ?
5140                                         " (assoc)" : "");
5141
5142                 link_sta = rcu_dereference_protected(sta->link[link_id],
5143                                                      lockdep_is_held(&local->sta_mtx));
5144                 if (WARN_ON(!link_sta))
5145                         goto out_err;
5146
5147                 if (!link->u.mgd.have_beacon) {
5148                         const struct cfg80211_bss_ies *ies;
5149
5150                         rcu_read_lock();
5151                         ies = rcu_dereference(cbss->beacon_ies);
5152                         if (ies)
5153                                 link->u.mgd.have_beacon = true;
5154                         else
5155                                 ies = rcu_dereference(cbss->ies);
5156                         ieee80211_get_dtim(ies,
5157                                            &link->conf->sync_dtim_count,
5158                                            &link->u.mgd.dtim_period);
5159                         link->conf->beacon_int = cbss->beacon_interval;
5160                         rcu_read_unlock();
5161                 }
5162
5163                 link->conf->dtim_period = link->u.mgd.dtim_period ?: 1;
5164
5165                 if (link_id != assoc_data->assoc_link_id) {
5166                         err = ieee80211_prep_channel(sdata, link, cbss,
5167                                                      &link->u.mgd.conn_flags);
5168                         if (err) {
5169                                 link_info(link, "prep_channel failed\n");
5170                                 goto out_err;
5171                         }
5172                 }
5173
5174                 err = ieee80211_mgd_setup_link_sta(link, sta, link_sta,
5175                                                    assoc_data->link[link_id].bss);
5176                 if (err)
5177                         goto out_err;
5178
5179                 if (!ieee80211_assoc_config_link(link, link_sta,
5180                                                  assoc_data->link[link_id].bss,
5181                                                  mgmt, elem_start, elem_len,
5182                                                  &changed[link_id]))
5183                         goto out_err;
5184
5185                 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
5186                         valid_links &= ~BIT(link_id);
5187                         ieee80211_sta_remove_link(sta, link_id);
5188                         continue;
5189                 }
5190
5191                 if (link_id != assoc_data->assoc_link_id) {
5192                         err = ieee80211_sta_activate_link(sta, link_id);
5193                         if (err)
5194                                 goto out_err;
5195                 }
5196         }
5197
5198         /* links might have changed due to rejected ones, set them again */
5199         ieee80211_vif_set_links(sdata, valid_links, dormant_links);
5200
5201         rate_control_rate_init(sta);
5202
5203         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
5204                 set_sta_flag(sta, WLAN_STA_MFP);
5205                 sta->sta.mfp = true;
5206         } else {
5207                 sta->sta.mfp = false;
5208         }
5209
5210         ieee80211_sta_set_max_amsdu_subframes(sta, elems->ext_capab,
5211                                               elems->ext_capab_len);
5212
5213         sta->sta.wme = (elems->wmm_param || elems->s1g_capab) &&
5214                        local->hw.queues >= IEEE80211_NUM_ACS;
5215
5216         err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
5217         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
5218                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
5219         if (err) {
5220                 sdata_info(sdata,
5221                            "failed to move station %pM to desired state\n",
5222                            sta->sta.addr);
5223                 WARN_ON(__sta_info_destroy(sta));
5224                 goto out_err;
5225         }
5226
5227         if (sdata->wdev.use_4addr)
5228                 drv_sta_set_4addr(local, sdata, &sta->sta, true);
5229
5230         mutex_unlock(&sdata->local->sta_mtx);
5231
5232         ieee80211_set_associated(sdata, assoc_data, changed);
5233
5234         /*
5235          * If we're using 4-addr mode, let the AP know that we're
5236          * doing so, so that it can create the STA VLAN on its side
5237          */
5238         if (ifmgd->use_4addr)
5239                 ieee80211_send_4addr_nullfunc(local, sdata);
5240
5241         /*
5242          * Start timer to probe the connection to the AP now.
5243          * Also start the timer that will detect beacon loss.
5244          */
5245         ieee80211_sta_reset_beacon_monitor(sdata);
5246         ieee80211_sta_reset_conn_monitor(sdata);
5247
5248         return true;
5249 out_err:
5250         eth_zero_addr(sdata->vif.cfg.ap_addr);
5251         mutex_unlock(&sdata->local->sta_mtx);
5252         return false;
5253 }
5254
5255 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
5256                                          struct ieee80211_mgmt *mgmt,
5257                                          size_t len)
5258 {
5259         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5260         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
5261         u16 capab_info, status_code, aid;
5262         struct ieee80211_elems_parse_params parse_params = {
5263                 .bss = NULL,
5264                 .link_id = -1,
5265                 .from_ap = true,
5266         };
5267         struct ieee802_11_elems *elems;
5268         int ac;
5269         const u8 *elem_start;
5270         unsigned int elem_len;
5271         bool reassoc;
5272         struct ieee80211_event event = {
5273                 .type = MLME_EVENT,
5274                 .u.mlme.data = ASSOC_EVENT,
5275         };
5276         struct ieee80211_prep_tx_info info = {};
5277         struct cfg80211_rx_assoc_resp resp = {
5278                 .uapsd_queues = -1,
5279         };
5280         u8 ap_mld_addr[ETH_ALEN] __aligned(2);
5281         unsigned int link_id;
5282
5283         sdata_assert_lock(sdata);
5284
5285         if (!assoc_data)
5286                 return;
5287
5288         if (!ether_addr_equal(assoc_data->ap_addr, mgmt->bssid) ||
5289             !ether_addr_equal(assoc_data->ap_addr, mgmt->sa))
5290                 return;
5291
5292         /*
5293          * AssocResp and ReassocResp have identical structure, so process both
5294          * of them in this function.
5295          */
5296
5297         if (len < 24 + 6)
5298                 return;
5299
5300         reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
5301         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
5302         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
5303         if (assoc_data->s1g)
5304                 elem_start = mgmt->u.s1g_assoc_resp.variable;
5305         else
5306                 elem_start = mgmt->u.assoc_resp.variable;
5307
5308         /*
5309          * Note: this may not be perfect, AP might misbehave - if
5310          * anyone needs to rely on perfect complete notification
5311          * with the exact right subtype, then we need to track what
5312          * we actually transmitted.
5313          */
5314         info.subtype = reassoc ? IEEE80211_STYPE_REASSOC_REQ :
5315                                  IEEE80211_STYPE_ASSOC_REQ;
5316
5317         if (assoc_data->fils_kek_len &&
5318             fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
5319                 return;
5320
5321         elem_len = len - (elem_start - (u8 *)mgmt);
5322         parse_params.start = elem_start;
5323         parse_params.len = elem_len;
5324         elems = ieee802_11_parse_elems_full(&parse_params);
5325         if (!elems)
5326                 goto notify_driver;
5327
5328         if (elems->aid_resp)
5329                 aid = le16_to_cpu(elems->aid_resp->aid);
5330         else if (assoc_data->s1g)
5331                 aid = 0; /* TODO */
5332         else
5333                 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
5334
5335         /*
5336          * The 5 MSB of the AID field are reserved
5337          * (802.11-2016 9.4.1.8 AID field)
5338          */
5339         aid &= 0x7ff;
5340
5341         sdata_info(sdata,
5342                    "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
5343                    reassoc ? "Rea" : "A", assoc_data->ap_addr,
5344                    capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
5345
5346         ifmgd->broken_ap = false;
5347
5348         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
5349             elems->timeout_int &&
5350             elems->timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
5351                 u32 tu, ms;
5352
5353                 cfg80211_assoc_comeback(sdata->dev, assoc_data->ap_addr,
5354                                         le32_to_cpu(elems->timeout_int->value));
5355
5356                 tu = le32_to_cpu(elems->timeout_int->value);
5357                 ms = tu * 1024 / 1000;
5358                 sdata_info(sdata,
5359                            "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
5360                            assoc_data->ap_addr, tu, ms);
5361                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
5362                 assoc_data->timeout_started = true;
5363                 if (ms > IEEE80211_ASSOC_TIMEOUT)
5364                         run_again(sdata, assoc_data->timeout);
5365                 goto notify_driver;
5366         }
5367
5368         if (status_code != WLAN_STATUS_SUCCESS) {
5369                 sdata_info(sdata, "%pM denied association (code=%d)\n",
5370                            assoc_data->ap_addr, status_code);
5371                 event.u.mlme.status = MLME_DENIED;
5372                 event.u.mlme.reason = status_code;
5373                 drv_event_callback(sdata->local, sdata, &event);
5374         } else {
5375                 if (aid == 0 || aid > IEEE80211_MAX_AID) {
5376                         sdata_info(sdata,
5377                                    "invalid AID value %d (out of range), turn off PS\n",
5378                                    aid);
5379                         aid = 0;
5380                         ifmgd->broken_ap = true;
5381                 }
5382
5383                 if (ieee80211_vif_is_mld(&sdata->vif)) {
5384                         if (!elems->ml_basic) {
5385                                 sdata_info(sdata,
5386                                            "MLO association with %pM but no multi-link element in response!\n",
5387                                            assoc_data->ap_addr);
5388                                 goto abandon_assoc;
5389                         }
5390
5391                         if (le16_get_bits(elems->ml_basic->control,
5392                                           IEEE80211_ML_CONTROL_TYPE) !=
5393                                         IEEE80211_ML_CONTROL_TYPE_BASIC) {
5394                                 sdata_info(sdata,
5395                                            "bad multi-link element (control=0x%x)\n",
5396                                            le16_to_cpu(elems->ml_basic->control));
5397                                 goto abandon_assoc;
5398                         } else {
5399                                 struct ieee80211_mle_basic_common_info *common;
5400
5401                                 common = (void *)elems->ml_basic->variable;
5402
5403                                 if (memcmp(assoc_data->ap_addr,
5404                                            common->mld_mac_addr, ETH_ALEN)) {
5405                                         sdata_info(sdata,
5406                                                    "AP MLD MAC address mismatch: got %pM expected %pM\n",
5407                                                    common->mld_mac_addr,
5408                                                    assoc_data->ap_addr);
5409                                         goto abandon_assoc;
5410                                 }
5411                         }
5412                 }
5413
5414                 sdata->vif.cfg.aid = aid;
5415
5416                 if (!ieee80211_assoc_success(sdata, mgmt, elems,
5417                                              elem_start, elem_len)) {
5418                         /* oops -- internal error -- send timeout for now */
5419                         ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
5420                         goto notify_driver;
5421                 }
5422                 event.u.mlme.status = MLME_SUCCESS;
5423                 drv_event_callback(sdata->local, sdata, &event);
5424                 sdata_info(sdata, "associated\n");
5425
5426                 info.success = 1;
5427         }
5428
5429         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5430                 struct ieee80211_link_data *link;
5431
5432                 link = sdata_dereference(sdata->link[link_id], sdata);
5433                 if (!link)
5434                         continue;
5435
5436                 if (!assoc_data->link[link_id].bss)
5437                         continue;
5438
5439                 resp.links[link_id].bss = assoc_data->link[link_id].bss;
5440                 resp.links[link_id].addr = link->conf->addr;
5441                 resp.links[link_id].status = assoc_data->link[link_id].status;
5442
5443                 /* get uapsd queues configuration - same for all links */
5444                 resp.uapsd_queues = 0;
5445                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5446                         if (link->tx_conf[ac].uapsd)
5447                                 resp.uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
5448         }
5449
5450         if (ieee80211_vif_is_mld(&sdata->vif)) {
5451                 ether_addr_copy(ap_mld_addr, sdata->vif.cfg.ap_addr);
5452                 resp.ap_mld_addr = ap_mld_addr;
5453         }
5454
5455         ieee80211_destroy_assoc_data(sdata,
5456                                      status_code == WLAN_STATUS_SUCCESS ?
5457                                         ASSOC_SUCCESS :
5458                                         ASSOC_REJECTED);
5459
5460         resp.buf = (u8 *)mgmt;
5461         resp.len = len;
5462         resp.req_ies = ifmgd->assoc_req_ies;
5463         resp.req_ies_len = ifmgd->assoc_req_ies_len;
5464         cfg80211_rx_assoc_resp(sdata->dev, &resp);
5465 notify_driver:
5466         drv_mgd_complete_tx(sdata->local, sdata, &info);
5467         kfree(elems);
5468         return;
5469 abandon_assoc:
5470         ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
5471         goto notify_driver;
5472 }
5473
5474 static void ieee80211_rx_bss_info(struct ieee80211_link_data *link,
5475                                   struct ieee80211_mgmt *mgmt, size_t len,
5476                                   struct ieee80211_rx_status *rx_status)
5477 {
5478         struct ieee80211_sub_if_data *sdata = link->sdata;
5479         struct ieee80211_local *local = sdata->local;
5480         struct ieee80211_bss *bss;
5481         struct ieee80211_channel *channel;
5482
5483         sdata_assert_lock(sdata);
5484
5485         channel = ieee80211_get_channel_khz(local->hw.wiphy,
5486                                         ieee80211_rx_status_to_khz(rx_status));
5487         if (!channel)
5488                 return;
5489
5490         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
5491         if (bss) {
5492                 link->conf->beacon_rate = bss->beacon_rate;
5493                 ieee80211_rx_bss_put(local, bss);
5494         }
5495 }
5496
5497
5498 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_link_data *link,
5499                                          struct sk_buff *skb)
5500 {
5501         struct ieee80211_sub_if_data *sdata = link->sdata;
5502         struct ieee80211_mgmt *mgmt = (void *)skb->data;
5503         struct ieee80211_if_managed *ifmgd;
5504         struct ieee80211_rx_status *rx_status = (void *) skb->cb;
5505         struct ieee80211_channel *channel;
5506         size_t baselen, len = skb->len;
5507
5508         ifmgd = &sdata->u.mgd;
5509
5510         sdata_assert_lock(sdata);
5511
5512         /*
5513          * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
5514          * "If a 6 GHz AP receives a Probe Request frame  and responds with
5515          * a Probe Response frame [..], the Address 1 field of the Probe
5516          * Response frame shall be set to the broadcast address [..]"
5517          * So, on 6GHz band we should also accept broadcast responses.
5518          */
5519         channel = ieee80211_get_channel(sdata->local->hw.wiphy,
5520                                         rx_status->freq);
5521         if (!channel)
5522                 return;
5523
5524         if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
5525             (channel->band != NL80211_BAND_6GHZ ||
5526              !is_broadcast_ether_addr(mgmt->da)))
5527                 return; /* ignore ProbeResp to foreign address */
5528
5529         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
5530         if (baselen > len)
5531                 return;
5532
5533         ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5534
5535         if (ifmgd->associated &&
5536             ether_addr_equal(mgmt->bssid, link->u.mgd.bssid))
5537                 ieee80211_reset_ap_probe(sdata);
5538 }
5539
5540 /*
5541  * This is the canonical list of information elements we care about,
5542  * the filter code also gives us all changes to the Microsoft OUI
5543  * (00:50:F2) vendor IE which is used for WMM which we need to track,
5544  * as well as the DTPC IE (part of the Cisco OUI) used for signaling
5545  * changes to requested client power.
5546  *
5547  * We implement beacon filtering in software since that means we can
5548  * avoid processing the frame here and in cfg80211, and userspace
5549  * will not be able to tell whether the hardware supports it or not.
5550  *
5551  * XXX: This list needs to be dynamic -- userspace needs to be able to
5552  *      add items it requires. It also needs to be able to tell us to
5553  *      look out for other vendor IEs.
5554  */
5555 static const u64 care_about_ies =
5556         (1ULL << WLAN_EID_COUNTRY) |
5557         (1ULL << WLAN_EID_ERP_INFO) |
5558         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
5559         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
5560         (1ULL << WLAN_EID_HT_CAPABILITY) |
5561         (1ULL << WLAN_EID_HT_OPERATION) |
5562         (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
5563
5564 static void ieee80211_handle_beacon_sig(struct ieee80211_link_data *link,
5565                                         struct ieee80211_if_managed *ifmgd,
5566                                         struct ieee80211_bss_conf *bss_conf,
5567                                         struct ieee80211_local *local,
5568                                         struct ieee80211_rx_status *rx_status)
5569 {
5570         struct ieee80211_sub_if_data *sdata = link->sdata;
5571
5572         /* Track average RSSI from the Beacon frames of the current AP */
5573
5574         if (!link->u.mgd.tracking_signal_avg) {
5575                 link->u.mgd.tracking_signal_avg = true;
5576                 ewma_beacon_signal_init(&link->u.mgd.ave_beacon_signal);
5577                 link->u.mgd.last_cqm_event_signal = 0;
5578                 link->u.mgd.count_beacon_signal = 1;
5579                 link->u.mgd.last_ave_beacon_signal = 0;
5580         } else {
5581                 link->u.mgd.count_beacon_signal++;
5582         }
5583
5584         ewma_beacon_signal_add(&link->u.mgd.ave_beacon_signal,
5585                                -rx_status->signal);
5586
5587         if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
5588             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5589                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5590                 int last_sig = link->u.mgd.last_ave_beacon_signal;
5591                 struct ieee80211_event event = {
5592                         .type = RSSI_EVENT,
5593                 };
5594
5595                 /*
5596                  * if signal crosses either of the boundaries, invoke callback
5597                  * with appropriate parameters
5598                  */
5599                 if (sig > ifmgd->rssi_max_thold &&
5600                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
5601                         link->u.mgd.last_ave_beacon_signal = sig;
5602                         event.u.rssi.data = RSSI_EVENT_HIGH;
5603                         drv_event_callback(local, sdata, &event);
5604                 } else if (sig < ifmgd->rssi_min_thold &&
5605                            (last_sig >= ifmgd->rssi_max_thold ||
5606                            last_sig == 0)) {
5607                         link->u.mgd.last_ave_beacon_signal = sig;
5608                         event.u.rssi.data = RSSI_EVENT_LOW;
5609                         drv_event_callback(local, sdata, &event);
5610                 }
5611         }
5612
5613         if (bss_conf->cqm_rssi_thold &&
5614             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
5615             !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
5616                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5617                 int last_event = link->u.mgd.last_cqm_event_signal;
5618                 int thold = bss_conf->cqm_rssi_thold;
5619                 int hyst = bss_conf->cqm_rssi_hyst;
5620
5621                 if (sig < thold &&
5622                     (last_event == 0 || sig < last_event - hyst)) {
5623                         link->u.mgd.last_cqm_event_signal = sig;
5624                         ieee80211_cqm_rssi_notify(
5625                                 &sdata->vif,
5626                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5627                                 sig, GFP_KERNEL);
5628                 } else if (sig > thold &&
5629                            (last_event == 0 || sig > last_event + hyst)) {
5630                         link->u.mgd.last_cqm_event_signal = sig;
5631                         ieee80211_cqm_rssi_notify(
5632                                 &sdata->vif,
5633                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5634                                 sig, GFP_KERNEL);
5635                 }
5636         }
5637
5638         if (bss_conf->cqm_rssi_low &&
5639             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5640                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5641                 int last_event = link->u.mgd.last_cqm_event_signal;
5642                 int low = bss_conf->cqm_rssi_low;
5643                 int high = bss_conf->cqm_rssi_high;
5644
5645                 if (sig < low &&
5646                     (last_event == 0 || last_event >= low)) {
5647                         link->u.mgd.last_cqm_event_signal = sig;
5648                         ieee80211_cqm_rssi_notify(
5649                                 &sdata->vif,
5650                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5651                                 sig, GFP_KERNEL);
5652                 } else if (sig > high &&
5653                            (last_event == 0 || last_event <= high)) {
5654                         link->u.mgd.last_cqm_event_signal = sig;
5655                         ieee80211_cqm_rssi_notify(
5656                                 &sdata->vif,
5657                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5658                                 sig, GFP_KERNEL);
5659                 }
5660         }
5661 }
5662
5663 static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
5664                                     struct cfg80211_bss *bss)
5665 {
5666         if (ether_addr_equal(tx_bssid, bss->bssid))
5667                 return true;
5668         if (!bss->transmitted_bss)
5669                 return false;
5670         return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
5671 }
5672
5673 static bool ieee80211_config_puncturing(struct ieee80211_link_data *link,
5674                                         const struct ieee80211_eht_operation *eht_oper,
5675                                         u64 *changed)
5676 {
5677         u16 bitmap = 0, extracted;
5678
5679         if ((eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
5680             (eht_oper->params &
5681              IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
5682                 const struct ieee80211_eht_operation_info *info =
5683                         (void *)eht_oper->optional;
5684                 const u8 *disable_subchannel_bitmap = info->optional;
5685
5686                 bitmap = get_unaligned_le16(disable_subchannel_bitmap);
5687         }
5688
5689         extracted = ieee80211_extract_dis_subch_bmap(eht_oper,
5690                                                      &link->conf->chandef,
5691                                                      bitmap);
5692
5693         /* accept if there are no changes */
5694         if (!(*changed & BSS_CHANGED_BANDWIDTH) &&
5695             extracted == link->conf->eht_puncturing)
5696                 return true;
5697
5698         if (!cfg80211_valid_disable_subchannel_bitmap(&bitmap,
5699                                                       &link->conf->chandef)) {
5700                 link_info(link,
5701                           "Got an invalid disable subchannel bitmap from AP %pM: bitmap = 0x%x, bw = 0x%x. disconnect\n",
5702                           link->u.mgd.bssid,
5703                           bitmap,
5704                           link->conf->chandef.width);
5705                 return false;
5706         }
5707
5708         ieee80211_handle_puncturing_bitmap(link, eht_oper, bitmap, changed);
5709         return true;
5710 }
5711
5712 static void ieee80211_ml_reconf_work(struct wiphy *wiphy,
5713                                      struct wiphy_work *work)
5714 {
5715         struct ieee80211_sub_if_data *sdata =
5716                 container_of(work, struct ieee80211_sub_if_data,
5717                              u.mgd.ml_reconf_work.work);
5718         u16 new_valid_links, new_active_links, new_dormant_links;
5719         int ret;
5720
5721         sdata_lock(sdata);
5722         if (!sdata->u.mgd.removed_links) {
5723                 sdata_unlock(sdata);
5724                 return;
5725         }
5726
5727         sdata_info(sdata,
5728                    "MLO Reconfiguration: work: valid=0x%x, removed=0x%x\n",
5729                    sdata->vif.valid_links, sdata->u.mgd.removed_links);
5730
5731         new_valid_links = sdata->vif.valid_links & ~sdata->u.mgd.removed_links;
5732         if (new_valid_links == sdata->vif.valid_links) {
5733                 sdata_unlock(sdata);
5734                 return;
5735         }
5736
5737         if (!new_valid_links ||
5738             !(new_valid_links & ~sdata->vif.dormant_links)) {
5739                 sdata_info(sdata, "No valid links after reconfiguration\n");
5740                 ret = -EINVAL;
5741                 goto out;
5742         }
5743
5744         new_active_links = sdata->vif.active_links & ~sdata->u.mgd.removed_links;
5745         if (new_active_links != sdata->vif.active_links) {
5746                 if (!new_active_links)
5747                         new_active_links =
5748                                 BIT(ffs(new_valid_links &
5749                                         ~sdata->vif.dormant_links) - 1);
5750
5751                 ret = __ieee80211_set_active_links(&sdata->vif,
5752                                                    new_active_links);
5753                 if (ret) {
5754                         sdata_info(sdata,
5755                                    "Failed setting active links\n");
5756                         goto out;
5757                 }
5758         }
5759
5760         new_dormant_links = sdata->vif.dormant_links & ~sdata->u.mgd.removed_links;
5761
5762         ret = ieee80211_vif_set_links(sdata, new_valid_links,
5763                                       new_dormant_links);
5764         if (ret)
5765                 sdata_info(sdata, "Failed setting valid links\n");
5766
5767 out:
5768         if (!ret)
5769                 cfg80211_links_removed(sdata->dev, sdata->u.mgd.removed_links);
5770         else
5771                 ___ieee80211_disconnect(sdata);
5772
5773         sdata->u.mgd.removed_links = 0;
5774
5775         sdata_unlock(sdata);
5776 }
5777
5778 static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,
5779                                          struct ieee802_11_elems *elems)
5780 {
5781         const struct ieee80211_multi_link_elem *ml;
5782         const struct element *sub;
5783         size_t ml_len;
5784         unsigned long removed_links = 0;
5785         u16 link_removal_timeout[IEEE80211_MLD_MAX_NUM_LINKS] = {};
5786         u8 link_id;
5787         u32 delay;
5788
5789         if (!ieee80211_vif_is_mld(&sdata->vif) || !elems->ml_reconf)
5790                 return;
5791
5792         ml_len = cfg80211_defragment_element(elems->ml_reconf_elem,
5793                                              elems->ie_start,
5794                                              elems->total_len,
5795                                              elems->scratch_pos,
5796                                              elems->scratch + elems->scratch_len -
5797                                              elems->scratch_pos,
5798                                              WLAN_EID_FRAGMENT);
5799
5800         elems->ml_reconf = (const void *)elems->scratch_pos;
5801         elems->ml_reconf_len = ml_len;
5802         ml = elems->ml_reconf;
5803
5804         /* Directly parse the sub elements as the common information doesn't
5805          * hold any useful information.
5806          */
5807         for_each_mle_subelement(sub, (u8 *)ml, ml_len) {
5808                 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
5809                 u8 *pos = prof->variable;
5810                 u16 control;
5811
5812                 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
5813                         continue;
5814
5815                 if (!ieee80211_mle_reconf_sta_prof_size_ok(sub->data,
5816                                                            sub->datalen))
5817                         return;
5818
5819                 control = le16_to_cpu(prof->control);
5820                 link_id = control & IEEE80211_MLE_STA_RECONF_CONTROL_LINK_ID;
5821
5822                 removed_links |= BIT(link_id);
5823
5824                 /* the MAC address should not be included, but handle it */
5825                 if (control &
5826                     IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT)
5827                         pos += 6;
5828
5829                 /* According to Draft P802.11be_D3.0, the control should
5830                  * include the AP Removal Timer present. If the AP Removal Timer
5831                  * is not present assume immediate removal.
5832                  */
5833                 if (control &
5834                     IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT)
5835                         link_removal_timeout[link_id] = le16_to_cpu(*(__le16 *)pos);
5836         }
5837
5838         removed_links &= sdata->vif.valid_links;
5839         if (!removed_links) {
5840                 /* In case the removal was cancelled, abort it */
5841                 if (sdata->u.mgd.removed_links) {
5842                         sdata->u.mgd.removed_links = 0;
5843                         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
5844                                                   &sdata->u.mgd.ml_reconf_work);
5845                 }
5846                 return;
5847         }
5848
5849         delay = 0;
5850         for_each_set_bit(link_id, &removed_links, IEEE80211_MLD_MAX_NUM_LINKS) {
5851                 struct ieee80211_bss_conf *link_conf =
5852                         sdata_dereference(sdata->vif.link_conf[link_id], sdata);
5853                 u32 link_delay;
5854
5855                 if (!link_conf) {
5856                         removed_links &= ~BIT(link_id);
5857                         continue;
5858                 }
5859
5860                 link_delay = link_conf->beacon_int *
5861                         link_removal_timeout[link_id];
5862
5863                 if (!delay)
5864                         delay = link_delay;
5865                 else
5866                         delay = min(delay, link_delay);
5867         }
5868
5869         sdata->u.mgd.removed_links = removed_links;
5870         wiphy_delayed_work_queue(sdata->local->hw.wiphy,
5871                                  &sdata->u.mgd.ml_reconf_work,
5872                                  TU_TO_JIFFIES(delay));
5873 }
5874
5875 static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
5876                                      struct ieee80211_hdr *hdr, size_t len,
5877                                      struct ieee80211_rx_status *rx_status)
5878 {
5879         struct ieee80211_sub_if_data *sdata = link->sdata;
5880         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5881         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
5882         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
5883         struct ieee80211_mgmt *mgmt = (void *) hdr;
5884         size_t baselen;
5885         struct ieee802_11_elems *elems;
5886         struct ieee80211_local *local = sdata->local;
5887         struct ieee80211_chanctx_conf *chanctx_conf;
5888         struct ieee80211_supported_band *sband;
5889         struct ieee80211_channel *chan;
5890         struct link_sta_info *link_sta;
5891         struct sta_info *sta;
5892         u64 changed = 0;
5893         bool erp_valid;
5894         u8 erp_value = 0;
5895         u32 ncrc = 0;
5896         u8 *bssid, *variable = mgmt->u.beacon.variable;
5897         u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
5898         struct ieee80211_elems_parse_params parse_params = {
5899                 .link_id = -1,
5900                 .from_ap = true,
5901         };
5902
5903         sdata_assert_lock(sdata);
5904
5905         /* Process beacon from the current BSS */
5906         bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
5907         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
5908                 struct ieee80211_ext *ext = (void *) mgmt;
5909
5910                 if (ieee80211_is_s1g_short_beacon(ext->frame_control))
5911                         variable = ext->u.s1g_short_beacon.variable;
5912                 else
5913                         variable = ext->u.s1g_beacon.variable;
5914         }
5915
5916         baselen = (u8 *) variable - (u8 *) mgmt;
5917         if (baselen > len)
5918                 return;
5919
5920         parse_params.start = variable;
5921         parse_params.len = len - baselen;
5922
5923         rcu_read_lock();
5924         chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
5925         if (!chanctx_conf) {
5926                 rcu_read_unlock();
5927                 return;
5928         }
5929
5930         if (ieee80211_rx_status_to_khz(rx_status) !=
5931             ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
5932                 rcu_read_unlock();
5933                 return;
5934         }
5935         chan = chanctx_conf->def.chan;
5936         rcu_read_unlock();
5937
5938         if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
5939             !WARN_ON(ieee80211_vif_is_mld(&sdata->vif)) &&
5940             ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) {
5941                 parse_params.bss = ifmgd->assoc_data->link[0].bss;
5942                 elems = ieee802_11_parse_elems_full(&parse_params);
5943                 if (!elems)
5944                         return;
5945
5946                 ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5947
5948                 if (elems->dtim_period)
5949                         link->u.mgd.dtim_period = elems->dtim_period;
5950                 link->u.mgd.have_beacon = true;
5951                 ifmgd->assoc_data->need_beacon = false;
5952                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5953                         link->conf->sync_tsf =
5954                                 le64_to_cpu(mgmt->u.beacon.timestamp);
5955                         link->conf->sync_device_ts =
5956                                 rx_status->device_timestamp;
5957                         link->conf->sync_dtim_count = elems->dtim_count;
5958                 }
5959
5960                 if (elems->mbssid_config_ie)
5961                         bss_conf->profile_periodicity =
5962                                 elems->mbssid_config_ie->profile_periodicity;
5963                 else
5964                         bss_conf->profile_periodicity = 0;
5965
5966                 if (elems->ext_capab_len >= 11 &&
5967                     (elems->ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
5968                         bss_conf->ema_ap = true;
5969                 else
5970                         bss_conf->ema_ap = false;
5971
5972                 /* continue assoc process */
5973                 ifmgd->assoc_data->timeout = jiffies;
5974                 ifmgd->assoc_data->timeout_started = true;
5975                 run_again(sdata, ifmgd->assoc_data->timeout);
5976                 kfree(elems);
5977                 return;
5978         }
5979
5980         if (!ifmgd->associated ||
5981             !ieee80211_rx_our_beacon(bssid, link->u.mgd.bss))
5982                 return;
5983         bssid = link->u.mgd.bssid;
5984
5985         if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
5986                 ieee80211_handle_beacon_sig(link, ifmgd, bss_conf,
5987                                             local, rx_status);
5988
5989         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
5990                 mlme_dbg_ratelimited(sdata,
5991                                      "cancelling AP probe due to a received beacon\n");
5992                 ieee80211_reset_ap_probe(sdata);
5993         }
5994
5995         /*
5996          * Push the beacon loss detection into the future since
5997          * we are processing a beacon from the AP just now.
5998          */
5999         ieee80211_sta_reset_beacon_monitor(sdata);
6000
6001         /* TODO: CRC urrently not calculated on S1G Beacon Compatibility
6002          * element (which carries the beacon interval). Don't forget to add a
6003          * bit to care_about_ies[] above if mac80211 is interested in a
6004          * changing S1G element.
6005          */
6006         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
6007                 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
6008         parse_params.bss = link->u.mgd.bss;
6009         parse_params.filter = care_about_ies;
6010         parse_params.crc = ncrc;
6011         elems = ieee802_11_parse_elems_full(&parse_params);
6012         if (!elems)
6013                 return;
6014         ncrc = elems->crc;
6015
6016         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
6017             ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid)) {
6018                 if (local->hw.conf.dynamic_ps_timeout > 0) {
6019                         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
6020                                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
6021                                 ieee80211_hw_config(local,
6022                                                     IEEE80211_CONF_CHANGE_PS);
6023                         }
6024                         ieee80211_send_nullfunc(local, sdata, false);
6025                 } else if (!local->pspolling && sdata->u.mgd.powersave) {
6026                         local->pspolling = true;
6027
6028                         /*
6029                          * Here is assumed that the driver will be
6030                          * able to send ps-poll frame and receive a
6031                          * response even though power save mode is
6032                          * enabled, but some drivers might require
6033                          * to disable power save here. This needs
6034                          * to be investigated.
6035                          */
6036                         ieee80211_send_pspoll(local, sdata);
6037                 }
6038         }
6039
6040         if (sdata->vif.p2p ||
6041             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
6042                 struct ieee80211_p2p_noa_attr noa = {};
6043                 int ret;
6044
6045                 ret = cfg80211_get_p2p_attr(variable,
6046                                             len - baselen,
6047                                             IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
6048                                             (u8 *) &noa, sizeof(noa));
6049                 if (ret >= 2) {
6050                         if (link->u.mgd.p2p_noa_index != noa.index) {
6051                                 /* valid noa_attr and index changed */
6052                                 link->u.mgd.p2p_noa_index = noa.index;
6053                                 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
6054                                 changed |= BSS_CHANGED_P2P_PS;
6055                                 /*
6056                                  * make sure we update all information, the CRC
6057                                  * mechanism doesn't look at P2P attributes.
6058                                  */
6059                                 link->u.mgd.beacon_crc_valid = false;
6060                         }
6061                 } else if (link->u.mgd.p2p_noa_index != -1) {
6062                         /* noa_attr not found and we had valid noa_attr before */
6063                         link->u.mgd.p2p_noa_index = -1;
6064                         memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
6065                         changed |= BSS_CHANGED_P2P_PS;
6066                         link->u.mgd.beacon_crc_valid = false;
6067                 }
6068         }
6069
6070         if (link->u.mgd.csa_waiting_bcn)
6071                 ieee80211_chswitch_post_beacon(link);
6072
6073         /*
6074          * Update beacon timing and dtim count on every beacon appearance. This
6075          * will allow the driver to use the most updated values. Do it before
6076          * comparing this one with last received beacon.
6077          * IMPORTANT: These parameters would possibly be out of sync by the time
6078          * the driver will use them. The synchronized view is currently
6079          * guaranteed only in certain callbacks.
6080          */
6081         if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
6082             !ieee80211_is_s1g_beacon(hdr->frame_control)) {
6083                 link->conf->sync_tsf =
6084                         le64_to_cpu(mgmt->u.beacon.timestamp);
6085                 link->conf->sync_device_ts =
6086                         rx_status->device_timestamp;
6087                 link->conf->sync_dtim_count = elems->dtim_count;
6088         }
6089
6090         if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) ||
6091             ieee80211_is_s1g_short_beacon(mgmt->frame_control))
6092                 goto free;
6093         link->u.mgd.beacon_crc = ncrc;
6094         link->u.mgd.beacon_crc_valid = true;
6095
6096         ieee80211_rx_bss_info(link, mgmt, len, rx_status);
6097
6098         ieee80211_sta_process_chanswitch(link, rx_status->mactime,
6099                                          rx_status->device_timestamp,
6100                                          elems, true);
6101
6102         if (!link->u.mgd.disable_wmm_tracking &&
6103             ieee80211_sta_wmm_params(local, link, elems->wmm_param,
6104                                      elems->wmm_param_len,
6105                                      elems->mu_edca_param_set))
6106                 changed |= BSS_CHANGED_QOS;
6107
6108         /*
6109          * If we haven't had a beacon before, tell the driver about the
6110          * DTIM period (and beacon timing if desired) now.
6111          */
6112         if (!link->u.mgd.have_beacon) {
6113                 /* a few bogus AP send dtim_period = 0 or no TIM IE */
6114                 bss_conf->dtim_period = elems->dtim_period ?: 1;
6115
6116                 changed |= BSS_CHANGED_BEACON_INFO;
6117                 link->u.mgd.have_beacon = true;
6118
6119                 mutex_lock(&local->iflist_mtx);
6120                 ieee80211_recalc_ps(local);
6121                 mutex_unlock(&local->iflist_mtx);
6122
6123                 ieee80211_recalc_ps_vif(sdata);
6124         }
6125
6126         if (elems->erp_info) {
6127                 erp_valid = true;
6128                 erp_value = elems->erp_info[0];
6129         } else {
6130                 erp_valid = false;
6131         }
6132
6133         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
6134                 changed |= ieee80211_handle_bss_capability(link,
6135                                 le16_to_cpu(mgmt->u.beacon.capab_info),
6136                                 erp_valid, erp_value);
6137
6138         mutex_lock(&local->sta_mtx);
6139         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
6140         if (WARN_ON(!sta)) {
6141                 mutex_unlock(&local->sta_mtx);
6142                 goto free;
6143         }
6144         link_sta = rcu_dereference_protected(sta->link[link->link_id],
6145                                              lockdep_is_held(&local->sta_mtx));
6146         if (WARN_ON(!link_sta)) {
6147                 mutex_unlock(&local->sta_mtx);
6148                 goto free;
6149         }
6150
6151         if (WARN_ON(!link->conf->chandef.chan))
6152                 goto free;
6153
6154         sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
6155
6156         changed |= ieee80211_recalc_twt_req(sdata, sband, link, link_sta, elems);
6157
6158         if (ieee80211_config_bw(link, elems->ht_cap_elem,
6159                                 elems->vht_cap_elem, elems->ht_operation,
6160                                 elems->vht_operation, elems->he_operation,
6161                                 elems->eht_operation,
6162                                 elems->s1g_oper, bssid, &changed)) {
6163                 mutex_unlock(&local->sta_mtx);
6164                 sdata_info(sdata,
6165                            "failed to follow AP %pM bandwidth change, disconnect\n",
6166                            bssid);
6167                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
6168                                        WLAN_REASON_DEAUTH_LEAVING,
6169                                        true, deauth_buf);
6170                 ieee80211_report_disconnect(sdata, deauth_buf,
6171                                             sizeof(deauth_buf), true,
6172                                             WLAN_REASON_DEAUTH_LEAVING,
6173                                             false);
6174                 goto free;
6175         }
6176
6177         if (elems->opmode_notif)
6178                 ieee80211_vht_handle_opmode(sdata, link_sta,
6179                                             *elems->opmode_notif,
6180                                             rx_status->band);
6181         mutex_unlock(&local->sta_mtx);
6182
6183         changed |= ieee80211_handle_pwr_constr(link, chan, mgmt,
6184                                                elems->country_elem,
6185                                                elems->country_elem_len,
6186                                                elems->pwr_constr_elem,
6187                                                elems->cisco_dtpc_elem);
6188
6189         if (elems->eht_operation &&
6190             !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
6191                 if (!ieee80211_config_puncturing(link, elems->eht_operation,
6192                                                  &changed)) {
6193                         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
6194                                                WLAN_REASON_DEAUTH_LEAVING,
6195                                                true, deauth_buf);
6196                         ieee80211_report_disconnect(sdata, deauth_buf,
6197                                                     sizeof(deauth_buf), true,
6198                                                     WLAN_REASON_DEAUTH_LEAVING,
6199                                                     false);
6200                         goto free;
6201                 }
6202         }
6203
6204         ieee80211_ml_reconfiguration(sdata, elems);
6205
6206         ieee80211_link_info_change_notify(sdata, link, changed);
6207 free:
6208         kfree(elems);
6209 }
6210
6211 void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
6212                                  struct sk_buff *skb)
6213 {
6214         struct ieee80211_link_data *link = &sdata->deflink;
6215         struct ieee80211_rx_status *rx_status;
6216         struct ieee80211_hdr *hdr;
6217         u16 fc;
6218
6219         rx_status = (struct ieee80211_rx_status *) skb->cb;
6220         hdr = (struct ieee80211_hdr *) skb->data;
6221         fc = le16_to_cpu(hdr->frame_control);
6222
6223         sdata_lock(sdata);
6224         switch (fc & IEEE80211_FCTL_STYPE) {
6225         case IEEE80211_STYPE_S1G_BEACON:
6226                 ieee80211_rx_mgmt_beacon(link, hdr, skb->len, rx_status);
6227                 break;
6228         }
6229         sdata_unlock(sdata);
6230 }
6231
6232 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
6233                                   struct sk_buff *skb)
6234 {
6235         struct ieee80211_link_data *link = &sdata->deflink;
6236         struct ieee80211_rx_status *rx_status;
6237         struct ieee80211_mgmt *mgmt;
6238         u16 fc;
6239         int ies_len;
6240
6241         rx_status = (struct ieee80211_rx_status *) skb->cb;
6242         mgmt = (struct ieee80211_mgmt *) skb->data;
6243         fc = le16_to_cpu(mgmt->frame_control);
6244
6245         sdata_lock(sdata);
6246
6247         if (rx_status->link_valid) {
6248                 link = sdata_dereference(sdata->link[rx_status->link_id],
6249                                          sdata);
6250                 if (!link)
6251                         goto out;
6252         }
6253
6254         switch (fc & IEEE80211_FCTL_STYPE) {
6255         case IEEE80211_STYPE_BEACON:
6256                 ieee80211_rx_mgmt_beacon(link, (void *)mgmt,
6257                                          skb->len, rx_status);
6258                 break;
6259         case IEEE80211_STYPE_PROBE_RESP:
6260                 ieee80211_rx_mgmt_probe_resp(link, skb);
6261                 break;
6262         case IEEE80211_STYPE_AUTH:
6263                 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
6264                 break;
6265         case IEEE80211_STYPE_DEAUTH:
6266                 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
6267                 break;
6268         case IEEE80211_STYPE_DISASSOC:
6269                 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
6270                 break;
6271         case IEEE80211_STYPE_ASSOC_RESP:
6272         case IEEE80211_STYPE_REASSOC_RESP:
6273                 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
6274                 break;
6275         case IEEE80211_STYPE_ACTION:
6276                 if (!sdata->u.mgd.associated ||
6277                     !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
6278                         break;
6279
6280                 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
6281                         struct ieee802_11_elems *elems;
6282
6283                         ies_len = skb->len -
6284                                   offsetof(struct ieee80211_mgmt,
6285                                            u.action.u.chan_switch.variable);
6286
6287                         if (ies_len < 0)
6288                                 break;
6289
6290                         /* CSA IE cannot be overridden, no need for BSSID */
6291                         elems = ieee802_11_parse_elems(
6292                                         mgmt->u.action.u.chan_switch.variable,
6293                                         ies_len, true, NULL);
6294
6295                         if (elems && !elems->parse_error)
6296                                 ieee80211_sta_process_chanswitch(link,
6297                                                                  rx_status->mactime,
6298                                                                  rx_status->device_timestamp,
6299                                                                  elems, false);
6300                         kfree(elems);
6301                 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
6302                         struct ieee802_11_elems *elems;
6303
6304                         ies_len = skb->len -
6305                                   offsetof(struct ieee80211_mgmt,
6306                                            u.action.u.ext_chan_switch.variable);
6307
6308                         if (ies_len < 0)
6309                                 break;
6310
6311                         /*
6312                          * extended CSA IE can't be overridden, no need for
6313                          * BSSID
6314                          */
6315                         elems = ieee802_11_parse_elems(
6316                                         mgmt->u.action.u.ext_chan_switch.variable,
6317                                         ies_len, true, NULL);
6318
6319                         if (elems && !elems->parse_error) {
6320                                 /* for the handling code pretend it was an IE */
6321                                 elems->ext_chansw_ie =
6322                                         &mgmt->u.action.u.ext_chan_switch.data;
6323
6324                                 ieee80211_sta_process_chanswitch(link,
6325                                                                  rx_status->mactime,
6326                                                                  rx_status->device_timestamp,
6327                                                                  elems, false);
6328                         }
6329
6330                         kfree(elems);
6331                 }
6332                 break;
6333         }
6334 out:
6335         sdata_unlock(sdata);
6336 }
6337
6338 static void ieee80211_sta_timer(struct timer_list *t)
6339 {
6340         struct ieee80211_sub_if_data *sdata =
6341                 from_timer(sdata, t, u.mgd.timer);
6342
6343         wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
6344 }
6345
6346 void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
6347                                    u8 reason, bool tx)
6348 {
6349         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6350
6351         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
6352                                tx, frame_buf);
6353
6354         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
6355                                     reason, false);
6356 }
6357
6358 static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
6359 {
6360         struct ieee80211_local *local = sdata->local;
6361         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6362         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
6363         u32 tx_flags = 0;
6364         u16 trans = 1;
6365         u16 status = 0;
6366         struct ieee80211_prep_tx_info info = {
6367                 .subtype = IEEE80211_STYPE_AUTH,
6368         };
6369
6370         sdata_assert_lock(sdata);
6371
6372         if (WARN_ON_ONCE(!auth_data))
6373                 return -EINVAL;
6374
6375         auth_data->tries++;
6376
6377         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
6378                 sdata_info(sdata, "authentication with %pM timed out\n",
6379                            auth_data->ap_addr);
6380
6381                 /*
6382                  * Most likely AP is not in the range so remove the
6383                  * bss struct for that AP.
6384                  */
6385                 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
6386
6387                 return -ETIMEDOUT;
6388         }
6389
6390         if (auth_data->algorithm == WLAN_AUTH_SAE)
6391                 info.duration = jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);
6392
6393         drv_mgd_prepare_tx(local, sdata, &info);
6394
6395         sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
6396                    auth_data->ap_addr, auth_data->tries,
6397                    IEEE80211_AUTH_MAX_TRIES);
6398
6399         auth_data->expected_transaction = 2;
6400
6401         if (auth_data->algorithm == WLAN_AUTH_SAE) {
6402                 trans = auth_data->sae_trans;
6403                 status = auth_data->sae_status;
6404                 auth_data->expected_transaction = trans;
6405         }
6406
6407         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
6408                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
6409                            IEEE80211_TX_INTFL_MLME_CONN_TX;
6410
6411         ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
6412                             auth_data->data, auth_data->data_len,
6413                             auth_data->ap_addr, auth_data->ap_addr,
6414                             NULL, 0, 0, tx_flags);
6415
6416         if (tx_flags == 0) {
6417                 if (auth_data->algorithm == WLAN_AUTH_SAE)
6418                         auth_data->timeout = jiffies +
6419                                 IEEE80211_AUTH_TIMEOUT_SAE;
6420                 else
6421                         auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
6422         } else {
6423                 auth_data->timeout =
6424                         round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
6425         }
6426
6427         auth_data->timeout_started = true;
6428         run_again(sdata, auth_data->timeout);
6429
6430         return 0;
6431 }
6432
6433 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
6434 {
6435         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
6436         struct ieee80211_local *local = sdata->local;
6437         int ret;
6438
6439         sdata_assert_lock(sdata);
6440
6441         assoc_data->tries++;
6442         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
6443                 sdata_info(sdata, "association with %pM timed out\n",
6444                            assoc_data->ap_addr);
6445
6446                 /*
6447                  * Most likely AP is not in the range so remove the
6448                  * bss struct for that AP.
6449                  */
6450                 cfg80211_unlink_bss(local->hw.wiphy,
6451                                     assoc_data->link[assoc_data->assoc_link_id].bss);
6452
6453                 return -ETIMEDOUT;
6454         }
6455
6456         sdata_info(sdata, "associate with %pM (try %d/%d)\n",
6457                    assoc_data->ap_addr, assoc_data->tries,
6458                    IEEE80211_ASSOC_MAX_TRIES);
6459         ret = ieee80211_send_assoc(sdata);
6460         if (ret)
6461                 return ret;
6462
6463         if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
6464                 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
6465                 assoc_data->timeout_started = true;
6466                 run_again(sdata, assoc_data->timeout);
6467         } else {
6468                 assoc_data->timeout =
6469                         round_jiffies_up(jiffies +
6470                                          IEEE80211_ASSOC_TIMEOUT_LONG);
6471                 assoc_data->timeout_started = true;
6472                 run_again(sdata, assoc_data->timeout);
6473         }
6474
6475         return 0;
6476 }
6477
6478 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
6479                                   __le16 fc, bool acked)
6480 {
6481         struct ieee80211_local *local = sdata->local;
6482
6483         sdata->u.mgd.status_fc = fc;
6484         sdata->u.mgd.status_acked = acked;
6485         sdata->u.mgd.status_received = true;
6486
6487         wiphy_work_queue(local->hw.wiphy, &sdata->work);
6488 }
6489
6490 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
6491 {
6492         struct ieee80211_local *local = sdata->local;
6493         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6494
6495         sdata_lock(sdata);
6496
6497         if (ifmgd->status_received) {
6498                 __le16 fc = ifmgd->status_fc;
6499                 bool status_acked = ifmgd->status_acked;
6500
6501                 ifmgd->status_received = false;
6502                 if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
6503                         if (status_acked) {
6504                                 if (ifmgd->auth_data->algorithm ==
6505                                     WLAN_AUTH_SAE)
6506                                         ifmgd->auth_data->timeout =
6507                                                 jiffies +
6508                                                 IEEE80211_AUTH_TIMEOUT_SAE;
6509                                 else
6510                                         ifmgd->auth_data->timeout =
6511                                                 jiffies +
6512                                                 IEEE80211_AUTH_TIMEOUT_SHORT;
6513                                 run_again(sdata, ifmgd->auth_data->timeout);
6514                         } else {
6515                                 ifmgd->auth_data->timeout = jiffies - 1;
6516                         }
6517                         ifmgd->auth_data->timeout_started = true;
6518                 } else if (ifmgd->assoc_data &&
6519                            (ieee80211_is_assoc_req(fc) ||
6520                             ieee80211_is_reassoc_req(fc))) {
6521                         if (status_acked) {
6522                                 ifmgd->assoc_data->timeout =
6523                                         jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
6524                                 run_again(sdata, ifmgd->assoc_data->timeout);
6525                         } else {
6526                                 ifmgd->assoc_data->timeout = jiffies - 1;
6527                         }
6528                         ifmgd->assoc_data->timeout_started = true;
6529                 }
6530         }
6531
6532         if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
6533             time_after(jiffies, ifmgd->auth_data->timeout)) {
6534                 if (ifmgd->auth_data->done || ifmgd->auth_data->waiting) {
6535                         /*
6536                          * ok ... we waited for assoc or continuation but
6537                          * userspace didn't do it, so kill the auth data
6538                          */
6539                         ieee80211_destroy_auth_data(sdata, false);
6540                 } else if (ieee80211_auth(sdata)) {
6541                         u8 ap_addr[ETH_ALEN];
6542                         struct ieee80211_event event = {
6543                                 .type = MLME_EVENT,
6544                                 .u.mlme.data = AUTH_EVENT,
6545                                 .u.mlme.status = MLME_TIMEOUT,
6546                         };
6547
6548                         memcpy(ap_addr, ifmgd->auth_data->ap_addr, ETH_ALEN);
6549
6550                         ieee80211_destroy_auth_data(sdata, false);
6551
6552                         cfg80211_auth_timeout(sdata->dev, ap_addr);
6553                         drv_event_callback(sdata->local, sdata, &event);
6554                 }
6555         } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
6556                 run_again(sdata, ifmgd->auth_data->timeout);
6557
6558         if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
6559             time_after(jiffies, ifmgd->assoc_data->timeout)) {
6560                 if ((ifmgd->assoc_data->need_beacon &&
6561                      !sdata->deflink.u.mgd.have_beacon) ||
6562                     ieee80211_do_assoc(sdata)) {
6563                         struct ieee80211_event event = {
6564                                 .type = MLME_EVENT,
6565                                 .u.mlme.data = ASSOC_EVENT,
6566                                 .u.mlme.status = MLME_TIMEOUT,
6567                         };
6568
6569                         ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
6570                         drv_event_callback(sdata->local, sdata, &event);
6571                 }
6572         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
6573                 run_again(sdata, ifmgd->assoc_data->timeout);
6574
6575         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
6576             ifmgd->associated) {
6577                 u8 *bssid = sdata->deflink.u.mgd.bssid;
6578                 int max_tries;
6579
6580                 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
6581                         max_tries = max_nullfunc_tries;
6582                 else
6583                         max_tries = max_probe_tries;
6584
6585                 /* ACK received for nullfunc probing frame */
6586                 if (!ifmgd->probe_send_count)
6587                         ieee80211_reset_ap_probe(sdata);
6588                 else if (ifmgd->nullfunc_failed) {
6589                         if (ifmgd->probe_send_count < max_tries) {
6590                                 mlme_dbg(sdata,
6591                                          "No ack for nullfunc frame to AP %pM, try %d/%i\n",
6592                                          bssid, ifmgd->probe_send_count,
6593                                          max_tries);
6594                                 ieee80211_mgd_probe_ap_send(sdata);
6595                         } else {
6596                                 mlme_dbg(sdata,
6597                                          "No ack for nullfunc frame to AP %pM, disconnecting.\n",
6598                                          bssid);
6599                                 ieee80211_sta_connection_lost(sdata,
6600                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
6601                                         false);
6602                         }
6603                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
6604                         run_again(sdata, ifmgd->probe_timeout);
6605                 else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
6606                         mlme_dbg(sdata,
6607                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
6608                                  bssid, probe_wait_ms);
6609                         ieee80211_sta_connection_lost(sdata,
6610                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
6611                 } else if (ifmgd->probe_send_count < max_tries) {
6612                         mlme_dbg(sdata,
6613                                  "No probe response from AP %pM after %dms, try %d/%i\n",
6614                                  bssid, probe_wait_ms,
6615                                  ifmgd->probe_send_count, max_tries);
6616                         ieee80211_mgd_probe_ap_send(sdata);
6617                 } else {
6618                         /*
6619                          * We actually lost the connection ... or did we?
6620                          * Let's make sure!
6621                          */
6622                         mlme_dbg(sdata,
6623                                  "No probe response from AP %pM after %dms, disconnecting.\n",
6624                                  bssid, probe_wait_ms);
6625
6626                         ieee80211_sta_connection_lost(sdata,
6627                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
6628                 }
6629         }
6630
6631         sdata_unlock(sdata);
6632 }
6633
6634 static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
6635 {
6636         struct ieee80211_sub_if_data *sdata =
6637                 from_timer(sdata, t, u.mgd.bcn_mon_timer);
6638
6639         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
6640                 return;
6641
6642         if (sdata->vif.bss_conf.csa_active &&
6643             !sdata->deflink.u.mgd.csa_waiting_bcn)
6644                 return;
6645
6646         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
6647                 return;
6648
6649         sdata->u.mgd.connection_loss = false;
6650         wiphy_work_queue(sdata->local->hw.wiphy,
6651                          &sdata->u.mgd.beacon_connection_loss_work);
6652 }
6653
6654 static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
6655 {
6656         struct ieee80211_sub_if_data *sdata =
6657                 from_timer(sdata, t, u.mgd.conn_mon_timer);
6658         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6659         struct ieee80211_local *local = sdata->local;
6660         struct sta_info *sta;
6661         unsigned long timeout;
6662
6663         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
6664                 return;
6665
6666         if (sdata->vif.bss_conf.csa_active &&
6667             !sdata->deflink.u.mgd.csa_waiting_bcn)
6668                 return;
6669
6670         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
6671         if (!sta)
6672                 return;
6673
6674         timeout = sta->deflink.status_stats.last_ack;
6675         if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx))
6676                 timeout = sta->deflink.rx_stats.last_rx;
6677         timeout += IEEE80211_CONNECTION_IDLE_TIME;
6678
6679         /* If timeout is after now, then update timer to fire at
6680          * the later date, but do not actually probe at this time.
6681          */
6682         if (time_is_after_jiffies(timeout)) {
6683                 mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
6684                 return;
6685         }
6686
6687         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
6688 }
6689
6690 static void ieee80211_sta_monitor_work(struct work_struct *work)
6691 {
6692         struct ieee80211_sub_if_data *sdata =
6693                 container_of(work, struct ieee80211_sub_if_data,
6694                              u.mgd.monitor_work);
6695
6696         ieee80211_mgd_probe_ap(sdata, false);
6697 }
6698
6699 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
6700 {
6701         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
6702                 __ieee80211_stop_poll(sdata);
6703
6704                 /* let's probe the connection once */
6705                 if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
6706                         ieee80211_queue_work(&sdata->local->hw,
6707                                              &sdata->u.mgd.monitor_work);
6708         }
6709 }
6710
6711 #ifdef CONFIG_PM
6712 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
6713 {
6714         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6715         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6716
6717         sdata_lock(sdata);
6718
6719         if (ifmgd->auth_data || ifmgd->assoc_data) {
6720                 const u8 *ap_addr = ifmgd->auth_data ?
6721                                 ifmgd->auth_data->ap_addr :
6722                                 ifmgd->assoc_data->ap_addr;
6723
6724                 /*
6725                  * If we are trying to authenticate / associate while suspending,
6726                  * cfg80211 won't know and won't actually abort those attempts,
6727                  * thus we need to do that ourselves.
6728                  */
6729                 ieee80211_send_deauth_disassoc(sdata, ap_addr, ap_addr,
6730                                                IEEE80211_STYPE_DEAUTH,
6731                                                WLAN_REASON_DEAUTH_LEAVING,
6732                                                false, frame_buf);
6733                 if (ifmgd->assoc_data)
6734                         ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
6735                 if (ifmgd->auth_data)
6736                         ieee80211_destroy_auth_data(sdata, false);
6737                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
6738                                       IEEE80211_DEAUTH_FRAME_LEN,
6739                                       false);
6740         }
6741
6742         /* This is a bit of a hack - we should find a better and more generic
6743          * solution to this. Normally when suspending, cfg80211 will in fact
6744          * deauthenticate. However, it doesn't (and cannot) stop an ongoing
6745          * auth (not so important) or assoc (this is the problem) process.
6746          *
6747          * As a consequence, it can happen that we are in the process of both
6748          * associating and suspending, and receive an association response
6749          * after cfg80211 has checked if it needs to disconnect, but before
6750          * we actually set the flag to drop incoming frames. This will then
6751          * cause the workqueue flush to process the association response in
6752          * the suspend, resulting in a successful association just before it
6753          * tries to remove the interface from the driver, which now though
6754          * has a channel context assigned ... this results in issues.
6755          *
6756          * To work around this (for now) simply deauth here again if we're
6757          * now connected.
6758          */
6759         if (ifmgd->associated && !sdata->local->wowlan) {
6760                 u8 bssid[ETH_ALEN];
6761                 struct cfg80211_deauth_request req = {
6762                         .reason_code = WLAN_REASON_DEAUTH_LEAVING,
6763                         .bssid = bssid,
6764                 };
6765
6766                 memcpy(bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
6767                 ieee80211_mgd_deauth(sdata, &req);
6768         }
6769
6770         sdata_unlock(sdata);
6771 }
6772 #endif
6773
6774 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
6775 {
6776         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6777
6778         sdata_lock(sdata);
6779         if (!ifmgd->associated) {
6780                 sdata_unlock(sdata);
6781                 return;
6782         }
6783
6784         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
6785                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
6786                 mlme_dbg(sdata, "driver requested disconnect after resume\n");
6787                 ieee80211_sta_connection_lost(sdata,
6788                                               WLAN_REASON_UNSPECIFIED,
6789                                               true);
6790                 sdata_unlock(sdata);
6791                 return;
6792         }
6793
6794         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_HW_RESTART) {
6795                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_HW_RESTART;
6796                 mlme_dbg(sdata, "driver requested disconnect after hardware restart\n");
6797                 ieee80211_sta_connection_lost(sdata,
6798                                               WLAN_REASON_UNSPECIFIED,
6799                                               true);
6800                 sdata_unlock(sdata);
6801                 return;
6802         }
6803
6804         sdata_unlock(sdata);
6805 }
6806
6807 static void ieee80211_request_smps_mgd_work(struct wiphy *wiphy,
6808                                             struct wiphy_work *work)
6809 {
6810         struct ieee80211_link_data *link =
6811                 container_of(work, struct ieee80211_link_data,
6812                              u.mgd.request_smps_work);
6813
6814         sdata_lock(link->sdata);
6815         __ieee80211_request_smps_mgd(link->sdata, link,
6816                                      link->u.mgd.driver_smps_mode);
6817         sdata_unlock(link->sdata);
6818 }
6819
6820 /* interface setup */
6821 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
6822 {
6823         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6824
6825         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
6826         wiphy_work_init(&ifmgd->beacon_connection_loss_work,
6827                         ieee80211_beacon_connection_loss_work);
6828         wiphy_work_init(&ifmgd->csa_connection_drop_work,
6829                         ieee80211_csa_connection_drop_work);
6830         INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
6831                           ieee80211_tdls_peer_del_work);
6832         wiphy_delayed_work_init(&ifmgd->ml_reconf_work,
6833                                 ieee80211_ml_reconf_work);
6834         timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
6835         timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
6836         timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
6837         INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
6838                           ieee80211_sta_handle_tspec_ac_params_wk);
6839
6840         ifmgd->flags = 0;
6841         ifmgd->powersave = sdata->wdev.ps;
6842         ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
6843         ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
6844         /* Setup TDLS data */
6845         spin_lock_init(&ifmgd->teardown_lock);
6846         ifmgd->teardown_skb = NULL;
6847         ifmgd->orig_teardown_skb = NULL;
6848 }
6849
6850 void ieee80211_mgd_setup_link(struct ieee80211_link_data *link)
6851 {
6852         struct ieee80211_sub_if_data *sdata = link->sdata;
6853         struct ieee80211_local *local = sdata->local;
6854         unsigned int link_id = link->link_id;
6855
6856         link->u.mgd.p2p_noa_index = -1;
6857         link->u.mgd.conn_flags = 0;
6858         link->conf->bssid = link->u.mgd.bssid;
6859
6860         wiphy_work_init(&link->u.mgd.request_smps_work,
6861                         ieee80211_request_smps_mgd_work);
6862         if (local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
6863                 link->u.mgd.req_smps = IEEE80211_SMPS_AUTOMATIC;
6864         else
6865                 link->u.mgd.req_smps = IEEE80211_SMPS_OFF;
6866
6867         wiphy_delayed_work_init(&link->u.mgd.chswitch_work,
6868                                 ieee80211_chswitch_work);
6869
6870         if (sdata->u.mgd.assoc_data)
6871                 ether_addr_copy(link->conf->addr,
6872                                 sdata->u.mgd.assoc_data->link[link_id].addr);
6873         else if (!is_valid_ether_addr(link->conf->addr))
6874                 eth_random_addr(link->conf->addr);
6875 }
6876
6877 /* scan finished notification */
6878 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
6879 {
6880         struct ieee80211_sub_if_data *sdata;
6881
6882         /* Restart STA timers */
6883         rcu_read_lock();
6884         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
6885                 if (ieee80211_sdata_running(sdata))
6886                         ieee80211_restart_sta_timer(sdata);
6887         }
6888         rcu_read_unlock();
6889 }
6890
6891 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
6892                                      struct cfg80211_bss *cbss, s8 link_id,
6893                                      const u8 *ap_mld_addr, bool assoc,
6894                                      bool override)
6895 {
6896         struct ieee80211_local *local = sdata->local;
6897         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6898         struct ieee80211_bss *bss = (void *)cbss->priv;
6899         struct sta_info *new_sta = NULL;
6900         struct ieee80211_link_data *link;
6901         bool have_sta = false;
6902         bool mlo;
6903         int err;
6904
6905         if (link_id >= 0) {
6906                 mlo = true;
6907                 if (WARN_ON(!ap_mld_addr))
6908                         return -EINVAL;
6909                 err = ieee80211_vif_set_links(sdata, BIT(link_id), 0);
6910         } else {
6911                 if (WARN_ON(ap_mld_addr))
6912                         return -EINVAL;
6913                 ap_mld_addr = cbss->bssid;
6914                 err = ieee80211_vif_set_links(sdata, 0, 0);
6915                 link_id = 0;
6916                 mlo = false;
6917         }
6918
6919         if (err)
6920                 return err;
6921
6922         link = sdata_dereference(sdata->link[link_id], sdata);
6923         if (WARN_ON(!link)) {
6924                 err = -ENOLINK;
6925                 goto out_err;
6926         }
6927
6928         if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) {
6929                 err = -EINVAL;
6930                 goto out_err;
6931         }
6932
6933         /* If a reconfig is happening, bail out */
6934         if (local->in_reconfig) {
6935                 err = -EBUSY;
6936                 goto out_err;
6937         }
6938
6939         if (assoc) {
6940                 rcu_read_lock();
6941                 have_sta = sta_info_get(sdata, ap_mld_addr);
6942                 rcu_read_unlock();
6943         }
6944
6945         if (!have_sta) {
6946                 if (mlo)
6947                         new_sta = sta_info_alloc_with_link(sdata, ap_mld_addr,
6948                                                            link_id, cbss->bssid,
6949                                                            GFP_KERNEL);
6950                 else
6951                         new_sta = sta_info_alloc(sdata, ap_mld_addr, GFP_KERNEL);
6952
6953                 if (!new_sta) {
6954                         err = -ENOMEM;
6955                         goto out_err;
6956                 }
6957
6958                 new_sta->sta.mlo = mlo;
6959         }
6960
6961         /*
6962          * Set up the information for the new channel before setting the
6963          * new channel. We can't - completely race-free - change the basic
6964          * rates bitmap and the channel (sband) that it refers to, but if
6965          * we set it up before we at least avoid calling into the driver's
6966          * bss_info_changed() method with invalid information (since we do
6967          * call that from changing the channel - only for IDLE and perhaps
6968          * some others, but ...).
6969          *
6970          * So to avoid that, just set up all the new information before the
6971          * channel, but tell the driver to apply it only afterwards, since
6972          * it might need the new channel for that.
6973          */
6974         if (new_sta) {
6975                 const struct cfg80211_bss_ies *ies;
6976                 struct link_sta_info *link_sta;
6977
6978                 rcu_read_lock();
6979                 link_sta = rcu_dereference(new_sta->link[link_id]);
6980                 if (WARN_ON(!link_sta)) {
6981                         rcu_read_unlock();
6982                         sta_info_free(local, new_sta);
6983                         err = -EINVAL;
6984                         goto out_err;
6985                 }
6986
6987                 err = ieee80211_mgd_setup_link_sta(link, new_sta,
6988                                                    link_sta, cbss);
6989                 if (err) {
6990                         rcu_read_unlock();
6991                         sta_info_free(local, new_sta);
6992                         goto out_err;
6993                 }
6994
6995                 memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
6996
6997                 /* set timing information */
6998                 link->conf->beacon_int = cbss->beacon_interval;
6999                 ies = rcu_dereference(cbss->beacon_ies);
7000                 if (ies) {
7001                         link->conf->sync_tsf = ies->tsf;
7002                         link->conf->sync_device_ts =
7003                                 bss->device_ts_beacon;
7004
7005                         ieee80211_get_dtim(ies,
7006                                            &link->conf->sync_dtim_count,
7007                                            NULL);
7008                 } else if (!ieee80211_hw_check(&sdata->local->hw,
7009                                                TIMING_BEACON_ONLY)) {
7010                         ies = rcu_dereference(cbss->proberesp_ies);
7011                         /* must be non-NULL since beacon IEs were NULL */
7012                         link->conf->sync_tsf = ies->tsf;
7013                         link->conf->sync_device_ts =
7014                                 bss->device_ts_presp;
7015                         link->conf->sync_dtim_count = 0;
7016                 } else {
7017                         link->conf->sync_tsf = 0;
7018                         link->conf->sync_device_ts = 0;
7019                         link->conf->sync_dtim_count = 0;
7020                 }
7021                 rcu_read_unlock();
7022         }
7023
7024         if (new_sta || override) {
7025                 err = ieee80211_prep_channel(sdata, link, cbss,
7026                                              &link->u.mgd.conn_flags);
7027                 if (err) {
7028                         if (new_sta)
7029                                 sta_info_free(local, new_sta);
7030                         goto out_err;
7031                 }
7032         }
7033
7034         if (new_sta) {
7035                 /*
7036                  * tell driver about BSSID, basic rates and timing
7037                  * this was set up above, before setting the channel
7038                  */
7039                 ieee80211_link_info_change_notify(sdata, link,
7040                                                   BSS_CHANGED_BSSID |
7041                                                   BSS_CHANGED_BASIC_RATES |
7042                                                   BSS_CHANGED_BEACON_INT);
7043
7044                 if (assoc)
7045                         sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
7046
7047                 err = sta_info_insert(new_sta);
7048                 new_sta = NULL;
7049                 if (err) {
7050                         sdata_info(sdata,
7051                                    "failed to insert STA entry for the AP (error %d)\n",
7052                                    err);
7053                         goto out_err;
7054                 }
7055         } else
7056                 WARN_ON_ONCE(!ether_addr_equal(link->u.mgd.bssid, cbss->bssid));
7057
7058         /* Cancel scan to ensure that nothing interferes with connection */
7059         if (local->scanning)
7060                 ieee80211_scan_cancel(local);
7061
7062         return 0;
7063
7064 out_err:
7065         ieee80211_link_release_channel(&sdata->deflink);
7066         ieee80211_vif_set_links(sdata, 0, 0);
7067         return err;
7068 }
7069
7070 /* config hooks */
7071 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
7072                        struct cfg80211_auth_request *req)
7073 {
7074         struct ieee80211_local *local = sdata->local;
7075         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7076         struct ieee80211_mgd_auth_data *auth_data;
7077         u16 auth_alg;
7078         int err;
7079         bool cont_auth;
7080
7081         /* prepare auth data structure */
7082
7083         switch (req->auth_type) {
7084         case NL80211_AUTHTYPE_OPEN_SYSTEM:
7085                 auth_alg = WLAN_AUTH_OPEN;
7086                 break;
7087         case NL80211_AUTHTYPE_SHARED_KEY:
7088                 if (fips_enabled)
7089                         return -EOPNOTSUPP;
7090                 auth_alg = WLAN_AUTH_SHARED_KEY;
7091                 break;
7092         case NL80211_AUTHTYPE_FT:
7093                 auth_alg = WLAN_AUTH_FT;
7094                 break;
7095         case NL80211_AUTHTYPE_NETWORK_EAP:
7096                 auth_alg = WLAN_AUTH_LEAP;
7097                 break;
7098         case NL80211_AUTHTYPE_SAE:
7099                 auth_alg = WLAN_AUTH_SAE;
7100                 break;
7101         case NL80211_AUTHTYPE_FILS_SK:
7102                 auth_alg = WLAN_AUTH_FILS_SK;
7103                 break;
7104         case NL80211_AUTHTYPE_FILS_SK_PFS:
7105                 auth_alg = WLAN_AUTH_FILS_SK_PFS;
7106                 break;
7107         case NL80211_AUTHTYPE_FILS_PK:
7108                 auth_alg = WLAN_AUTH_FILS_PK;
7109                 break;
7110         default:
7111                 return -EOPNOTSUPP;
7112         }
7113
7114         if (ifmgd->assoc_data)
7115                 return -EBUSY;
7116
7117         auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
7118                             req->ie_len, GFP_KERNEL);
7119         if (!auth_data)
7120                 return -ENOMEM;
7121
7122         memcpy(auth_data->ap_addr,
7123                req->ap_mld_addr ?: req->bss->bssid,
7124                ETH_ALEN);
7125         auth_data->bss = req->bss;
7126         auth_data->link_id = req->link_id;
7127
7128         if (req->auth_data_len >= 4) {
7129                 if (req->auth_type == NL80211_AUTHTYPE_SAE) {
7130                         __le16 *pos = (__le16 *) req->auth_data;
7131
7132                         auth_data->sae_trans = le16_to_cpu(pos[0]);
7133                         auth_data->sae_status = le16_to_cpu(pos[1]);
7134                 }
7135                 memcpy(auth_data->data, req->auth_data + 4,
7136                        req->auth_data_len - 4);
7137                 auth_data->data_len += req->auth_data_len - 4;
7138         }
7139
7140         /* Check if continuing authentication or trying to authenticate with the
7141          * same BSS that we were in the process of authenticating with and avoid
7142          * removal and re-addition of the STA entry in
7143          * ieee80211_prep_connection().
7144          */
7145         cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss &&
7146                     ifmgd->auth_data->link_id == req->link_id;
7147
7148         if (req->ie && req->ie_len) {
7149                 memcpy(&auth_data->data[auth_data->data_len],
7150                        req->ie, req->ie_len);
7151                 auth_data->data_len += req->ie_len;
7152         }
7153
7154         if (req->key && req->key_len) {
7155                 auth_data->key_len = req->key_len;
7156                 auth_data->key_idx = req->key_idx;
7157                 memcpy(auth_data->key, req->key, req->key_len);
7158         }
7159
7160         auth_data->algorithm = auth_alg;
7161
7162         /* try to authenticate/probe */
7163
7164         if (ifmgd->auth_data) {
7165                 if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
7166                         auth_data->peer_confirmed =
7167                                 ifmgd->auth_data->peer_confirmed;
7168                 }
7169                 ieee80211_destroy_auth_data(sdata, cont_auth);
7170         }
7171
7172         /* prep auth_data so we don't go into idle on disassoc */
7173         ifmgd->auth_data = auth_data;
7174
7175         /* If this is continuation of an ongoing SAE authentication exchange
7176          * (i.e., request to send SAE Confirm) and the peer has already
7177          * confirmed, mark authentication completed since we are about to send
7178          * out SAE Confirm.
7179          */
7180         if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
7181             auth_data->peer_confirmed && auth_data->sae_trans == 2)
7182                 ieee80211_mark_sta_auth(sdata);
7183
7184         if (ifmgd->associated) {
7185                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7186
7187                 sdata_info(sdata,
7188                            "disconnect from AP %pM for new auth to %pM\n",
7189                            sdata->vif.cfg.ap_addr, auth_data->ap_addr);
7190                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7191                                        WLAN_REASON_UNSPECIFIED,
7192                                        false, frame_buf);
7193
7194                 ieee80211_report_disconnect(sdata, frame_buf,
7195                                             sizeof(frame_buf), true,
7196                                             WLAN_REASON_UNSPECIFIED,
7197                                             false);
7198         }
7199
7200         sdata_info(sdata, "authenticate with %pM\n", auth_data->ap_addr);
7201
7202         /* needed for transmitting the auth frame(s) properly */
7203         memcpy(sdata->vif.cfg.ap_addr, auth_data->ap_addr, ETH_ALEN);
7204
7205         err = ieee80211_prep_connection(sdata, req->bss, req->link_id,
7206                                         req->ap_mld_addr, cont_auth, false);
7207         if (err)
7208                 goto err_clear;
7209
7210         err = ieee80211_auth(sdata);
7211         if (err) {
7212                 sta_info_destroy_addr(sdata, auth_data->ap_addr);
7213                 goto err_clear;
7214         }
7215
7216         /* hold our own reference */
7217         cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
7218         return 0;
7219
7220  err_clear:
7221         if (!ieee80211_vif_is_mld(&sdata->vif)) {
7222                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
7223                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
7224                                                   BSS_CHANGED_BSSID);
7225                 mutex_lock(&sdata->local->mtx);
7226                 ieee80211_link_release_channel(&sdata->deflink);
7227                 mutex_unlock(&sdata->local->mtx);
7228         }
7229         ifmgd->auth_data = NULL;
7230         kfree(auth_data);
7231         return err;
7232 }
7233
7234 static ieee80211_conn_flags_t
7235 ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
7236                            struct ieee80211_mgd_assoc_data *assoc_data,
7237                            struct cfg80211_assoc_request *req,
7238                            ieee80211_conn_flags_t conn_flags,
7239                            unsigned int link_id)
7240 {
7241         struct ieee80211_local *local = sdata->local;
7242         const struct cfg80211_bss_ies *beacon_ies;
7243         struct ieee80211_supported_band *sband;
7244         const struct element *ht_elem, *vht_elem;
7245         struct ieee80211_link_data *link;
7246         struct cfg80211_bss *cbss;
7247         struct ieee80211_bss *bss;
7248         bool is_5ghz, is_6ghz;
7249
7250         cbss = assoc_data->link[link_id].bss;
7251         if (WARN_ON(!cbss))
7252                 return 0;
7253
7254         bss = (void *)cbss->priv;
7255
7256         sband = local->hw.wiphy->bands[cbss->channel->band];
7257         if (WARN_ON(!sband))
7258                 return 0;
7259
7260         link = sdata_dereference(sdata->link[link_id], sdata);
7261         if (WARN_ON(!link))
7262                 return 0;
7263
7264         is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
7265         is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
7266
7267         /* for MLO connections assume advertising all rates is OK */
7268         if (!req->ap_mld_addr) {
7269                 assoc_data->supp_rates = bss->supp_rates;
7270                 assoc_data->supp_rates_len = bss->supp_rates_len;
7271         }
7272
7273         /* copy and link elems for the STA profile */
7274         if (req->links[link_id].elems_len) {
7275                 memcpy(assoc_data->ie_pos, req->links[link_id].elems,
7276                        req->links[link_id].elems_len);
7277                 assoc_data->link[link_id].elems = assoc_data->ie_pos;
7278                 assoc_data->link[link_id].elems_len = req->links[link_id].elems_len;
7279                 assoc_data->ie_pos += req->links[link_id].elems_len;
7280         }
7281
7282         rcu_read_lock();
7283         ht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_OPERATION);
7284         if (ht_elem && ht_elem->datalen >= sizeof(struct ieee80211_ht_operation))
7285                 assoc_data->link[link_id].ap_ht_param =
7286                         ((struct ieee80211_ht_operation *)(ht_elem->data))->ht_param;
7287         else if (!is_6ghz)
7288                 conn_flags |= IEEE80211_CONN_DISABLE_HT;
7289         vht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
7290         if (vht_elem && vht_elem->datalen >= sizeof(struct ieee80211_vht_cap)) {
7291                 memcpy(&assoc_data->link[link_id].ap_vht_cap, vht_elem->data,
7292                        sizeof(struct ieee80211_vht_cap));
7293         } else if (is_5ghz) {
7294                 link_info(link,
7295                           "VHT capa missing/short, disabling VHT/HE/EHT\n");
7296                 conn_flags |= IEEE80211_CONN_DISABLE_VHT |
7297                               IEEE80211_CONN_DISABLE_HE |
7298                               IEEE80211_CONN_DISABLE_EHT;
7299         }
7300         rcu_read_unlock();
7301
7302         link->u.mgd.beacon_crc_valid = false;
7303         link->u.mgd.dtim_period = 0;
7304         link->u.mgd.have_beacon = false;
7305
7306         /* override HT/VHT configuration only if the AP and we support it */
7307         if (!(conn_flags & IEEE80211_CONN_DISABLE_HT)) {
7308                 struct ieee80211_sta_ht_cap sta_ht_cap;
7309
7310                 memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
7311                 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
7312         }
7313
7314         link->conf->eht_puncturing = 0;
7315
7316         rcu_read_lock();
7317         beacon_ies = rcu_dereference(cbss->beacon_ies);
7318         if (beacon_ies) {
7319                 const struct ieee80211_eht_operation *eht_oper;
7320                 const struct element *elem;
7321                 u8 dtim_count = 0;
7322
7323                 ieee80211_get_dtim(beacon_ies, &dtim_count,
7324                                    &link->u.mgd.dtim_period);
7325
7326                 sdata->deflink.u.mgd.have_beacon = true;
7327
7328                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
7329                         link->conf->sync_tsf = beacon_ies->tsf;
7330                         link->conf->sync_device_ts = bss->device_ts_beacon;
7331                         link->conf->sync_dtim_count = dtim_count;
7332                 }
7333
7334                 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
7335                                               beacon_ies->data, beacon_ies->len);
7336                 if (elem && elem->datalen >= 3)
7337                         link->conf->profile_periodicity = elem->data[2];
7338                 else
7339                         link->conf->profile_periodicity = 0;
7340
7341                 elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
7342                                           beacon_ies->data, beacon_ies->len);
7343                 if (elem && elem->datalen >= 11 &&
7344                     (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
7345                         link->conf->ema_ap = true;
7346                 else
7347                         link->conf->ema_ap = false;
7348
7349                 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION,
7350                                               beacon_ies->data, beacon_ies->len);
7351                 eht_oper = (const void *)(elem->data + 1);
7352
7353                 if (elem &&
7354                     ieee80211_eht_oper_size_ok((const void *)(elem->data + 1),
7355                                                elem->datalen - 1) &&
7356                     (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
7357                     (eht_oper->params & IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
7358                         const struct ieee80211_eht_operation_info *info =
7359                                 (void *)eht_oper->optional;
7360                         const u8 *disable_subchannel_bitmap = info->optional;
7361                         u16 bitmap;
7362
7363                         bitmap = get_unaligned_le16(disable_subchannel_bitmap);
7364                         if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
7365                                                                      &link->conf->chandef))
7366                                 ieee80211_handle_puncturing_bitmap(link,
7367                                                                    eht_oper,
7368                                                                    bitmap,
7369                                                                    NULL);
7370                         else
7371                                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7372                 }
7373         }
7374         rcu_read_unlock();
7375
7376         if (bss->corrupt_data) {
7377                 char *corrupt_type = "data";
7378
7379                 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
7380                         if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
7381                                 corrupt_type = "beacon and probe response";
7382                         else
7383                                 corrupt_type = "beacon";
7384                 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) {
7385                         corrupt_type = "probe response";
7386                 }
7387                 sdata_info(sdata, "associating to AP %pM with corrupt %s\n",
7388                            cbss->bssid, corrupt_type);
7389         }
7390
7391         if (link->u.mgd.req_smps == IEEE80211_SMPS_AUTOMATIC) {
7392                 if (sdata->u.mgd.powersave)
7393                         link->smps_mode = IEEE80211_SMPS_DYNAMIC;
7394                 else
7395                         link->smps_mode = IEEE80211_SMPS_OFF;
7396         } else {
7397                 link->smps_mode = link->u.mgd.req_smps;
7398         }
7399
7400         return conn_flags;
7401 }
7402
7403 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
7404                         struct cfg80211_assoc_request *req)
7405 {
7406         unsigned int assoc_link_id = req->link_id < 0 ? 0 : req->link_id;
7407         struct ieee80211_local *local = sdata->local;
7408         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7409         struct ieee80211_mgd_assoc_data *assoc_data;
7410         const struct element *ssid_elem;
7411         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
7412         ieee80211_conn_flags_t conn_flags = 0;
7413         struct ieee80211_link_data *link;
7414         struct cfg80211_bss *cbss;
7415         struct ieee80211_bss *bss;
7416         bool override;
7417         int i, err;
7418         size_t size = sizeof(*assoc_data) + req->ie_len;
7419
7420         for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++)
7421                 size += req->links[i].elems_len;
7422
7423         /* FIXME: no support for 4-addr MLO yet */
7424         if (sdata->u.mgd.use_4addr && req->link_id >= 0)
7425                 return -EOPNOTSUPP;
7426
7427         assoc_data = kzalloc(size, GFP_KERNEL);
7428         if (!assoc_data)
7429                 return -ENOMEM;
7430
7431         cbss = req->link_id < 0 ? req->bss : req->links[req->link_id].bss;
7432
7433         rcu_read_lock();
7434         ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
7435         if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) {
7436                 rcu_read_unlock();
7437                 kfree(assoc_data);
7438                 return -EINVAL;
7439         }
7440         memcpy(assoc_data->ssid, ssid_elem->data, ssid_elem->datalen);
7441         assoc_data->ssid_len = ssid_elem->datalen;
7442         memcpy(vif_cfg->ssid, assoc_data->ssid, assoc_data->ssid_len);
7443         vif_cfg->ssid_len = assoc_data->ssid_len;
7444         rcu_read_unlock();
7445
7446         if (req->ap_mld_addr) {
7447                 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7448                         if (!req->links[i].bss)
7449                                 continue;
7450                         link = sdata_dereference(sdata->link[i], sdata);
7451                         if (link)
7452                                 ether_addr_copy(assoc_data->link[i].addr,
7453                                                 link->conf->addr);
7454                         else
7455                                 eth_random_addr(assoc_data->link[i].addr);
7456                 }
7457         } else {
7458                 memcpy(assoc_data->link[0].addr, sdata->vif.addr, ETH_ALEN);
7459         }
7460
7461         assoc_data->s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
7462
7463         memcpy(assoc_data->ap_addr,
7464                req->ap_mld_addr ?: req->bss->bssid,
7465                ETH_ALEN);
7466
7467         if (ifmgd->associated) {
7468                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7469
7470                 sdata_info(sdata,
7471                            "disconnect from AP %pM for new assoc to %pM\n",
7472                            sdata->vif.cfg.ap_addr, assoc_data->ap_addr);
7473                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7474                                        WLAN_REASON_UNSPECIFIED,
7475                                        false, frame_buf);
7476
7477                 ieee80211_report_disconnect(sdata, frame_buf,
7478                                             sizeof(frame_buf), true,
7479                                             WLAN_REASON_UNSPECIFIED,
7480                                             false);
7481         }
7482
7483         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
7484                 err = -EBUSY;
7485                 goto err_free;
7486         }
7487
7488         if (ifmgd->assoc_data) {
7489                 err = -EBUSY;
7490                 goto err_free;
7491         }
7492
7493         if (ifmgd->auth_data) {
7494                 bool match;
7495
7496                 /* keep sta info, bssid if matching */
7497                 match = ether_addr_equal(ifmgd->auth_data->ap_addr,
7498                                          assoc_data->ap_addr) &&
7499                         ifmgd->auth_data->link_id == req->link_id;
7500                 ieee80211_destroy_auth_data(sdata, match);
7501         }
7502
7503         /* prepare assoc data */
7504
7505         bss = (void *)cbss->priv;
7506         assoc_data->wmm = bss->wmm_used &&
7507                           (local->hw.queues >= IEEE80211_NUM_ACS);
7508
7509         /*
7510          * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
7511          * We still associate in non-HT mode (11a/b/g) if any one of these
7512          * ciphers is configured as pairwise.
7513          * We can set this to true for non-11n hardware, that'll be checked
7514          * separately along with the peer capabilities.
7515          */
7516         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
7517                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
7518                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
7519                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
7520                         conn_flags |= IEEE80211_CONN_DISABLE_HT;
7521                         conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7522                         conn_flags |= IEEE80211_CONN_DISABLE_HE;
7523                         conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7524                         netdev_info(sdata->dev,
7525                                     "disabling HT/VHT/HE due to WEP/TKIP use\n");
7526                 }
7527         }
7528
7529         /* also disable HT/VHT/HE/EHT if the AP doesn't use WMM */
7530         if (!bss->wmm_used) {
7531                 conn_flags |= IEEE80211_CONN_DISABLE_HT;
7532                 conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7533                 conn_flags |= IEEE80211_CONN_DISABLE_HE;
7534                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7535                 netdev_info(sdata->dev,
7536                             "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
7537         }
7538
7539         if (req->flags & ASSOC_REQ_DISABLE_HT) {
7540                 mlme_dbg(sdata, "HT disabled by flag, disabling HT/VHT/HE\n");
7541                 conn_flags |= IEEE80211_CONN_DISABLE_HT;
7542                 conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7543                 conn_flags |= IEEE80211_CONN_DISABLE_HE;
7544                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7545         }
7546
7547         if (req->flags & ASSOC_REQ_DISABLE_VHT) {
7548                 mlme_dbg(sdata, "VHT disabled by flag, disabling VHT\n");
7549                 conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7550         }
7551
7552         if (req->flags & ASSOC_REQ_DISABLE_HE) {
7553                 mlme_dbg(sdata, "HE disabled by flag, disabling HE/EHT\n");
7554                 conn_flags |= IEEE80211_CONN_DISABLE_HE;
7555                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7556         }
7557
7558         if (req->flags & ASSOC_REQ_DISABLE_EHT)
7559                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7560
7561         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
7562         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
7563                sizeof(ifmgd->ht_capa_mask));
7564
7565         memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
7566         memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
7567                sizeof(ifmgd->vht_capa_mask));
7568
7569         memcpy(&ifmgd->s1g_capa, &req->s1g_capa, sizeof(ifmgd->s1g_capa));
7570         memcpy(&ifmgd->s1g_capa_mask, &req->s1g_capa_mask,
7571                sizeof(ifmgd->s1g_capa_mask));
7572
7573         if (req->ie && req->ie_len) {
7574                 memcpy(assoc_data->ie, req->ie, req->ie_len);
7575                 assoc_data->ie_len = req->ie_len;
7576                 assoc_data->ie_pos = assoc_data->ie + assoc_data->ie_len;
7577         } else {
7578                 assoc_data->ie_pos = assoc_data->ie;
7579         }
7580
7581         if (req->fils_kek) {
7582                 /* should already be checked in cfg80211 - so warn */
7583                 if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
7584                         err = -EINVAL;
7585                         goto err_free;
7586                 }
7587                 memcpy(assoc_data->fils_kek, req->fils_kek,
7588                        req->fils_kek_len);
7589                 assoc_data->fils_kek_len = req->fils_kek_len;
7590         }
7591
7592         if (req->fils_nonces)
7593                 memcpy(assoc_data->fils_nonces, req->fils_nonces,
7594                        2 * FILS_NONCE_LEN);
7595
7596         /* default timeout */
7597         assoc_data->timeout = jiffies;
7598         assoc_data->timeout_started = true;
7599
7600         assoc_data->assoc_link_id = assoc_link_id;
7601
7602         if (req->ap_mld_addr) {
7603                 for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
7604                         assoc_data->link[i].conn_flags = conn_flags;
7605                         assoc_data->link[i].bss = req->links[i].bss;
7606                         assoc_data->link[i].disabled = req->links[i].disabled;
7607                 }
7608
7609                 /* if there was no authentication, set up the link */
7610                 err = ieee80211_vif_set_links(sdata, BIT(assoc_link_id), 0);
7611                 if (err)
7612                         goto err_clear;
7613         } else {
7614                 assoc_data->link[0].conn_flags = conn_flags;
7615                 assoc_data->link[0].bss = cbss;
7616         }
7617
7618         link = sdata_dereference(sdata->link[assoc_link_id], sdata);
7619         if (WARN_ON(!link)) {
7620                 err = -EINVAL;
7621                 goto err_clear;
7622         }
7623
7624         /* keep old conn_flags from ieee80211_prep_channel() from auth */
7625         conn_flags |= link->u.mgd.conn_flags;
7626         conn_flags |= ieee80211_setup_assoc_link(sdata, assoc_data, req,
7627                                                  conn_flags, assoc_link_id);
7628         override = link->u.mgd.conn_flags != conn_flags;
7629         link->u.mgd.conn_flags |= conn_flags;
7630
7631         if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
7632                  ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
7633              "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
7634                 sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
7635
7636         if (bss->wmm_used && bss->uapsd_supported &&
7637             (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
7638                 assoc_data->uapsd = true;
7639                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
7640         } else {
7641                 assoc_data->uapsd = false;
7642                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
7643         }
7644
7645         if (req->prev_bssid)
7646                 memcpy(assoc_data->prev_ap_addr, req->prev_bssid, ETH_ALEN);
7647
7648         if (req->use_mfp) {
7649                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
7650                 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
7651         } else {
7652                 ifmgd->mfp = IEEE80211_MFP_DISABLED;
7653                 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
7654         }
7655
7656         if (req->flags & ASSOC_REQ_USE_RRM)
7657                 ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
7658         else
7659                 ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
7660
7661         if (req->crypto.control_port)
7662                 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
7663         else
7664                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
7665
7666         sdata->control_port_protocol = req->crypto.control_port_ethertype;
7667         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
7668         sdata->control_port_over_nl80211 =
7669                                         req->crypto.control_port_over_nl80211;
7670         sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
7671
7672         /* kick off associate process */
7673         ifmgd->assoc_data = assoc_data;
7674
7675         for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
7676                 if (!assoc_data->link[i].bss)
7677                         continue;
7678                 if (i == assoc_data->assoc_link_id)
7679                         continue;
7680                 /* only calculate the flags, hence link == NULL */
7681                 err = ieee80211_prep_channel(sdata, NULL, assoc_data->link[i].bss,
7682                                              &assoc_data->link[i].conn_flags);
7683                 if (err)
7684                         goto err_clear;
7685         }
7686
7687         /* needed for transmitting the assoc frames properly */
7688         memcpy(sdata->vif.cfg.ap_addr, assoc_data->ap_addr, ETH_ALEN);
7689
7690         err = ieee80211_prep_connection(sdata, cbss, req->link_id,
7691                                         req->ap_mld_addr, true, override);
7692         if (err)
7693                 goto err_clear;
7694
7695         assoc_data->link[assoc_data->assoc_link_id].conn_flags =
7696                 link->u.mgd.conn_flags;
7697
7698         if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC)) {
7699                 const struct cfg80211_bss_ies *beacon_ies;
7700
7701                 rcu_read_lock();
7702                 beacon_ies = rcu_dereference(req->bss->beacon_ies);
7703
7704                 if (beacon_ies) {
7705                         /*
7706                          * Wait up to one beacon interval ...
7707                          * should this be more if we miss one?
7708                          */
7709                         sdata_info(sdata, "waiting for beacon from %pM\n",
7710                                    link->u.mgd.bssid);
7711                         assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
7712                         assoc_data->timeout_started = true;
7713                         assoc_data->need_beacon = true;
7714                 }
7715                 rcu_read_unlock();
7716         }
7717
7718         run_again(sdata, assoc_data->timeout);
7719
7720         return 0;
7721  err_clear:
7722         eth_zero_addr(sdata->deflink.u.mgd.bssid);
7723         ieee80211_link_info_change_notify(sdata, &sdata->deflink,
7724                                           BSS_CHANGED_BSSID);
7725         ifmgd->assoc_data = NULL;
7726  err_free:
7727         kfree(assoc_data);
7728         return err;
7729 }
7730
7731 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
7732                          struct cfg80211_deauth_request *req)
7733 {
7734         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7735         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7736         bool tx = !req->local_state_change;
7737         struct ieee80211_prep_tx_info info = {
7738                 .subtype = IEEE80211_STYPE_DEAUTH,
7739         };
7740
7741         if (ifmgd->auth_data &&
7742             ether_addr_equal(ifmgd->auth_data->ap_addr, req->bssid)) {
7743                 sdata_info(sdata,
7744                            "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
7745                            req->bssid, req->reason_code,
7746                            ieee80211_get_reason_code_string(req->reason_code));
7747
7748                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
7749                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
7750                                                IEEE80211_STYPE_DEAUTH,
7751                                                req->reason_code, tx,
7752                                                frame_buf);
7753                 ieee80211_destroy_auth_data(sdata, false);
7754                 ieee80211_report_disconnect(sdata, frame_buf,
7755                                             sizeof(frame_buf), true,
7756                                             req->reason_code, false);
7757                 drv_mgd_complete_tx(sdata->local, sdata, &info);
7758                 return 0;
7759         }
7760
7761         if (ifmgd->assoc_data &&
7762             ether_addr_equal(ifmgd->assoc_data->ap_addr, req->bssid)) {
7763                 sdata_info(sdata,
7764                            "aborting association with %pM by local choice (Reason: %u=%s)\n",
7765                            req->bssid, req->reason_code,
7766                            ieee80211_get_reason_code_string(req->reason_code));
7767
7768                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
7769                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
7770                                                IEEE80211_STYPE_DEAUTH,
7771                                                req->reason_code, tx,
7772                                                frame_buf);
7773                 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
7774                 ieee80211_report_disconnect(sdata, frame_buf,
7775                                             sizeof(frame_buf), true,
7776                                             req->reason_code, false);
7777                 return 0;
7778         }
7779
7780         if (ifmgd->associated &&
7781             ether_addr_equal(sdata->vif.cfg.ap_addr, req->bssid)) {
7782                 sdata_info(sdata,
7783                            "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
7784                            req->bssid, req->reason_code,
7785                            ieee80211_get_reason_code_string(req->reason_code));
7786
7787                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7788                                        req->reason_code, tx, frame_buf);
7789                 ieee80211_report_disconnect(sdata, frame_buf,
7790                                             sizeof(frame_buf), true,
7791                                             req->reason_code, false);
7792                 drv_mgd_complete_tx(sdata->local, sdata, &info);
7793                 return 0;
7794         }
7795
7796         return -ENOTCONN;
7797 }
7798
7799 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
7800                            struct cfg80211_disassoc_request *req)
7801 {
7802         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7803
7804         if (!sdata->u.mgd.associated ||
7805             memcmp(sdata->vif.cfg.ap_addr, req->ap_addr, ETH_ALEN))
7806                 return -ENOTCONN;
7807
7808         sdata_info(sdata,
7809                    "disassociating from %pM by local choice (Reason: %u=%s)\n",
7810                    req->ap_addr, req->reason_code,
7811                    ieee80211_get_reason_code_string(req->reason_code));
7812
7813         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
7814                                req->reason_code, !req->local_state_change,
7815                                frame_buf);
7816
7817         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
7818                                     req->reason_code, false);
7819
7820         return 0;
7821 }
7822
7823 void ieee80211_mgd_stop_link(struct ieee80211_link_data *link)
7824 {
7825         wiphy_work_cancel(link->sdata->local->hw.wiphy,
7826                           &link->u.mgd.request_smps_work);
7827         wiphy_delayed_work_cancel(link->sdata->local->hw.wiphy,
7828                                   &link->u.mgd.chswitch_work);
7829 }
7830
7831 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
7832 {
7833         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7834
7835         /*
7836          * Make sure some work items will not run after this,
7837          * they will not do anything but might not have been
7838          * cancelled when disconnecting.
7839          */
7840         cancel_work_sync(&ifmgd->monitor_work);
7841         wiphy_work_cancel(sdata->local->hw.wiphy,
7842                           &ifmgd->beacon_connection_loss_work);
7843         wiphy_work_cancel(sdata->local->hw.wiphy,
7844                           &ifmgd->csa_connection_drop_work);
7845         cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
7846         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
7847                                   &ifmgd->ml_reconf_work);
7848
7849         sdata_lock(sdata);
7850         if (ifmgd->assoc_data)
7851                 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
7852         if (ifmgd->auth_data)
7853                 ieee80211_destroy_auth_data(sdata, false);
7854         spin_lock_bh(&ifmgd->teardown_lock);
7855         if (ifmgd->teardown_skb) {
7856                 kfree_skb(ifmgd->teardown_skb);
7857                 ifmgd->teardown_skb = NULL;
7858                 ifmgd->orig_teardown_skb = NULL;
7859         }
7860         kfree(ifmgd->assoc_req_ies);
7861         ifmgd->assoc_req_ies = NULL;
7862         ifmgd->assoc_req_ies_len = 0;
7863         spin_unlock_bh(&ifmgd->teardown_lock);
7864         del_timer_sync(&ifmgd->timer);
7865         sdata_unlock(sdata);
7866 }
7867
7868 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
7869                                enum nl80211_cqm_rssi_threshold_event rssi_event,
7870                                s32 rssi_level,
7871                                gfp_t gfp)
7872 {
7873         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7874
7875         trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
7876
7877         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
7878 }
7879 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
7880
7881 void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
7882 {
7883         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7884
7885         trace_api_cqm_beacon_loss_notify(sdata->local, sdata);
7886
7887         cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
7888 }
7889 EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);
7890
7891 static void _ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data *sdata,
7892                                             int rssi_min_thold,
7893                                             int rssi_max_thold)
7894 {
7895         trace_api_enable_rssi_reports(sdata, rssi_min_thold, rssi_max_thold);
7896
7897         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
7898                 return;
7899
7900         /*
7901          * Scale up threshold values before storing it, as the RSSI averaging
7902          * algorithm uses a scaled up value as well. Change this scaling
7903          * factor if the RSSI averaging algorithm changes.
7904          */
7905         sdata->u.mgd.rssi_min_thold = rssi_min_thold*16;
7906         sdata->u.mgd.rssi_max_thold = rssi_max_thold*16;
7907 }
7908
7909 void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
7910                                     int rssi_min_thold,
7911                                     int rssi_max_thold)
7912 {
7913         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7914
7915         WARN_ON(rssi_min_thold == rssi_max_thold ||
7916                 rssi_min_thold > rssi_max_thold);
7917
7918         _ieee80211_enable_rssi_reports(sdata, rssi_min_thold,
7919                                        rssi_max_thold);
7920 }
7921 EXPORT_SYMBOL(ieee80211_enable_rssi_reports);
7922
7923 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
7924 {
7925         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7926
7927         _ieee80211_enable_rssi_reports(sdata, 0, 0);
7928 }
7929 EXPORT_SYMBOL(ieee80211_disable_rssi_reports);