net/mac80211/mlme.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * BSS client mode implementation
   4  * Copyright 2003-2008, Jouni Malinen <[email protected]>
   5  * Copyright 2004, Instant802 Networks, Inc.
   6  * Copyright 2005, Devicescape Software, Inc.
   7  * Copyright 2006-2007  Jiri Benc <[email protected]>
   8  * Copyright 2007, Michael Wu <[email protected]>
   9  * Copyright 2013-2014  Intel Mobile Communications GmbH
  10  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
  11  * Copyright (C) 2018 - 2023 Intel Corporation
  12  */
  13
  14 #include <linux/delay.h>
  15 #include <linux/fips.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/etherdevice.h>
  20 #include <linux/moduleparam.h>
  21 #include <linux/rtnetlink.h>
  22 #include <linux/crc32.h>
  23 #include <linux/slab.h>
  24 #include <linux/export.h>
  25 #include <net/mac80211.h>
  26 #include <asm/unaligned.h>
  27
  28 #include "ieee80211_i.h"
  29 #include "driver-ops.h"
  30 #include "rate.h"
  31 #include "led.h"
  32 #include "fils_aead.h"
  33
  34 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
  35 #define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
  36 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
  37 #define IEEE80211_AUTH_TIMEOUT_SAE      (HZ * 2)
  38 #define IEEE80211_AUTH_MAX_TRIES        3
  39 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
  40 #define IEEE80211_AUTH_WAIT_SAE_RETRY   (HZ * 2)
  41 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
  42 #define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
  43 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
  44 #define IEEE80211_ASSOC_MAX_TRIES       3
  45
  46 static int max_nullfunc_tries = 2;
  47 module_param(max_nullfunc_tries, int, 0644);
  48 MODULE_PARM_DESC(max_nullfunc_tries,
  49                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
  50
  51 static int max_probe_tries = 5;
  52 module_param(max_probe_tries, int, 0644);
  53 MODULE_PARM_DESC(max_probe_tries,
  54                  "Maximum probe tries before disconnecting (reason 4).");
  55
  56 /*
  57  * Beacon loss timeout is calculated as N frames times the
  58  * advertised beacon interval.  This may need to be somewhat
  59  * higher than what hardware might detect to account for
  60  * delays in the host processing frames. But since we also
  61  * probe on beacon miss before declaring the connection lost
  62  * default to what we want.
  63  */
  64 static int beacon_loss_count = 7;
  65 module_param(beacon_loss_count, int, 0644);
  66 MODULE_PARM_DESC(beacon_loss_count,
  67                  "Number of beacon intervals before we decide beacon was lost.");
  68
  69 /*
  70  * Time the connection can be idle before we probe
  71  * it to see if we can still talk to the AP.
  72  */
  73 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
  74 /*
  75  * Time we wait for a probe response after sending
  76  * a probe request because of beacon loss or for
  77  * checking the connection still works.
  78  */
  79 static int probe_wait_ms = 500;
  80 module_param(probe_wait_ms, int, 0644);
  81 MODULE_PARM_DESC(probe_wait_ms,
  82                  "Maximum time(ms) to wait for probe response"
  83                  " before disconnecting (reason 4).");
  84
  85 /*
  86  * How many Beacon frames need to have been used in average signal strength
  87  * before starting to indicate signal change events.
  88  */
  89 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
  90
  91 /*
  92  * Extract from the given disabled subchannel bitmap (raw format
  93  * from the EHT Operation Element) the bits for the subchannel
  94  * we're using right now.
  95  */
  96 static u16
  97 ieee80211_extract_dis_subch_bmap(const struct ieee80211_eht_operation *eht_oper,
  98                                  struct cfg80211_chan_def *chandef, u16 bitmap)
  99 {
 100         struct ieee80211_eht_operation_info *info = (void *)eht_oper->optional;
 101         struct cfg80211_chan_def ap_chandef = *chandef;
 102         u32 ap_center_freq, local_center_freq;
 103         u32 ap_bw, local_bw;
 104         int ap_start_freq, local_start_freq;
 105         u16 shift, mask;
 106
 107         if (!(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) ||
 108             !(eht_oper->params &
 109               IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT))
 110                 return 0;
 111
 112         /* set 160/320 supported to get the full AP definition */
 113         ieee80211_chandef_eht_oper(eht_oper, true, true, &ap_chandef);
 114         ap_center_freq = ap_chandef.center_freq1;
 115         ap_bw = 20 * BIT(u8_get_bits(info->control,
 116                                      IEEE80211_EHT_OPER_CHAN_WIDTH));
 117         ap_start_freq = ap_center_freq - ap_bw / 2;
 118         local_center_freq = chandef->center_freq1;
 119         local_bw = 20 * BIT(ieee80211_chan_width_to_rx_bw(chandef->width));
 120         local_start_freq = local_center_freq - local_bw / 2;
 121         shift = (local_start_freq - ap_start_freq) / 20;
 122         mask = BIT(local_bw / 20) - 1;
 123
 124         return (bitmap >> shift) & mask;
 125 }
 126
 127 /*
 128  * Handle the puncturing bitmap, possibly downgrading bandwidth to get a
 129  * valid bitmap.
 130  */
 131 static void
 132 ieee80211_handle_puncturing_bitmap(struct ieee80211_link_data *link,
 133                                    const struct ieee80211_eht_operation *eht_oper,
 134                                    u16 bitmap, u64 *changed)
 135 {
 136         struct cfg80211_chan_def *chandef = &link->conf->chandef;
 137         u16 extracted;
 138         u64 _changed = 0;
 139
 140         if (!changed)
 141                 changed = &_changed;
 142
 143         while (chandef->width > NL80211_CHAN_WIDTH_40) {
 144                 extracted =
 145                         ieee80211_extract_dis_subch_bmap(eht_oper, chandef,
 146                                                          bitmap);
 147
 148                 if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
 149                                                              chandef))
 150                         break;
 151                 link->u.mgd.conn_flags |=
 152                         ieee80211_chandef_downgrade(chandef);
 153                 *changed |= BSS_CHANGED_BANDWIDTH;
 154         }
 155
 156         if (chandef->width <= NL80211_CHAN_WIDTH_40)
 157                 extracted = 0;
 158
 159         if (link->conf->eht_puncturing != extracted) {
 160                 link->conf->eht_puncturing = extracted;
 161                 *changed |= BSS_CHANGED_EHT_PUNCTURING;
 162         }
 163 }
 164
 165 /*
 166  * We can have multiple work items (and connection probing)
 167  * scheduling this timer, but we need to take care to only
 168  * reschedule it when it should fire _earlier_ than it was
 169  * asked for before, or if it's not pending right now. This
 170  * function ensures that. Note that it then is required to
 171  * run this function for all timeouts after the first one
 172  * has happened -- the work that runs from this timer will
 173  * do that.
 174  */
 175 static void run_again(struct ieee80211_sub_if_data *sdata,
 176                       unsigned long timeout)
 177 {
 178         sdata_assert_lock(sdata);
 179
 180         if (!timer_pending(&sdata->u.mgd.timer) ||
 181             time_before(timeout, sdata->u.mgd.timer.expires))
 182                 mod_timer(&sdata->u.mgd.timer, timeout);
 183 }
 184
 185 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 186 {
 187         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
 188                 return;
 189
 190         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 191                 return;
 192
 193         mod_timer(&sdata->u.mgd.bcn_mon_timer,
 194                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 195 }
 196
 197 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 198 {
 199         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 200
 201         if (unlikely(!ifmgd->associated))
 202                 return;
 203
 204         if (ifmgd->probe_send_count)
 205                 ifmgd->probe_send_count = 0;
 206
 207         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 208                 return;
 209
 210         mod_timer(&ifmgd->conn_mon_timer,
 211                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 212 }
 213
 214 static int ecw2cw(int ecw)
 215 {
 216         return (1 << ecw) - 1;
 217 }
 218
 219 static ieee80211_conn_flags_t
 220 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 221                              struct ieee80211_link_data *link,
 222                              ieee80211_conn_flags_t conn_flags,
 223                              struct ieee80211_supported_band *sband,
 224                              struct ieee80211_channel *channel,
 225                              u32 vht_cap_info,
 226                              const struct ieee80211_ht_operation *ht_oper,
 227                              const struct ieee80211_vht_operation *vht_oper,
 228                              const struct ieee80211_he_operation *he_oper,
 229                              const struct ieee80211_eht_operation *eht_oper,
 230                              const struct ieee80211_s1g_oper_ie *s1g_oper,
 231                              struct cfg80211_chan_def *chandef, bool tracking)
 232 {
 233         struct cfg80211_chan_def vht_chandef;
 234         struct ieee80211_sta_ht_cap sta_ht_cap;
 235         ieee80211_conn_flags_t ret;
 236         u32 ht_cfreq;
 237
 238         memset(chandef, 0, sizeof(struct cfg80211_chan_def));
 239         chandef->chan = channel;
 240         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
 241         chandef->center_freq1 = channel->center_freq;
 242         chandef->freq1_offset = channel->freq_offset;
 243
 244         if (channel->band == NL80211_BAND_6GHZ) {
 245                 if (!ieee80211_chandef_he_6ghz_oper(sdata, he_oper, eht_oper,
 246                                                     chandef)) {
 247                         mlme_dbg(sdata,
 248                                  "bad 6 GHz operation, disabling HT/VHT/HE/EHT\n");
 249                         ret = IEEE80211_CONN_DISABLE_HT |
 250                               IEEE80211_CONN_DISABLE_VHT |
 251                               IEEE80211_CONN_DISABLE_HE |
 252                               IEEE80211_CONN_DISABLE_EHT;
 253                 } else {
 254                         ret = 0;
 255                 }
 256                 vht_chandef = *chandef;
 257                 goto out;
 258         } else if (sband->band == NL80211_BAND_S1GHZ) {
 259                 if (!ieee80211_chandef_s1g_oper(s1g_oper, chandef)) {
 260                         sdata_info(sdata,
 261                                    "Missing S1G Operation Element? Trying operating == primary\n");
 262                         chandef->width = ieee80211_s1g_channel_width(channel);
 263                 }
 264
 265                 ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_40MHZ |
 266                       IEEE80211_CONN_DISABLE_VHT |
 267                       IEEE80211_CONN_DISABLE_80P80MHZ |
 268                       IEEE80211_CONN_DISABLE_160MHZ;
 269                 goto out;
 270         }
 271
 272         memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
 273         ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
 274
 275         if (!ht_oper || !sta_ht_cap.ht_supported) {
 276                 mlme_dbg(sdata, "HT operation missing / HT not supported\n");
 277                 ret = IEEE80211_CONN_DISABLE_HT |
 278                       IEEE80211_CONN_DISABLE_VHT |
 279                       IEEE80211_CONN_DISABLE_HE |
 280                       IEEE80211_CONN_DISABLE_EHT;
 281                 goto out;
 282         }
 283
 284         chandef->width = NL80211_CHAN_WIDTH_20;
 285
 286         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
 287                                                   channel->band);
 288         /* check that channel matches the right operating channel */
 289         if (!tracking && channel->center_freq != ht_cfreq) {
 290                 /*
 291                  * It's possible that some APs are confused here;
 292                  * Netgear WNDR3700 sometimes reports 4 higher than
 293                  * the actual channel in association responses, but
 294                  * since we look at probe response/beacon data here
 295                  * it should be OK.
 296                  */
 297                 sdata_info(sdata,
 298                            "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
 299                            channel->center_freq, ht_cfreq,
 300                            ht_oper->primary_chan, channel->band);
 301                 ret = IEEE80211_CONN_DISABLE_HT |
 302                       IEEE80211_CONN_DISABLE_VHT |
 303                       IEEE80211_CONN_DISABLE_HE |
 304                       IEEE80211_CONN_DISABLE_EHT;
 305                 goto out;
 306         }
 307
 308         /* check 40 MHz support, if we have it */
 309         if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
 310                 ieee80211_chandef_ht_oper(ht_oper, chandef);
 311         } else {
 312                 mlme_dbg(sdata, "40 MHz not supported\n");
 313                 /* 40 MHz (and 80 MHz) must be supported for VHT */
 314                 ret = IEEE80211_CONN_DISABLE_VHT;
 315                 /* also mark 40 MHz disabled */
 316                 ret |= IEEE80211_CONN_DISABLE_40MHZ;
 317                 goto out;
 318         }
 319
 320         if (!vht_oper || !sband->vht_cap.vht_supported) {
 321                 mlme_dbg(sdata, "VHT operation missing / VHT not supported\n");
 322                 ret = IEEE80211_CONN_DISABLE_VHT;
 323                 goto out;
 324         }
 325
 326         vht_chandef = *chandef;
 327         if (!(conn_flags & IEEE80211_CONN_DISABLE_HE) &&
 328             he_oper &&
 329             (le32_to_cpu(he_oper->he_oper_params) &
 330              IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
 331                 struct ieee80211_vht_operation he_oper_vht_cap;
 332
 333                 /*
 334                  * Set only first 3 bytes (other 2 aren't used in
 335                  * ieee80211_chandef_vht_oper() anyway)
 336                  */
 337                 memcpy(&he_oper_vht_cap, he_oper->optional, 3);
 338                 he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);
 339
 340                 if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
 341                                                 &he_oper_vht_cap, ht_oper,
 342                                                 &vht_chandef)) {
 343                         if (!(conn_flags & IEEE80211_CONN_DISABLE_HE))
 344                                 sdata_info(sdata,
 345                                            "HE AP VHT information is invalid, disabling HE\n");
 346                         ret = IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
 347                         goto out;
 348                 }
 349         } else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
 350                                                vht_cap_info,
 351                                                vht_oper, ht_oper,
 352                                                &vht_chandef)) {
 353                 if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
 354                         sdata_info(sdata,
 355                                    "AP VHT information is invalid, disabling VHT\n");
 356                 ret = IEEE80211_CONN_DISABLE_VHT;
 357                 goto out;
 358         }
 359
 360         if (!cfg80211_chandef_valid(&vht_chandef)) {
 361                 if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
 362                         sdata_info(sdata,
 363                                    "AP VHT information is invalid, disabling VHT\n");
 364                 ret = IEEE80211_CONN_DISABLE_VHT;
 365                 goto out;
 366         }
 367
 368         if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
 369                 ret = 0;
 370                 goto out;
 371         }
 372
 373         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
 374                 if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
 375                         sdata_info(sdata,
 376                                    "AP VHT information doesn't match HT, disabling VHT\n");
 377                 ret = IEEE80211_CONN_DISABLE_VHT;
 378                 goto out;
 379         }
 380
 381         *chandef = vht_chandef;
 382
 383         /*
 384          * handle the case that the EHT operation indicates that it holds EHT
 385          * operation information (in case that the channel width differs from
 386          * the channel width reported in HT/VHT/HE).
 387          */
 388         if (eht_oper && (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT)) {
 389                 struct cfg80211_chan_def eht_chandef = *chandef;
 390
 391                 ieee80211_chandef_eht_oper(eht_oper,
 392                                            eht_chandef.width ==
 393                                            NL80211_CHAN_WIDTH_160,
 394                                            false, &eht_chandef);
 395
 396                 if (!cfg80211_chandef_valid(&eht_chandef)) {
 397                         if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
 398                                 sdata_info(sdata,
 399                                            "AP EHT information is invalid, disabling EHT\n");
 400                         ret = IEEE80211_CONN_DISABLE_EHT;
 401                         goto out;
 402                 }
 403
 404                 if (!cfg80211_chandef_compatible(chandef, &eht_chandef)) {
 405                         if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
 406                                 sdata_info(sdata,
 407                                            "AP EHT information is incompatible, disabling EHT\n");
 408                         ret = IEEE80211_CONN_DISABLE_EHT;
 409                         goto out;
 410                 }
 411
 412                 *chandef = eht_chandef;
 413         }
 414
 415         ret = 0;
 416
 417 out:
 418         /*
 419          * When tracking the current AP, don't do any further checks if the
 420          * new chandef is identical to the one we're currently using for the
 421          * connection. This keeps us from playing ping-pong with regulatory,
 422          * without it the following can happen (for example):
 423          *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
 424          *  - AP advertises regdom US
 425          *  - CRDA loads regdom US with 80 MHz prohibited (old database)
 426          *  - the code below detects an unsupported channel, downgrades, and
 427          *    we disconnect from the AP in the caller
 428          *  - disconnect causes CRDA to reload world regdomain and the game
 429          *    starts anew.
 430          * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
 431          *
 432          * It seems possible that there are still scenarios with CSA or real
 433          * bandwidth changes where a this could happen, but those cases are
 434          * less common and wouldn't completely prevent using the AP.
 435          */
 436         if (tracking &&
 437             cfg80211_chandef_identical(chandef, &link->conf->chandef))
 438                 return ret;
 439
 440         /* don't print the message below for VHT mismatch if VHT is disabled */
 441         if (ret & IEEE80211_CONN_DISABLE_VHT)
 442                 vht_chandef = *chandef;
 443
 444         /*
 445          * Ignore the DISABLED flag when we're already connected and only
 446          * tracking the APs beacon for bandwidth changes - otherwise we
 447          * might get disconnected here if we connect to an AP, update our
 448          * regulatory information based on the AP's country IE and the
 449          * information we have is wrong/outdated and disables the channel
 450          * that we're actually using for the connection to the AP.
 451          */
 452         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
 453                                         tracking ? 0 :
 454                                                    IEEE80211_CHAN_DISABLED)) {
 455                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
 456                         ret = IEEE80211_CONN_DISABLE_HT |
 457                               IEEE80211_CONN_DISABLE_VHT |
 458                               IEEE80211_CONN_DISABLE_HE |
 459                               IEEE80211_CONN_DISABLE_EHT;
 460                         break;
 461                 }
 462
 463                 ret |= ieee80211_chandef_downgrade(chandef);
 464         }
 465
 466         if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
 467                                                  IEEE80211_CHAN_NO_HE))
 468                 ret |= IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
 469
 470         if (!eht_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
 471                                                   IEEE80211_CHAN_NO_EHT))
 472                 ret |= IEEE80211_CONN_DISABLE_EHT;
 473
 474         if (chandef->width != vht_chandef.width && !tracking)
 475                 sdata_info(sdata,
 476                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 477
 478         WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
 479         return ret;
 480 }
 481
 482 static int ieee80211_config_bw(struct ieee80211_link_data *link,
 483                                const struct ieee80211_ht_cap *ht_cap,
 484                                const struct ieee80211_vht_cap *vht_cap,
 485                                const struct ieee80211_ht_operation *ht_oper,
 486                                const struct ieee80211_vht_operation *vht_oper,
 487                                const struct ieee80211_he_operation *he_oper,
 488                                const struct ieee80211_eht_operation *eht_oper,
 489                                const struct ieee80211_s1g_oper_ie *s1g_oper,
 490                                const u8 *bssid, u64 *changed)
 491 {
 492         struct ieee80211_sub_if_data *sdata = link->sdata;
 493         struct ieee80211_local *local = sdata->local;
 494         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 495         struct ieee80211_channel *chan = link->conf->chandef.chan;
 496         struct ieee80211_supported_band *sband =
 497                 local->hw.wiphy->bands[chan->band];
 498         struct cfg80211_chan_def chandef;
 499         u16 ht_opmode;
 500         ieee80211_conn_flags_t flags;
 501         u32 vht_cap_info = 0;
 502         int ret;
 503
 504         /* if HT was/is disabled, don't track any bandwidth changes */
 505         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT || !ht_oper)
 506                 return 0;
 507
 508         /* don't check VHT if we associated as non-VHT station */
 509         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
 510                 vht_oper = NULL;
 511
 512         /* don't check HE if we associated as non-HE station */
 513         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE ||
 514             !ieee80211_get_he_iftype_cap(sband,
 515                                          ieee80211_vif_type_p2p(&sdata->vif))) {
 516                 he_oper = NULL;
 517                 eht_oper = NULL;
 518         }
 519
 520         /* don't check EHT if we associated as non-EHT station */
 521         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT ||
 522             !ieee80211_get_eht_iftype_cap(sband,
 523                                          ieee80211_vif_type_p2p(&sdata->vif)))
 524                 eht_oper = NULL;
 525
 526         /*
 527          * if bss configuration changed store the new one -
 528          * this may be applicable even if channel is identical
 529          */
 530         ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 531         if (link->conf->ht_operation_mode != ht_opmode) {
 532                 *changed |= BSS_CHANGED_HT;
 533                 link->conf->ht_operation_mode = ht_opmode;
 534         }
 535
 536         if (vht_cap)
 537                 vht_cap_info = le32_to_cpu(vht_cap->vht_cap_info);
 538
 539         /* calculate new channel (type) based on HT/VHT/HE operation IEs */
 540         flags = ieee80211_determine_chantype(sdata, link,
 541                                              link->u.mgd.conn_flags,
 542                                              sband, chan, vht_cap_info,
 543                                              ht_oper, vht_oper,
 544                                              he_oper, eht_oper,
 545                                              s1g_oper, &chandef, true);
 546
 547         /*
 548          * Downgrade the new channel if we associated with restricted
 549          * capabilities. For example, if we associated as a 20 MHz STA
 550          * to a 40 MHz AP (due to regulatory, capabilities or config
 551          * reasons) then switching to a 40 MHz channel now won't do us
 552          * any good -- we couldn't use it with the AP.
 553          */
 554         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ &&
 555             chandef.width == NL80211_CHAN_WIDTH_80P80)
 556                 flags |= ieee80211_chandef_downgrade(&chandef);
 557         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_160MHZ &&
 558             chandef.width == NL80211_CHAN_WIDTH_160)
 559                 flags |= ieee80211_chandef_downgrade(&chandef);
 560         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_40MHZ &&
 561             chandef.width > NL80211_CHAN_WIDTH_20)
 562                 flags |= ieee80211_chandef_downgrade(&chandef);
 563
 564         if (cfg80211_chandef_identical(&chandef, &link->conf->chandef))
 565                 return 0;
 566
 567         link_info(link,
 568                   "AP %pM changed bandwidth, new config is %d.%03d MHz, width %d (%d.%03d/%d MHz)\n",
 569                   link->u.mgd.bssid, chandef.chan->center_freq,
 570                   chandef.chan->freq_offset, chandef.width,
 571                   chandef.center_freq1, chandef.freq1_offset,
 572                   chandef.center_freq2);
 573
 574         if (flags != (link->u.mgd.conn_flags &
 575                                 (IEEE80211_CONN_DISABLE_HT |
 576                                  IEEE80211_CONN_DISABLE_VHT |
 577                                  IEEE80211_CONN_DISABLE_HE |
 578                                  IEEE80211_CONN_DISABLE_EHT |
 579                                  IEEE80211_CONN_DISABLE_40MHZ |
 580                                  IEEE80211_CONN_DISABLE_80P80MHZ |
 581                                  IEEE80211_CONN_DISABLE_160MHZ |
 582                                  IEEE80211_CONN_DISABLE_320MHZ)) ||
 583             !cfg80211_chandef_valid(&chandef)) {
 584                 sdata_info(sdata,
 585                            "AP %pM changed caps/bw in a way we can't support (0x%x/0x%x) - disconnect\n",
 586                            link->u.mgd.bssid, flags, ifmgd->flags);
 587                 return -EINVAL;
 588         }
 589
 590         ret = ieee80211_link_change_bandwidth(link, &chandef, changed);
 591
 592         if (ret) {
 593                 sdata_info(sdata,
 594                            "AP %pM changed bandwidth to incompatible one - disconnect\n",
 595                            link->u.mgd.bssid);
 596                 return ret;
 597         }
 598
 599         return 0;
 600 }
 601
 602 /* frame sending functions */
 603
 604 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 605                                 struct sk_buff *skb, u8 ap_ht_param,
 606                                 struct ieee80211_supported_band *sband,
 607                                 struct ieee80211_channel *channel,
 608                                 enum ieee80211_smps_mode smps,
 609                                 ieee80211_conn_flags_t conn_flags)
 610 {
 611         u8 *pos;
 612         u32 flags = channel->flags;
 613         u16 cap;
 614         struct ieee80211_sta_ht_cap ht_cap;
 615
 616         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 617
 618         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
 619         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 620
 621         /* determine capability flags */
 622         cap = ht_cap.cap;
 623
 624         switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 625         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 626                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
 627                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 628                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 629                 }
 630                 break;
 631         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 632                 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
 633                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 634                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 635                 }
 636                 break;
 637         }
 638
 639         /*
 640          * If 40 MHz was disabled associate as though we weren't
 641          * capable of 40 MHz -- some broken APs will never fall
 642          * back to trying to transmit in 20 MHz.
 643          */
 644         if (conn_flags & IEEE80211_CONN_DISABLE_40MHZ) {
 645                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 646                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 647         }
 648
 649         /* set SM PS mode properly */
 650         cap &= ~IEEE80211_HT_CAP_SM_PS;
 651         switch (smps) {
 652         case IEEE80211_SMPS_AUTOMATIC:
 653         case IEEE80211_SMPS_NUM_MODES:
 654                 WARN_ON(1);
 655                 fallthrough;
 656         case IEEE80211_SMPS_OFF:
 657                 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
 658                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 659                 break;
 660         case IEEE80211_SMPS_STATIC:
 661                 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
 662                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 663                 break;
 664         case IEEE80211_SMPS_DYNAMIC:
 665                 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
 666                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 667                 break;
 668         }
 669
 670         /* reserve and fill IE */
 671         pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
 672         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 673 }
 674
 675 /* This function determines vht capability flags for the association
 676  * and builds the IE.
 677  * Note - the function returns true to own the MU-MIMO capability
 678  */
 679 static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
 680                                  struct sk_buff *skb,
 681                                  struct ieee80211_supported_band *sband,
 682                                  struct ieee80211_vht_cap *ap_vht_cap,
 683                                  ieee80211_conn_flags_t conn_flags)
 684 {
 685         struct ieee80211_local *local = sdata->local;
 686         u8 *pos;
 687         u32 cap;
 688         struct ieee80211_sta_vht_cap vht_cap;
 689         u32 mask, ap_bf_sts, our_bf_sts;
 690         bool mu_mimo_owner = false;
 691
 692         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 693
 694         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
 695         ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
 696
 697         /* determine capability flags */
 698         cap = vht_cap.cap;
 699
 700         if (conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ) {
 701                 u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 702
 703                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 704                 if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
 705                     bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
 706                         cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
 707         }
 708
 709         if (conn_flags & IEEE80211_CONN_DISABLE_160MHZ) {
 710                 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
 711                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 712         }
 713
 714         /*
 715          * Some APs apparently get confused if our capabilities are better
 716          * than theirs, so restrict what we advertise in the assoc request.
 717          */
 718         if (!(ap_vht_cap->vht_cap_info &
 719                         cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
 720                 cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
 721                          IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 722         else if (!(ap_vht_cap->vht_cap_info &
 723                         cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
 724                 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 725
 726         /*
 727          * If some other vif is using the MU-MIMO capability we cannot associate
 728          * using MU-MIMO - this will lead to contradictions in the group-id
 729          * mechanism.
 730          * Ownership is defined since association request, in order to avoid
 731          * simultaneous associations with MU-MIMO.
 732          */
 733         if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
 734                 bool disable_mu_mimo = false;
 735                 struct ieee80211_sub_if_data *other;
 736
 737                 list_for_each_entry_rcu(other, &local->interfaces, list) {
 738                         if (other->vif.bss_conf.mu_mimo_owner) {
 739                                 disable_mu_mimo = true;
 740                                 break;
 741                         }
 742                 }
 743                 if (disable_mu_mimo)
 744                         cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 745                 else
 746                         mu_mimo_owner = true;
 747         }
 748
 749         mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
 750
 751         ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
 752         our_bf_sts = cap & mask;
 753
 754         if (ap_bf_sts < our_bf_sts) {
 755                 cap &= ~mask;
 756                 cap |= ap_bf_sts;
 757         }
 758
 759         /* reserve and fill IE */
 760         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
 761         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
 762
 763         return mu_mimo_owner;
 764 }
 765
 766 /* This function determines HE capability flags for the association
 767  * and builds the IE.
 768  */
 769 static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
 770                                 struct sk_buff *skb,
 771                                 struct ieee80211_supported_band *sband,
 772                                 enum ieee80211_smps_mode smps_mode,
 773                                 ieee80211_conn_flags_t conn_flags)
 774 {
 775         u8 *pos, *pre_he_pos;
 776         const struct ieee80211_sta_he_cap *he_cap;
 777         u8 he_cap_size;
 778
 779         he_cap = ieee80211_get_he_iftype_cap(sband,
 780                                              ieee80211_vif_type_p2p(&sdata->vif));
 781         if (WARN_ON(!he_cap))
 782                 return;
 783
 784         /* get a max size estimate */
 785         he_cap_size =
 786                 2 + 1 + sizeof(he_cap->he_cap_elem) +
 787                 ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
 788                 ieee80211_he_ppe_size(he_cap->ppe_thres[0],
 789                                       he_cap->he_cap_elem.phy_cap_info);
 790         pos = skb_put(skb, he_cap_size);
 791         pre_he_pos = pos;
 792         pos = ieee80211_ie_build_he_cap(conn_flags,
 793                                         pos, he_cap, pos + he_cap_size);
 794         /* trim excess if any */
 795         skb_trim(skb, skb->len - (pre_he_pos + he_cap_size - pos));
 796
 797         ieee80211_ie_build_he_6ghz_cap(sdata, smps_mode, skb);
 798 }
 799
 800 static void ieee80211_add_eht_ie(struct ieee80211_sub_if_data *sdata,
 801                                  struct sk_buff *skb,
 802                                  struct ieee80211_supported_band *sband)
 803 {
 804         u8 *pos;
 805         const struct ieee80211_sta_he_cap *he_cap;
 806         const struct ieee80211_sta_eht_cap *eht_cap;
 807         u8 eht_cap_size;
 808
 809         he_cap = ieee80211_get_he_iftype_cap(sband,
 810                                              ieee80211_vif_type_p2p(&sdata->vif));
 811         eht_cap = ieee80211_get_eht_iftype_cap(sband,
 812                                                ieee80211_vif_type_p2p(&sdata->vif));
 813
 814         /*
 815          * EHT capabilities element is only added if the HE capabilities element
 816          * was added so assume that 'he_cap' is valid and don't check it.
 817          */
 818         if (WARN_ON(!he_cap || !eht_cap))
 819                 return;
 820
 821         eht_cap_size =
 822                 2 + 1 + sizeof(eht_cap->eht_cap_elem) +
 823                 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
 824                                            &eht_cap->eht_cap_elem,
 825                                            false) +
 826                 ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0],
 827                                        eht_cap->eht_cap_elem.phy_cap_info);
 828         pos = skb_put(skb, eht_cap_size);
 829         ieee80211_ie_build_eht_cap(pos, he_cap, eht_cap, pos + eht_cap_size,
 830                                    false);
 831 }
 832
 833 static void ieee80211_assoc_add_rates(struct sk_buff *skb,
 834                                       enum nl80211_chan_width width,
 835                                       struct ieee80211_supported_band *sband,
 836                                       struct ieee80211_mgd_assoc_data *assoc_data)
 837 {
 838         unsigned int shift = ieee80211_chanwidth_get_shift(width);
 839         unsigned int rates_len, supp_rates_len;
 840         u32 rates = 0;
 841         int i, count;
 842         u8 *pos;
 843
 844         if (assoc_data->supp_rates_len) {
 845                 /*
 846                  * Get all rates supported by the device and the AP as
 847                  * some APs don't like getting a superset of their rates
 848                  * in the association request (e.g. D-Link DAP 1353 in
 849                  * b-only mode)...
 850                  */
 851                 rates_len = ieee80211_parse_bitrates(width, sband,
 852                                                      assoc_data->supp_rates,
 853                                                      assoc_data->supp_rates_len,
 854                                                      &rates);
 855         } else {
 856                 /*
 857                  * In case AP not provide any supported rates information
 858                  * before association, we send information element(s) with
 859                  * all rates that we support.
 860                  */
 861                 rates_len = sband->n_bitrates;
 862                 for (i = 0; i < sband->n_bitrates; i++)
 863                         rates |= BIT(i);
 864         }
 865
 866         supp_rates_len = rates_len;
 867         if (supp_rates_len > 8)
 868                 supp_rates_len = 8;
 869
 870         pos = skb_put(skb, supp_rates_len + 2);
 871         *pos++ = WLAN_EID_SUPP_RATES;
 872         *pos++ = supp_rates_len;
 873
 874         count = 0;
 875         for (i = 0; i < sband->n_bitrates; i++) {
 876                 if (BIT(i) & rates) {
 877                         int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 878                                                 5 * (1 << shift));
 879                         *pos++ = (u8)rate;
 880                         if (++count == 8)
 881                                 break;
 882                 }
 883         }
 884
 885         if (rates_len > count) {
 886                 pos = skb_put(skb, rates_len - count + 2);
 887                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 888                 *pos++ = rates_len - count;
 889
 890                 for (i++; i < sband->n_bitrates; i++) {
 891                         if (BIT(i) & rates) {
 892                                 int rate;
 893
 894                                 rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 895                                                     5 * (1 << shift));
 896                                 *pos++ = (u8)rate;
 897                         }
 898                 }
 899         }
 900 }
 901
 902 static size_t ieee80211_add_before_ht_elems(struct sk_buff *skb,
 903                                             const u8 *elems,
 904                                             size_t elems_len,
 905                                             size_t offset)
 906 {
 907         size_t noffset;
 908
 909         static const u8 before_ht[] = {
 910                 WLAN_EID_SSID,
 911                 WLAN_EID_SUPP_RATES,
 912                 WLAN_EID_EXT_SUPP_RATES,
 913                 WLAN_EID_PWR_CAPABILITY,
 914                 WLAN_EID_SUPPORTED_CHANNELS,
 915                 WLAN_EID_RSN,
 916                 WLAN_EID_QOS_CAPA,
 917                 WLAN_EID_RRM_ENABLED_CAPABILITIES,
 918                 WLAN_EID_MOBILITY_DOMAIN,
 919                 WLAN_EID_FAST_BSS_TRANSITION,   /* reassoc only */
 920                 WLAN_EID_RIC_DATA,              /* reassoc only */
 921                 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 922         };
 923         static const u8 after_ric[] = {
 924                 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 925                 WLAN_EID_HT_CAPABILITY,
 926                 WLAN_EID_BSS_COEX_2040,
 927                 /* luckily this is almost always there */
 928                 WLAN_EID_EXT_CAPABILITY,
 929                 WLAN_EID_QOS_TRAFFIC_CAPA,
 930                 WLAN_EID_TIM_BCAST_REQ,
 931                 WLAN_EID_INTERWORKING,
 932                 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
 933                 WLAN_EID_VHT_CAPABILITY,
 934                 WLAN_EID_OPMODE_NOTIF,
 935         };
 936
 937         if (!elems_len)
 938                 return offset;
 939
 940         noffset = ieee80211_ie_split_ric(elems, elems_len,
 941                                          before_ht,
 942                                          ARRAY_SIZE(before_ht),
 943                                          after_ric,
 944                                          ARRAY_SIZE(after_ric),
 945                                          offset);
 946         skb_put_data(skb, elems + offset, noffset - offset);
 947
 948         return noffset;
 949 }
 950
 951 static size_t ieee80211_add_before_vht_elems(struct sk_buff *skb,
 952                                              const u8 *elems,
 953                                              size_t elems_len,
 954                                              size_t offset)
 955 {
 956         static const u8 before_vht[] = {
 957                 /*
 958                  * no need to list the ones split off before HT
 959                  * or generated here
 960                  */
 961                 WLAN_EID_BSS_COEX_2040,
 962                 WLAN_EID_EXT_CAPABILITY,
 963                 WLAN_EID_QOS_TRAFFIC_CAPA,
 964                 WLAN_EID_TIM_BCAST_REQ,
 965                 WLAN_EID_INTERWORKING,
 966                 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
 967         };
 968         size_t noffset;
 969
 970         if (!elems_len)
 971                 return offset;
 972
 973         /* RIC already taken care of in ieee80211_add_before_ht_elems() */
 974         noffset = ieee80211_ie_split(elems, elems_len,
 975                                      before_vht, ARRAY_SIZE(before_vht),
 976                                      offset);
 977         skb_put_data(skb, elems + offset, noffset - offset);
 978
 979         return noffset;
 980 }
 981
 982 static size_t ieee80211_add_before_he_elems(struct sk_buff *skb,
 983                                             const u8 *elems,
 984                                             size_t elems_len,
 985                                             size_t offset)
 986 {
 987         static const u8 before_he[] = {
 988                 /*
 989                  * no need to list the ones split off before VHT
 990                  * or generated here
 991                  */
 992                 WLAN_EID_OPMODE_NOTIF,
 993                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
 994                 /* 11ai elements */
 995                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
 996                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
 997                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
 998                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
 999                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
1000                 /* TODO: add 11ah/11aj/11ak elements */
1001         };
1002         size_t noffset;
1003
1004         if (!elems_len)
1005                 return offset;
1006
1007         /* RIC already taken care of in ieee80211_add_before_ht_elems() */
1008         noffset = ieee80211_ie_split(elems, elems_len,
1009                                      before_he, ARRAY_SIZE(before_he),
1010                                      offset);
1011         skb_put_data(skb, elems + offset, noffset - offset);
1012
1013         return noffset;
1014 }
1015
1016 #define PRESENT_ELEMS_MAX       8
1017 #define PRESENT_ELEM_EXT_OFFS   0x100
1018
1019 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1020                                         struct sk_buff *skb, u16 capab,
1021                                         const struct element *ext_capa,
1022                                         const u16 *present_elems);
1023
1024 static size_t ieee80211_assoc_link_elems(struct ieee80211_sub_if_data *sdata,
1025                                          struct sk_buff *skb, u16 *capab,
1026                                          const struct element *ext_capa,
1027                                          const u8 *extra_elems,
1028                                          size_t extra_elems_len,
1029                                          unsigned int link_id,
1030                                          struct ieee80211_link_data *link,
1031                                          u16 *present_elems)
1032 {
1033         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1034         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1035         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1036         struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1037         struct ieee80211_channel *chan = cbss->channel;
1038         const struct ieee80211_sband_iftype_data *iftd;
1039         struct ieee80211_local *local = sdata->local;
1040         struct ieee80211_supported_band *sband;
1041         enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20;
1042         struct ieee80211_chanctx_conf *chanctx_conf;
1043         enum ieee80211_smps_mode smps_mode;
1044         u16 orig_capab = *capab;
1045         size_t offset = 0;
1046         int present_elems_len = 0;
1047         u8 *pos;
1048         int i;
1049
1050 #define ADD_PRESENT_ELEM(id) do {                                       \
1051         /* need a last for termination - we use 0 == SSID */            \
1052         if (!WARN_ON(present_elems_len >= PRESENT_ELEMS_MAX - 1))       \
1053                 present_elems[present_elems_len++] = (id);              \
1054 } while (0)
1055 #define ADD_PRESENT_EXT_ELEM(id) ADD_PRESENT_ELEM(PRESENT_ELEM_EXT_OFFS | (id))
1056
1057         if (link)
1058                 smps_mode = link->smps_mode;
1059         else if (sdata->u.mgd.powersave)
1060                 smps_mode = IEEE80211_SMPS_DYNAMIC;
1061         else
1062                 smps_mode = IEEE80211_SMPS_OFF;
1063
1064         if (link) {
1065                 /*
1066                  * 5/10 MHz scenarios are only viable without MLO, in which
1067                  * case this pointer should be used ... All of this is a bit
1068                  * unclear though, not sure this even works at all.
1069                  */
1070                 rcu_read_lock();
1071                 chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
1072                 if (chanctx_conf)
1073                         width = chanctx_conf->def.width;
1074                 rcu_read_unlock();
1075         }
1076
1077         sband = local->hw.wiphy->bands[chan->band];
1078         iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1079
1080         if (sband->band == NL80211_BAND_2GHZ) {
1081                 *capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
1082                 *capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
1083         }
1084
1085         if ((cbss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
1086             ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
1087                 *capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
1088
1089         if (sband->band != NL80211_BAND_S1GHZ)
1090                 ieee80211_assoc_add_rates(skb, width, sband, assoc_data);
1091
1092         if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
1093             *capab & WLAN_CAPABILITY_RADIO_MEASURE) {
1094                 struct cfg80211_chan_def chandef = {
1095                         .width = width,
1096                         .chan = chan,
1097                 };
1098
1099                 pos = skb_put(skb, 4);
1100                 *pos++ = WLAN_EID_PWR_CAPABILITY;
1101                 *pos++ = 2;
1102                 *pos++ = 0; /* min tx power */
1103                  /* max tx power */
1104                 *pos++ = ieee80211_chandef_max_power(&chandef);
1105                 ADD_PRESENT_ELEM(WLAN_EID_PWR_CAPABILITY);
1106         }
1107
1108         /*
1109          * Per spec, we shouldn't include the list of channels if we advertise
1110          * support for extended channel switching, but we've always done that;
1111          * (for now?) apply this restriction only on the (new) 6 GHz band.
1112          */
1113         if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
1114             (sband->band != NL80211_BAND_6GHZ ||
1115              !ext_capa || ext_capa->datalen < 1 ||
1116              !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
1117                 /* TODO: get this in reg domain format */
1118                 pos = skb_put(skb, 2 * sband->n_channels + 2);
1119                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
1120                 *pos++ = 2 * sband->n_channels;
1121                 for (i = 0; i < sband->n_channels; i++) {
1122                         int cf = sband->channels[i].center_freq;
1123
1124                         *pos++ = ieee80211_frequency_to_channel(cf);
1125                         *pos++ = 1; /* one channel in the subband*/
1126                 }
1127                 ADD_PRESENT_ELEM(WLAN_EID_SUPPORTED_CHANNELS);
1128         }
1129
1130         /* if present, add any custom IEs that go before HT */
1131         offset = ieee80211_add_before_ht_elems(skb, extra_elems,
1132                                                extra_elems_len,
1133                                                offset);
1134
1135         if (sband->band != NL80211_BAND_6GHZ &&
1136             !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT)) {
1137                 ieee80211_add_ht_ie(sdata, skb,
1138                                     assoc_data->link[link_id].ap_ht_param,
1139                                     sband, chan, smps_mode,
1140                                     assoc_data->link[link_id].conn_flags);
1141                 ADD_PRESENT_ELEM(WLAN_EID_HT_CAPABILITY);
1142         }
1143
1144         /* if present, add any custom IEs that go before VHT */
1145         offset = ieee80211_add_before_vht_elems(skb, extra_elems,
1146                                                 extra_elems_len,
1147                                                 offset);
1148
1149         if (sband->band != NL80211_BAND_6GHZ &&
1150             !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
1151                 bool mu_mimo_owner =
1152                         ieee80211_add_vht_ie(sdata, skb, sband,
1153                                              &assoc_data->link[link_id].ap_vht_cap,
1154                                              assoc_data->link[link_id].conn_flags);
1155
1156                 if (link)
1157                         link->conf->mu_mimo_owner = mu_mimo_owner;
1158                 ADD_PRESENT_ELEM(WLAN_EID_VHT_CAPABILITY);
1159         }
1160
1161         /*
1162          * If AP doesn't support HT, mark HE and EHT as disabled.
1163          * If on the 5GHz band, make sure it supports VHT.
1164          */
1165         if (assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT ||
1166             (sband->band == NL80211_BAND_5GHZ &&
1167              assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT))
1168                 assoc_data->link[link_id].conn_flags |=
1169                         IEEE80211_CONN_DISABLE_HE |
1170                         IEEE80211_CONN_DISABLE_EHT;
1171
1172         /* if present, add any custom IEs that go before HE */
1173         offset = ieee80211_add_before_he_elems(skb, extra_elems,
1174                                                extra_elems_len,
1175                                                offset);
1176
1177         if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HE)) {
1178                 ieee80211_add_he_ie(sdata, skb, sband, smps_mode,
1179                                     assoc_data->link[link_id].conn_flags);
1180                 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY);
1181         }
1182
1183         /*
1184          * careful - need to know about all the present elems before
1185          * calling ieee80211_assoc_add_ml_elem(), so add this one if
1186          * we're going to put it after the ML element
1187          */
1188         if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
1189                 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_EHT_CAPABILITY);
1190
1191         if (link_id == assoc_data->assoc_link_id)
1192                 ieee80211_assoc_add_ml_elem(sdata, skb, orig_capab, ext_capa,
1193                                             present_elems);
1194
1195         /* crash if somebody gets it wrong */
1196         present_elems = NULL;
1197
1198         if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
1199                 ieee80211_add_eht_ie(sdata, skb, sband);
1200
1201         if (sband->band == NL80211_BAND_S1GHZ) {
1202                 ieee80211_add_aid_request_ie(sdata, skb);
1203                 ieee80211_add_s1g_capab_ie(sdata, &sband->s1g_cap, skb);
1204         }
1205
1206         if (iftd && iftd->vendor_elems.data && iftd->vendor_elems.len)
1207                 skb_put_data(skb, iftd->vendor_elems.data, iftd->vendor_elems.len);
1208
1209         if (link)
1210                 link->u.mgd.conn_flags = assoc_data->link[link_id].conn_flags;
1211
1212         return offset;
1213 }
1214
1215 static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb,
1216                                                const u16 *outer,
1217                                                const u16 *inner)
1218 {
1219         unsigned int skb_len = skb->len;
1220         bool added = false;
1221         int i, j;
1222         u8 *len, *list_len = NULL;
1223
1224         skb_put_u8(skb, WLAN_EID_EXTENSION);
1225         len = skb_put(skb, 1);
1226         skb_put_u8(skb, WLAN_EID_EXT_NON_INHERITANCE);
1227
1228         for (i = 0; i < PRESENT_ELEMS_MAX && outer[i]; i++) {
1229                 u16 elem = outer[i];
1230                 bool have_inner = false;
1231                 bool at_extension = false;
1232
1233                 /* should at least be sorted in the sense of normal -> ext */
1234                 WARN_ON(at_extension && elem < PRESENT_ELEM_EXT_OFFS);
1235
1236                 /* switch to extension list */
1237                 if (!at_extension && elem >= PRESENT_ELEM_EXT_OFFS) {
1238                         at_extension = true;
1239                         if (!list_len)
1240                                 skb_put_u8(skb, 0);
1241                         list_len = NULL;
1242                 }
1243
1244                 for (j = 0; j < PRESENT_ELEMS_MAX && inner[j]; j++) {
1245                         if (elem == inner[j]) {
1246                                 have_inner = true;
1247                                 break;
1248                         }
1249                 }
1250
1251                 if (have_inner)
1252                         continue;
1253
1254                 if (!list_len) {
1255                         list_len = skb_put(skb, 1);
1256                         *list_len = 0;
1257                 }
1258                 *list_len += 1;
1259                 skb_put_u8(skb, (u8)elem);
1260         }
1261
1262         if (!added)
1263                 skb_trim(skb, skb_len);
1264         else
1265                 *len = skb->len - skb_len - 2;
1266 }
1267
1268 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1269                                         struct sk_buff *skb, u16 capab,
1270                                         const struct element *ext_capa,
1271                                         const u16 *outer_present_elems)
1272 {
1273         struct ieee80211_local *local = sdata->local;
1274         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1275         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1276         struct ieee80211_multi_link_elem *ml_elem;
1277         struct ieee80211_mle_basic_common_info *common;
1278         const struct wiphy_iftype_ext_capab *ift_ext_capa;
1279         __le16 eml_capa = 0, mld_capa_ops = 0;
1280         unsigned int link_id;
1281         u8 *ml_elem_len;
1282         void *capab_pos;
1283
1284         if (!sdata->vif.valid_links)
1285                 return;
1286
1287         ift_ext_capa = cfg80211_get_iftype_ext_capa(local->hw.wiphy,
1288                                                     ieee80211_vif_type_p2p(&sdata->vif));
1289         if (ift_ext_capa) {
1290                 eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities);
1291                 mld_capa_ops = cpu_to_le16(ift_ext_capa->mld_capa_and_ops);
1292         }
1293
1294         skb_put_u8(skb, WLAN_EID_EXTENSION);
1295         ml_elem_len = skb_put(skb, 1);
1296         skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK);
1297         ml_elem = skb_put(skb, sizeof(*ml_elem));
1298         ml_elem->control =
1299                 cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC |
1300                             IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP);
1301         common = skb_put(skb, sizeof(*common));
1302         common->len = sizeof(*common) +
1303                       2;  /* MLD capa/ops */
1304         memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN);
1305
1306         /* add EML_CAPA only if needed, see Draft P802.11be_D2.1, 35.3.17 */
1307         if (eml_capa &
1308             cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |
1309                          IEEE80211_EML_CAP_EMLMR_SUPPORT))) {
1310                 common->len += 2; /* EML capabilities */
1311                 ml_elem->control |=
1312                         cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EML_CAPA);
1313                 skb_put_data(skb, &eml_capa, sizeof(eml_capa));
1314         }
1315         /* need indication from userspace to support this */
1316         mld_capa_ops &= ~cpu_to_le16(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP);
1317         skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops));
1318
1319         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1320                 u16 link_present_elems[PRESENT_ELEMS_MAX] = {};
1321                 const u8 *extra_elems;
1322                 size_t extra_elems_len;
1323                 size_t extra_used;
1324                 u8 *subelem_len = NULL;
1325                 __le16 ctrl;
1326
1327                 if (!assoc_data->link[link_id].bss ||
1328                     link_id == assoc_data->assoc_link_id)
1329                         continue;
1330
1331                 extra_elems = assoc_data->link[link_id].elems;
1332                 extra_elems_len = assoc_data->link[link_id].elems_len;
1333
1334                 skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE);
1335                 subelem_len = skb_put(skb, 1);
1336
1337                 ctrl = cpu_to_le16(link_id |
1338                                    IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE |
1339                                    IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT);
1340                 skb_put_data(skb, &ctrl, sizeof(ctrl));
1341                 skb_put_u8(skb, 1 + ETH_ALEN); /* STA Info Length */
1342                 skb_put_data(skb, assoc_data->link[link_id].addr,
1343                              ETH_ALEN);
1344                 /*
1345                  * Now add the contents of the (re)association request,
1346                  * but the "listen interval" and "current AP address"
1347                  * (if applicable) are skipped. So we only have
1348                  * the capability field (remember the position and fill
1349                  * later), followed by the elements added below by
1350                  * calling ieee80211_assoc_link_elems().
1351                  */
1352                 capab_pos = skb_put(skb, 2);
1353
1354                 extra_used = ieee80211_assoc_link_elems(sdata, skb, &capab,
1355                                                         ext_capa,
1356                                                         extra_elems,
1357                                                         extra_elems_len,
1358                                                         link_id, NULL,
1359                                                         link_present_elems);
1360                 if (extra_elems)
1361                         skb_put_data(skb, extra_elems + extra_used,
1362                                      extra_elems_len - extra_used);
1363
1364                 put_unaligned_le16(capab, capab_pos);
1365
1366                 ieee80211_add_non_inheritance_elem(skb, outer_present_elems,
1367                                                    link_present_elems);
1368
1369                 ieee80211_fragment_element(skb, subelem_len);
1370         }
1371
1372         ieee80211_fragment_element(skb, ml_elem_len);
1373 }
1374
1375 static int ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
1376 {
1377         struct ieee80211_local *local = sdata->local;
1378         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1379         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1380         struct ieee80211_link_data *link;
1381         struct sk_buff *skb;
1382         struct ieee80211_mgmt *mgmt;
1383         u8 *pos, qos_info, *ie_start;
1384         size_t offset, noffset;
1385         u16 capab = WLAN_CAPABILITY_ESS, link_capab;
1386         __le16 listen_int;
1387         struct element *ext_capa = NULL;
1388         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1389         struct ieee80211_prep_tx_info info = {};
1390         unsigned int link_id, n_links = 0;
1391         u16 present_elems[PRESENT_ELEMS_MAX] = {};
1392         void *capab_pos;
1393         size_t size;
1394         int ret;
1395
1396         /* we know it's writable, cast away the const */
1397         if (assoc_data->ie_len)
1398                 ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
1399                                                       assoc_data->ie,
1400                                                       assoc_data->ie_len);
1401
1402         sdata_assert_lock(sdata);
1403
1404         size = local->hw.extra_tx_headroom +
1405                sizeof(*mgmt) + /* bit too much but doesn't matter */
1406                2 + assoc_data->ssid_len + /* SSID */
1407                assoc_data->ie_len + /* extra IEs */
1408                (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
1409                9; /* WMM */
1410
1411         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1412                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1413                 const struct ieee80211_sband_iftype_data *iftd;
1414                 struct ieee80211_supported_band *sband;
1415
1416                 if (!cbss)
1417                         continue;
1418
1419                 sband = local->hw.wiphy->bands[cbss->channel->band];
1420
1421                 n_links++;
1422                 /* add STA profile elements length */
1423                 size += assoc_data->link[link_id].elems_len;
1424                 /* and supported rates length */
1425                 size += 4 + sband->n_bitrates;
1426                 /* supported channels */
1427                 size += 2 + 2 * sband->n_channels;
1428
1429                 iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1430                 if (iftd)
1431                         size += iftd->vendor_elems.len;
1432
1433                 /* power capability */
1434                 size += 4;
1435
1436                 /* HT, VHT, HE, EHT */
1437                 size += 2 + sizeof(struct ieee80211_ht_cap);
1438                 size += 2 + sizeof(struct ieee80211_vht_cap);
1439                 size += 2 + 1 + sizeof(struct ieee80211_he_cap_elem) +
1440                         sizeof(struct ieee80211_he_mcs_nss_supp) +
1441                         IEEE80211_HE_PPE_THRES_MAX_LEN;
1442
1443                 if (sband->band == NL80211_BAND_6GHZ)
1444                         size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa);
1445
1446                 size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) +
1447                         sizeof(struct ieee80211_eht_mcs_nss_supp) +
1448                         IEEE80211_EHT_PPE_THRES_MAX_LEN;
1449
1450                 /* non-inheritance element */
1451                 size += 2 + 2 + PRESENT_ELEMS_MAX;
1452
1453                 /* should be the same across all BSSes */
1454                 if (cbss->capability & WLAN_CAPABILITY_PRIVACY)
1455                         capab |= WLAN_CAPABILITY_PRIVACY;
1456         }
1457
1458         if (sdata->vif.valid_links) {
1459                 /* consider the multi-link element with STA profile */
1460                 size += sizeof(struct ieee80211_multi_link_elem);
1461                 /* max common info field in basic multi-link element */
1462                 size += sizeof(struct ieee80211_mle_basic_common_info) +
1463                         2 + /* capa & op */
1464                         2; /* EML capa */
1465
1466                 /*
1467                  * The capability elements were already considered above;
1468                  * note this over-estimates a bit because there's no
1469                  * STA profile for the assoc link.
1470                  */
1471                 size += (n_links - 1) *
1472                         (1 + 1 + /* subelement ID/length */
1473                          2 + /* STA control */
1474                          1 + ETH_ALEN + 2 /* STA Info field */);
1475         }
1476
1477         link = sdata_dereference(sdata->link[assoc_data->assoc_link_id], sdata);
1478         if (WARN_ON(!link))
1479                 return -EINVAL;
1480
1481         if (WARN_ON(!assoc_data->link[assoc_data->assoc_link_id].bss))
1482                 return -EINVAL;
1483
1484         skb = alloc_skb(size, GFP_KERNEL);
1485         if (!skb)
1486                 return -ENOMEM;
1487
1488         skb_reserve(skb, local->hw.extra_tx_headroom);
1489
1490         if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
1491                 capab |= WLAN_CAPABILITY_RADIO_MEASURE;
1492
1493         /* Set MBSSID support for HE AP if needed */
1494         if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
1495             !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
1496             ext_capa && ext_capa->datalen >= 3)
1497                 ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
1498
1499         mgmt = skb_put_zero(skb, 24);
1500         memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
1501         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1502         memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
1503
1504         listen_int = cpu_to_le16(assoc_data->s1g ?
1505                         ieee80211_encode_usf(local->hw.conf.listen_interval) :
1506                         local->hw.conf.listen_interval);
1507         if (!is_zero_ether_addr(assoc_data->prev_ap_addr)) {
1508                 skb_put(skb, 10);
1509                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1510                                                   IEEE80211_STYPE_REASSOC_REQ);
1511                 capab_pos = &mgmt->u.reassoc_req.capab_info;
1512                 mgmt->u.reassoc_req.listen_interval = listen_int;
1513                 memcpy(mgmt->u.reassoc_req.current_ap,
1514                        assoc_data->prev_ap_addr, ETH_ALEN);
1515                 info.subtype = IEEE80211_STYPE_REASSOC_REQ;
1516         } else {
1517                 skb_put(skb, 4);
1518                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1519                                                   IEEE80211_STYPE_ASSOC_REQ);
1520                 capab_pos = &mgmt->u.assoc_req.capab_info;
1521                 mgmt->u.assoc_req.listen_interval = listen_int;
1522                 info.subtype = IEEE80211_STYPE_ASSOC_REQ;
1523         }
1524
1525         /* SSID */
1526         pos = skb_put(skb, 2 + assoc_data->ssid_len);
1527         ie_start = pos;
1528         *pos++ = WLAN_EID_SSID;
1529         *pos++ = assoc_data->ssid_len;
1530         memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
1531
1532         /* add the elements for the assoc (main) link */
1533         link_capab = capab;
1534         offset = ieee80211_assoc_link_elems(sdata, skb, &link_capab,
1535                                             ext_capa,
1536                                             assoc_data->ie,
1537                                             assoc_data->ie_len,
1538                                             assoc_data->assoc_link_id, link,
1539                                             present_elems);
1540         put_unaligned_le16(link_capab, capab_pos);
1541
1542         /* if present, add any custom non-vendor IEs */
1543         if (assoc_data->ie_len) {
1544                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
1545                                                     assoc_data->ie_len,
1546                                                     offset);
1547                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1548                 offset = noffset;
1549         }
1550
1551         if (assoc_data->wmm) {
1552                 if (assoc_data->uapsd) {
1553                         qos_info = ifmgd->uapsd_queues;
1554                         qos_info |= (ifmgd->uapsd_max_sp_len <<
1555                                      IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
1556                 } else {
1557                         qos_info = 0;
1558                 }
1559
1560                 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
1561         }
1562
1563         /* add any remaining custom (i.e. vendor specific here) IEs */
1564         if (assoc_data->ie_len) {
1565                 noffset = assoc_data->ie_len;
1566                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1567         }
1568
1569         if (assoc_data->fils_kek_len) {
1570                 ret = fils_encrypt_assoc_req(skb, assoc_data);
1571                 if (ret < 0) {
1572                         dev_kfree_skb(skb);
1573                         return ret;
1574                 }
1575         }
1576
1577         pos = skb_tail_pointer(skb);
1578         kfree(ifmgd->assoc_req_ies);
1579         ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
1580         if (!ifmgd->assoc_req_ies) {
1581                 dev_kfree_skb(skb);
1582                 return -ENOMEM;
1583         }
1584
1585         ifmgd->assoc_req_ies_len = pos - ie_start;
1586
1587         drv_mgd_prepare_tx(local, sdata, &info);
1588
1589         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1590         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1591                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
1592                                                 IEEE80211_TX_INTFL_MLME_CONN_TX;
1593         ieee80211_tx_skb(sdata, skb);
1594
1595         return 0;
1596 }
1597
1598 void ieee80211_send_pspoll(struct ieee80211_local *local,
1599                            struct ieee80211_sub_if_data *sdata)
1600 {
1601         struct ieee80211_pspoll *pspoll;
1602         struct sk_buff *skb;
1603
1604         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
1605         if (!skb)
1606                 return;
1607
1608         pspoll = (struct ieee80211_pspoll *) skb->data;
1609         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1610
1611         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1612         ieee80211_tx_skb(sdata, skb);
1613 }
1614
1615 void ieee80211_send_nullfunc(struct ieee80211_local *local,
1616                              struct ieee80211_sub_if_data *sdata,
1617                              bool powersave)
1618 {
1619         struct sk_buff *skb;
1620         struct ieee80211_hdr_3addr *nullfunc;
1621         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1622
1623         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, -1,
1624                                      !ieee80211_hw_check(&local->hw,
1625                                                          DOESNT_SUPPORT_QOS_NDP));
1626         if (!skb)
1627                 return;
1628
1629         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1630         if (powersave)
1631                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1632
1633         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1634                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1635
1636         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1637                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1638
1639         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1640                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1641
1642         ieee80211_tx_skb(sdata, skb);
1643 }
1644
1645 void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
1646                                    struct ieee80211_sub_if_data *sdata)
1647 {
1648         struct sk_buff *skb;
1649         struct ieee80211_hdr *nullfunc;
1650         __le16 fc;
1651
1652         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1653                 return;
1654
1655         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1656         if (!skb)
1657                 return;
1658
1659         skb_reserve(skb, local->hw.extra_tx_headroom);
1660
1661         nullfunc = skb_put_zero(skb, 30);
1662         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
1663                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
1664         nullfunc->frame_control = fc;
1665         memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1666         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1667         memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1668         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
1669
1670         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1671         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1672         ieee80211_tx_skb(sdata, skb);
1673 }
1674
1675 /* spectrum management related things */
1676 static void ieee80211_chswitch_work(struct work_struct *work)
1677 {
1678         struct ieee80211_link_data *link =
1679                 container_of(work, struct ieee80211_link_data, u.mgd.chswitch_work);
1680         struct ieee80211_sub_if_data *sdata = link->sdata;
1681         struct ieee80211_local *local = sdata->local;
1682         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1683         int ret;
1684
1685         if (!ieee80211_sdata_running(sdata))
1686                 return;
1687
1688         sdata_lock(sdata);
1689         mutex_lock(&local->mtx);
1690         mutex_lock(&local->chanctx_mtx);
1691
1692         if (!ifmgd->associated)
1693                 goto out;
1694
1695         if (!link->conf->csa_active)
1696                 goto out;
1697
1698         /*
1699          * using reservation isn't immediate as it may be deferred until later
1700          * with multi-vif. once reservation is complete it will re-schedule the
1701          * work with no reserved_chanctx so verify chandef to check if it
1702          * completed successfully
1703          */
1704
1705         if (link->reserved_chanctx) {
1706                 /*
1707                  * with multi-vif csa driver may call ieee80211_csa_finish()
1708                  * many times while waiting for other interfaces to use their
1709                  * reservations
1710                  */
1711                 if (link->reserved_ready)
1712                         goto out;
1713
1714                 ret = ieee80211_link_use_reserved_context(link);
1715                 if (ret) {
1716                         sdata_info(sdata,
1717                                    "failed to use reserved channel context, disconnecting (err=%d)\n",
1718                                    ret);
1719                         ieee80211_queue_work(&sdata->local->hw,
1720                                              &ifmgd->csa_connection_drop_work);
1721                         goto out;
1722                 }
1723
1724                 goto out;
1725         }
1726
1727         if (!cfg80211_chandef_identical(&link->conf->chandef,
1728                                         &link->csa_chandef)) {
1729                 sdata_info(sdata,
1730                            "failed to finalize channel switch, disconnecting\n");
1731                 ieee80211_queue_work(&sdata->local->hw,
1732                                      &ifmgd->csa_connection_drop_work);
1733                 goto out;
1734         }
1735
1736         link->u.mgd.csa_waiting_bcn = true;
1737
1738         ieee80211_sta_reset_beacon_monitor(sdata);
1739         ieee80211_sta_reset_conn_monitor(sdata);
1740
1741 out:
1742         mutex_unlock(&local->chanctx_mtx);
1743         mutex_unlock(&local->mtx);
1744         sdata_unlock(sdata);
1745 }
1746
1747 static void ieee80211_chswitch_post_beacon(struct ieee80211_link_data *link)
1748 {
1749         struct ieee80211_sub_if_data *sdata = link->sdata;
1750         struct ieee80211_local *local = sdata->local;
1751         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1752         int ret;
1753
1754         sdata_assert_lock(sdata);
1755
1756         WARN_ON(!link->conf->csa_active);
1757
1758         if (link->csa_block_tx) {
1759                 ieee80211_wake_vif_queues(local, sdata,
1760                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1761                 link->csa_block_tx = false;
1762         }
1763
1764         link->conf->csa_active = false;
1765         link->u.mgd.csa_waiting_bcn = false;
1766         /*
1767          * If the CSA IE is still present on the beacon after the switch,
1768          * we need to consider it as a new CSA (possibly to self).
1769          */
1770         link->u.mgd.beacon_crc_valid = false;
1771
1772         ret = drv_post_channel_switch(sdata);
1773         if (ret) {
1774                 sdata_info(sdata,
1775                            "driver post channel switch failed, disconnecting\n");
1776                 ieee80211_queue_work(&local->hw,
1777                                      &ifmgd->csa_connection_drop_work);
1778                 return;
1779         }
1780
1781         cfg80211_ch_switch_notify(sdata->dev, &link->reserved_chandef, 0, 0);
1782 }
1783
1784 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1785 {
1786         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1787         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1788
1789         if (WARN_ON(sdata->vif.valid_links))
1790                 success = false;
1791
1792         trace_api_chswitch_done(sdata, success);
1793         if (!success) {
1794                 sdata_info(sdata,
1795                            "driver channel switch failed, disconnecting\n");
1796                 ieee80211_queue_work(&sdata->local->hw,
1797                                      &ifmgd->csa_connection_drop_work);
1798         } else {
1799                 ieee80211_queue_work(&sdata->local->hw,
1800                                      &sdata->deflink.u.mgd.chswitch_work);
1801         }
1802 }
1803 EXPORT_SYMBOL(ieee80211_chswitch_done);
1804
1805 static void ieee80211_chswitch_timer(struct timer_list *t)
1806 {
1807         struct ieee80211_link_data *link =
1808                 from_timer(link, t, u.mgd.chswitch_timer);
1809
1810         ieee80211_queue_work(&link->sdata->local->hw,
1811                              &link->u.mgd.chswitch_work);
1812 }
1813
1814 static void
1815 ieee80211_sta_abort_chanswitch(struct ieee80211_link_data *link)
1816 {
1817         struct ieee80211_sub_if_data *sdata = link->sdata;
1818         struct ieee80211_local *local = sdata->local;
1819
1820         if (!local->ops->abort_channel_switch)
1821                 return;
1822
1823         mutex_lock(&local->mtx);
1824
1825         mutex_lock(&local->chanctx_mtx);
1826         ieee80211_link_unreserve_chanctx(link);
1827         mutex_unlock(&local->chanctx_mtx);
1828
1829         if (link->csa_block_tx)
1830                 ieee80211_wake_vif_queues(local, sdata,
1831                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1832
1833         link->csa_block_tx = false;
1834         link->conf->csa_active = false;
1835
1836         mutex_unlock(&local->mtx);
1837
1838         drv_abort_channel_switch(sdata);
1839 }
1840
1841 static void
1842 ieee80211_sta_process_chanswitch(struct ieee80211_link_data *link,
1843                                  u64 timestamp, u32 device_timestamp,
1844                                  struct ieee802_11_elems *elems,
1845                                  bool beacon)
1846 {
1847         struct ieee80211_sub_if_data *sdata = link->sdata;
1848         struct ieee80211_local *local = sdata->local;
1849         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1850         struct cfg80211_bss *cbss = link->u.mgd.bss;
1851         struct ieee80211_chanctx_conf *conf;
1852         struct ieee80211_chanctx *chanctx;
1853         enum nl80211_band current_band;
1854         struct ieee80211_csa_ie csa_ie;
1855         struct ieee80211_channel_switch ch_switch;
1856         struct ieee80211_bss *bss;
1857         int res;
1858
1859         sdata_assert_lock(sdata);
1860
1861         if (!cbss)
1862                 return;
1863
1864         if (local->scanning)
1865                 return;
1866
1867         current_band = cbss->channel->band;
1868         bss = (void *)cbss->priv;
1869         res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1870                                            bss->vht_cap_info,
1871                                            link->u.mgd.conn_flags,
1872                                            link->u.mgd.bssid, &csa_ie);
1873
1874         if (!res) {
1875                 ch_switch.timestamp = timestamp;
1876                 ch_switch.device_timestamp = device_timestamp;
1877                 ch_switch.block_tx = csa_ie.mode;
1878                 ch_switch.chandef = csa_ie.chandef;
1879                 ch_switch.count = csa_ie.count;
1880                 ch_switch.delay = csa_ie.max_switch_time;
1881         }
1882
1883         if (res < 0)
1884                 goto lock_and_drop_connection;
1885
1886         if (beacon && link->conf->csa_active &&
1887             !link->u.mgd.csa_waiting_bcn) {
1888                 if (res)
1889                         ieee80211_sta_abort_chanswitch(link);
1890                 else
1891                         drv_channel_switch_rx_beacon(sdata, &ch_switch);
1892                 return;
1893         } else if (link->conf->csa_active || res) {
1894                 /* disregard subsequent announcements if already processing */
1895                 return;
1896         }
1897
1898         if (link->conf->chandef.chan->band !=
1899             csa_ie.chandef.chan->band) {
1900                 sdata_info(sdata,
1901                            "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1902                            link->u.mgd.bssid,
1903                            csa_ie.chandef.chan->center_freq,
1904                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1905                            csa_ie.chandef.center_freq2);
1906                 goto lock_and_drop_connection;
1907         }
1908
1909         if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1910                                      IEEE80211_CHAN_DISABLED)) {
1911                 sdata_info(sdata,
1912                            "AP %pM switches to unsupported channel "
1913                            "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
1914                            "disconnecting\n",
1915                            link->u.mgd.bssid,
1916                            csa_ie.chandef.chan->center_freq,
1917                            csa_ie.chandef.chan->freq_offset,
1918                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1919                            csa_ie.chandef.freq1_offset,
1920                            csa_ie.chandef.center_freq2);
1921                 goto lock_and_drop_connection;
1922         }
1923
1924         if (cfg80211_chandef_identical(&csa_ie.chandef,
1925                                        &link->conf->chandef) &&
1926             (!csa_ie.mode || !beacon)) {
1927                 if (link->u.mgd.csa_ignored_same_chan)
1928                         return;
1929                 sdata_info(sdata,
1930                            "AP %pM tries to chanswitch to same channel, ignore\n",
1931                            link->u.mgd.bssid);
1932                 link->u.mgd.csa_ignored_same_chan = true;
1933                 return;
1934         }
1935
1936         /*
1937          * Drop all TDLS peers - either we disconnect or move to a different
1938          * channel from this point on. There's no telling what our peer will do.
1939          * The TDLS WIDER_BW scenario is also problematic, as peers might now
1940          * have an incompatible wider chandef.
1941          */
1942         ieee80211_teardown_tdls_peers(sdata);
1943
1944         mutex_lock(&local->mtx);
1945         mutex_lock(&local->chanctx_mtx);
1946         conf = rcu_dereference_protected(link->conf->chanctx_conf,
1947                                          lockdep_is_held(&local->chanctx_mtx));
1948         if (!conf) {
1949                 sdata_info(sdata,
1950                            "no channel context assigned to vif?, disconnecting\n");
1951                 goto drop_connection;
1952         }
1953
1954         chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1955
1956         if (local->use_chanctx &&
1957             !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1958                 sdata_info(sdata,
1959                            "driver doesn't support chan-switch with channel contexts\n");
1960                 goto drop_connection;
1961         }
1962
1963         if (drv_pre_channel_switch(sdata, &ch_switch)) {
1964                 sdata_info(sdata,
1965                            "preparing for channel switch failed, disconnecting\n");
1966                 goto drop_connection;
1967         }
1968
1969         res = ieee80211_link_reserve_chanctx(link, &csa_ie.chandef,
1970                                              chanctx->mode, false);
1971         if (res) {
1972                 sdata_info(sdata,
1973                            "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1974                            res);
1975                 goto drop_connection;
1976         }
1977         mutex_unlock(&local->chanctx_mtx);
1978
1979         link->conf->csa_active = true;
1980         link->csa_chandef = csa_ie.chandef;
1981         link->csa_block_tx = csa_ie.mode;
1982         link->u.mgd.csa_ignored_same_chan = false;
1983         link->u.mgd.beacon_crc_valid = false;
1984
1985         if (link->csa_block_tx)
1986                 ieee80211_stop_vif_queues(local, sdata,
1987                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1988         mutex_unlock(&local->mtx);
1989
1990         cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef, 0,
1991                                           csa_ie.count, csa_ie.mode, 0);
1992
1993         if (local->ops->channel_switch) {
1994                 /* use driver's channel switch callback */
1995                 drv_channel_switch(local, sdata, &ch_switch);
1996                 return;
1997         }
1998
1999         /* channel switch handled in software */
2000         if (csa_ie.count <= 1)
2001                 ieee80211_queue_work(&local->hw, &link->u.mgd.chswitch_work);
2002         else
2003                 mod_timer(&link->u.mgd.chswitch_timer,
2004                           TU_TO_EXP_TIME((csa_ie.count - 1) *
2005                                          cbss->beacon_interval));
2006         return;
2007  lock_and_drop_connection:
2008         mutex_lock(&local->mtx);
2009         mutex_lock(&local->chanctx_mtx);
2010  drop_connection:
2011         /*
2012          * This is just so that the disconnect flow will know that
2013          * we were trying to switch channel and failed. In case the
2014          * mode is 1 (we are not allowed to Tx), we will know not to
2015          * send a deauthentication frame. Those two fields will be
2016          * reset when the disconnection worker runs.
2017          */
2018         link->conf->csa_active = true;
2019         link->csa_block_tx = csa_ie.mode;
2020
2021         ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
2022         mutex_unlock(&local->chanctx_mtx);
2023         mutex_unlock(&local->mtx);
2024 }
2025
2026 static bool
2027 ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
2028                                  struct ieee80211_channel *channel,
2029                                  const u8 *country_ie, u8 country_ie_len,
2030                                  const u8 *pwr_constr_elem,
2031                                  int *chan_pwr, int *pwr_reduction)
2032 {
2033         struct ieee80211_country_ie_triplet *triplet;
2034         int chan = ieee80211_frequency_to_channel(channel->center_freq);
2035         int i, chan_increment;
2036         bool have_chan_pwr = false;
2037
2038         /* Invalid IE */
2039         if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
2040                 return false;
2041
2042         triplet = (void *)(country_ie + 3);
2043         country_ie_len -= 3;
2044
2045         switch (channel->band) {
2046         default:
2047                 WARN_ON_ONCE(1);
2048                 fallthrough;
2049         case NL80211_BAND_2GHZ:
2050         case NL80211_BAND_60GHZ:
2051         case NL80211_BAND_LC:
2052                 chan_increment = 1;
2053                 break;
2054         case NL80211_BAND_5GHZ:
2055                 chan_increment = 4;
2056                 break;
2057         case NL80211_BAND_6GHZ:
2058                 /*
2059                  * In the 6 GHz band, the "maximum transmit power level"
2060                  * field in the triplets is reserved, and thus will be
2061                  * zero and we shouldn't use it to control TX power.
2062                  * The actual TX power will be given in the transmit
2063                  * power envelope element instead.
2064                  */
2065                 return false;
2066         }
2067
2068         /* find channel */
2069         while (country_ie_len >= 3) {
2070                 u8 first_channel = triplet->chans.first_channel;
2071
2072                 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
2073                         goto next;
2074
2075                 for (i = 0; i < triplet->chans.num_channels; i++) {
2076                         if (first_channel + i * chan_increment == chan) {
2077                                 have_chan_pwr = true;
2078                                 *chan_pwr = triplet->chans.max_power;
2079                                 break;
2080                         }
2081                 }
2082                 if (have_chan_pwr)
2083                         break;
2084
2085  next:
2086                 triplet++;
2087                 country_ie_len -= 3;
2088         }
2089
2090         if (have_chan_pwr && pwr_constr_elem)
2091                 *pwr_reduction = *pwr_constr_elem;
2092         else
2093                 *pwr_reduction = 0;
2094
2095         return have_chan_pwr;
2096 }
2097
2098 static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
2099                                       struct ieee80211_channel *channel,
2100                                       const u8 *cisco_dtpc_ie,
2101                                       int *pwr_level)
2102 {
2103         /* From practical testing, the first data byte of the DTPC element
2104          * seems to contain the requested dBm level, and the CLI on Cisco
2105          * APs clearly state the range is -127 to 127 dBm, which indicates
2106          * a signed byte, although it seemingly never actually goes negative.
2107          * The other byte seems to always be zero.
2108          */
2109         *pwr_level = (__s8)cisco_dtpc_ie[4];
2110 }
2111
2112 static u32 ieee80211_handle_pwr_constr(struct ieee80211_link_data *link,
2113                                        struct ieee80211_channel *channel,
2114                                        struct ieee80211_mgmt *mgmt,
2115                                        const u8 *country_ie, u8 country_ie_len,
2116                                        const u8 *pwr_constr_ie,
2117                                        const u8 *cisco_dtpc_ie)
2118 {
2119         struct ieee80211_sub_if_data *sdata = link->sdata;
2120         bool has_80211h_pwr = false, has_cisco_pwr = false;
2121         int chan_pwr = 0, pwr_reduction_80211h = 0;
2122         int pwr_level_cisco, pwr_level_80211h;
2123         int new_ap_level;
2124         __le16 capab = mgmt->u.probe_resp.capab_info;
2125
2126         if (ieee80211_is_s1g_beacon(mgmt->frame_control))
2127                 return 0;       /* TODO */
2128
2129         if (country_ie &&
2130             (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
2131              capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
2132                 has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
2133                         sdata, channel, country_ie, country_ie_len,
2134                         pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
2135                 pwr_level_80211h =
2136                         max_t(int, 0, chan_pwr - pwr_reduction_80211h);
2137         }
2138
2139         if (cisco_dtpc_ie) {
2140                 ieee80211_find_cisco_dtpc(
2141                         sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
2142                 has_cisco_pwr = true;
2143         }
2144
2145         if (!has_80211h_pwr && !has_cisco_pwr)
2146                 return 0;
2147
2148         /* If we have both 802.11h and Cisco DTPC, apply both limits
2149          * by picking the smallest of the two power levels advertised.
2150          */
2151         if (has_80211h_pwr &&
2152             (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
2153                 new_ap_level = pwr_level_80211h;
2154
2155                 if (link->ap_power_level == new_ap_level)
2156                         return 0;
2157
2158                 sdata_dbg(sdata,
2159                           "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
2160                           pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
2161                           link->u.mgd.bssid);
2162         } else {  /* has_cisco_pwr is always true here. */
2163                 new_ap_level = pwr_level_cisco;
2164
2165                 if (link->ap_power_level == new_ap_level)
2166                         return 0;
2167
2168                 sdata_dbg(sdata,
2169                           "Limiting TX power to %d dBm as advertised by %pM\n",
2170                           pwr_level_cisco, link->u.mgd.bssid);
2171         }
2172
2173         link->ap_power_level = new_ap_level;
2174         if (__ieee80211_recalc_txpower(sdata))
2175                 return BSS_CHANGED_TXPOWER;
2176         return 0;
2177 }
2178
2179 /* powersave */
2180 static void ieee80211_enable_ps(struct ieee80211_local *local,
2181                                 struct ieee80211_sub_if_data *sdata)
2182 {
2183         struct ieee80211_conf *conf = &local->hw.conf;
2184
2185         /*
2186          * If we are scanning right now then the parameters will
2187          * take effect when scan finishes.
2188          */
2189         if (local->scanning)
2190                 return;
2191
2192         if (conf->dynamic_ps_timeout > 0 &&
2193             !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2194                 mod_timer(&local->dynamic_ps_timer, jiffies +
2195                           msecs_to_jiffies(conf->dynamic_ps_timeout));
2196         } else {
2197                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
2198                         ieee80211_send_nullfunc(local, sdata, true);
2199
2200                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2201                     ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2202                         return;
2203
2204                 conf->flags |= IEEE80211_CONF_PS;
2205                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2206         }
2207 }
2208
2209 static void ieee80211_change_ps(struct ieee80211_local *local)
2210 {
2211         struct ieee80211_conf *conf = &local->hw.conf;
2212
2213         if (local->ps_sdata) {
2214                 ieee80211_enable_ps(local, local->ps_sdata);
2215         } else if (conf->flags & IEEE80211_CONF_PS) {
2216                 conf->flags &= ~IEEE80211_CONF_PS;
2217                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2218                 del_timer_sync(&local->dynamic_ps_timer);
2219                 cancel_work_sync(&local->dynamic_ps_enable_work);
2220         }
2221 }
2222
2223 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
2224 {
2225         struct ieee80211_local *local = sdata->local;
2226         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
2227         struct sta_info *sta = NULL;
2228         bool authorized = false;
2229
2230         if (!mgd->powersave)
2231                 return false;
2232
2233         if (mgd->broken_ap)
2234                 return false;
2235
2236         if (!mgd->associated)
2237                 return false;
2238
2239         if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
2240                 return false;
2241
2242         if (!(local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO) &&
2243             !sdata->deflink.u.mgd.have_beacon)
2244                 return false;
2245
2246         rcu_read_lock();
2247         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
2248         if (sta)
2249                 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2250         rcu_read_unlock();
2251
2252         return authorized;
2253 }
2254
2255 /* need to hold RTNL or interface lock */
2256 void ieee80211_recalc_ps(struct ieee80211_local *local)
2257 {
2258         struct ieee80211_sub_if_data *sdata, *found = NULL;
2259         int count = 0;
2260         int timeout;
2261
2262         if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS) ||
2263             ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2264                 local->ps_sdata = NULL;
2265                 return;
2266         }
2267
2268         list_for_each_entry(sdata, &local->interfaces, list) {
2269                 if (!ieee80211_sdata_running(sdata))
2270                         continue;
2271                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
2272                         /* If an AP vif is found, then disable PS
2273                          * by setting the count to zero thereby setting
2274                          * ps_sdata to NULL.
2275                          */
2276                         count = 0;
2277                         break;
2278                 }
2279                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2280                         continue;
2281                 found = sdata;
2282                 count++;
2283         }
2284
2285         if (count == 1 && ieee80211_powersave_allowed(found)) {
2286                 u8 dtimper = found->deflink.u.mgd.dtim_period;
2287
2288                 timeout = local->dynamic_ps_forced_timeout;
2289                 if (timeout < 0)
2290                         timeout = 100;
2291                 local->hw.conf.dynamic_ps_timeout = timeout;
2292
2293                 /* If the TIM IE is invalid, pretend the value is 1 */
2294                 if (!dtimper)
2295                         dtimper = 1;
2296
2297                 local->hw.conf.ps_dtim_period = dtimper;
2298                 local->ps_sdata = found;
2299         } else {
2300                 local->ps_sdata = NULL;
2301         }
2302
2303         ieee80211_change_ps(local);
2304 }
2305
2306 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
2307 {
2308         bool ps_allowed = ieee80211_powersave_allowed(sdata);
2309
2310         if (sdata->vif.cfg.ps != ps_allowed) {
2311                 sdata->vif.cfg.ps = ps_allowed;
2312                 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_PS);
2313         }
2314 }
2315
2316 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
2317 {
2318         struct ieee80211_local *local =
2319                 container_of(work, struct ieee80211_local,
2320                              dynamic_ps_disable_work);
2321
2322         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2323                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2324                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2325         }
2326
2327         ieee80211_wake_queues_by_reason(&local->hw,
2328                                         IEEE80211_MAX_QUEUE_MAP,
2329                                         IEEE80211_QUEUE_STOP_REASON_PS,
2330                                         false);
2331 }
2332
2333 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
2334 {
2335         struct ieee80211_local *local =
2336                 container_of(work, struct ieee80211_local,
2337                              dynamic_ps_enable_work);
2338         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
2339         struct ieee80211_if_managed *ifmgd;
2340         unsigned long flags;
2341         int q;
2342
2343         /* can only happen when PS was just disabled anyway */
2344         if (!sdata)
2345                 return;
2346
2347         ifmgd = &sdata->u.mgd;
2348
2349         if (local->hw.conf.flags & IEEE80211_CONF_PS)
2350                 return;
2351
2352         if (local->hw.conf.dynamic_ps_timeout > 0) {
2353                 /* don't enter PS if TX frames are pending */
2354                 if (drv_tx_frames_pending(local)) {
2355                         mod_timer(&local->dynamic_ps_timer, jiffies +
2356                                   msecs_to_jiffies(
2357                                   local->hw.conf.dynamic_ps_timeout));
2358                         return;
2359                 }
2360
2361                 /*
2362                  * transmission can be stopped by others which leads to
2363                  * dynamic_ps_timer expiry. Postpone the ps timer if it
2364                  * is not the actual idle state.
2365                  */
2366                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2367                 for (q = 0; q < local->hw.queues; q++) {
2368                         if (local->queue_stop_reasons[q]) {
2369                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
2370                                                        flags);
2371                                 mod_timer(&local->dynamic_ps_timer, jiffies +
2372                                           msecs_to_jiffies(
2373                                           local->hw.conf.dynamic_ps_timeout));
2374                                 return;
2375                         }
2376                 }
2377                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2378         }
2379
2380         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2381             !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2382                 if (drv_tx_frames_pending(local)) {
2383                         mod_timer(&local->dynamic_ps_timer, jiffies +
2384                                   msecs_to_jiffies(
2385                                   local->hw.conf.dynamic_ps_timeout));
2386                 } else {
2387                         ieee80211_send_nullfunc(local, sdata, true);
2388                         /* Flush to get the tx status of nullfunc frame */
2389                         ieee80211_flush_queues(local, sdata, false);
2390                 }
2391         }
2392
2393         if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
2394               ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
2395             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2396                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
2397                 local->hw.conf.flags |= IEEE80211_CONF_PS;
2398                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2399         }
2400 }
2401
2402 void ieee80211_dynamic_ps_timer(struct timer_list *t)
2403 {
2404         struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
2405
2406         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
2407 }
2408
2409 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
2410 {
2411         struct delayed_work *delayed_work = to_delayed_work(work);
2412         struct ieee80211_link_data *link =
2413                 container_of(delayed_work, struct ieee80211_link_data,
2414                              dfs_cac_timer_work);
2415         struct cfg80211_chan_def chandef = link->conf->chandef;
2416         struct ieee80211_sub_if_data *sdata = link->sdata;
2417
2418         mutex_lock(&sdata->local->mtx);
2419         if (sdata->wdev.cac_started) {
2420                 ieee80211_link_release_channel(link);
2421                 cfg80211_cac_event(sdata->dev, &chandef,
2422                                    NL80211_RADAR_CAC_FINISHED,
2423                                    GFP_KERNEL);
2424         }
2425         mutex_unlock(&sdata->local->mtx);
2426 }
2427
2428 static bool
2429 __ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2430 {
2431         struct ieee80211_local *local = sdata->local;
2432         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2433         bool ret = false;
2434         int ac;
2435
2436         if (local->hw.queues < IEEE80211_NUM_ACS)
2437                 return false;
2438
2439         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2440                 struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
2441                 int non_acm_ac;
2442                 unsigned long now = jiffies;
2443
2444                 if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
2445                     tx_tspec->admitted_time &&
2446                     time_after(now, tx_tspec->time_slice_start + HZ)) {
2447                         tx_tspec->consumed_tx_time = 0;
2448                         tx_tspec->time_slice_start = now;
2449
2450                         if (tx_tspec->downgraded)
2451                                 tx_tspec->action =
2452                                         TX_TSPEC_ACTION_STOP_DOWNGRADE;
2453                 }
2454
2455                 switch (tx_tspec->action) {
2456                 case TX_TSPEC_ACTION_STOP_DOWNGRADE:
2457                         /* take the original parameters */
2458                         if (drv_conf_tx(local, &sdata->deflink, ac,
2459                                         &sdata->deflink.tx_conf[ac]))
2460                                 link_err(&sdata->deflink,
2461                                          "failed to set TX queue parameters for queue %d\n",
2462                                          ac);
2463                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
2464                         tx_tspec->downgraded = false;
2465                         ret = true;
2466                         break;
2467                 case TX_TSPEC_ACTION_DOWNGRADE:
2468                         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
2469                                 tx_tspec->action = TX_TSPEC_ACTION_NONE;
2470                                 ret = true;
2471                                 break;
2472                         }
2473                         /* downgrade next lower non-ACM AC */
2474                         for (non_acm_ac = ac + 1;
2475                              non_acm_ac < IEEE80211_NUM_ACS;
2476                              non_acm_ac++)
2477                                 if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
2478                                         break;
2479                         /* Usually the loop will result in using BK even if it
2480                          * requires admission control, but such a configuration
2481                          * makes no sense and we have to transmit somehow - the
2482                          * AC selection does the same thing.
2483                          * If we started out trying to downgrade from BK, then
2484                          * the extra condition here might be needed.
2485                          */
2486                         if (non_acm_ac >= IEEE80211_NUM_ACS)
2487                                 non_acm_ac = IEEE80211_AC_BK;
2488                         if (drv_conf_tx(local, &sdata->deflink, ac,
2489                                         &sdata->deflink.tx_conf[non_acm_ac]))
2490                                 link_err(&sdata->deflink,
2491                                          "failed to set TX queue parameters for queue %d\n",
2492                                          ac);
2493                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
2494                         ret = true;
2495                         schedule_delayed_work(&ifmgd->tx_tspec_wk,
2496                                 tx_tspec->time_slice_start + HZ - now + 1);
2497                         break;
2498                 case TX_TSPEC_ACTION_NONE:
2499                         /* nothing now */
2500                         break;
2501                 }
2502         }
2503
2504         return ret;
2505 }
2506
2507 void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2508 {
2509         if (__ieee80211_sta_handle_tspec_ac_params(sdata))
2510                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
2511                                                   BSS_CHANGED_QOS);
2512 }
2513
2514 static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
2515 {
2516         struct ieee80211_sub_if_data *sdata;
2517
2518         sdata = container_of(work, struct ieee80211_sub_if_data,
2519                              u.mgd.tx_tspec_wk.work);
2520         ieee80211_sta_handle_tspec_ac_params(sdata);
2521 }
2522
2523 void ieee80211_mgd_set_link_qos_params(struct ieee80211_link_data *link)
2524 {
2525         struct ieee80211_sub_if_data *sdata = link->sdata;
2526         struct ieee80211_local *local = sdata->local;
2527         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2528         struct ieee80211_tx_queue_params *params = link->tx_conf;
2529         u8 ac;
2530
2531         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2532                 mlme_dbg(sdata,
2533                          "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
2534                          ac, params[ac].acm,
2535                          params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
2536                          params[ac].txop, params[ac].uapsd,
2537                          ifmgd->tx_tspec[ac].downgraded);
2538                 if (!ifmgd->tx_tspec[ac].downgraded &&
2539                     drv_conf_tx(local, link, ac, &params[ac]))
2540                         link_err(link,
2541                                  "failed to set TX queue parameters for AC %d\n",
2542                                  ac);
2543         }
2544 }
2545
2546 /* MLME */
2547 static bool
2548 ieee80211_sta_wmm_params(struct ieee80211_local *local,
2549                          struct ieee80211_link_data *link,
2550                          const u8 *wmm_param, size_t wmm_param_len,
2551                          const struct ieee80211_mu_edca_param_set *mu_edca)
2552 {
2553         struct ieee80211_sub_if_data *sdata = link->sdata;
2554         struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
2555         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2556         size_t left;
2557         int count, mu_edca_count, ac;
2558         const u8 *pos;
2559         u8 uapsd_queues = 0;
2560
2561         if (!local->ops->conf_tx)
2562                 return false;
2563
2564         if (local->hw.queues < IEEE80211_NUM_ACS)
2565                 return false;
2566
2567         if (!wmm_param)
2568                 return false;
2569
2570         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
2571                 return false;
2572
2573         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
2574                 uapsd_queues = ifmgd->uapsd_queues;
2575
2576         count = wmm_param[6] & 0x0f;
2577         /* -1 is the initial value of ifmgd->mu_edca_last_param_set.
2578          * if mu_edca was preset before and now it disappeared tell
2579          * the driver about it.
2580          */
2581         mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
2582         if (count == link->u.mgd.wmm_last_param_set &&
2583             mu_edca_count == link->u.mgd.mu_edca_last_param_set)
2584                 return false;
2585         link->u.mgd.wmm_last_param_set = count;
2586         link->u.mgd.mu_edca_last_param_set = mu_edca_count;
2587
2588         pos = wmm_param + 8;
2589         left = wmm_param_len - 8;
2590
2591         memset(&params, 0, sizeof(params));
2592
2593         sdata->wmm_acm = 0;
2594         for (; left >= 4; left -= 4, pos += 4) {
2595                 int aci = (pos[0] >> 5) & 0x03;
2596                 int acm = (pos[0] >> 4) & 0x01;
2597                 bool uapsd = false;
2598
2599                 switch (aci) {
2600                 case 1: /* AC_BK */
2601                         ac = IEEE80211_AC_BK;
2602                         if (acm)
2603                                 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
2604                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
2605                                 uapsd = true;
2606                         params[ac].mu_edca = !!mu_edca;
2607                         if (mu_edca)
2608                                 params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2609                         break;
2610                 case 2: /* AC_VI */
2611                         ac = IEEE80211_AC_VI;
2612                         if (acm)
2613                                 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
2614                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
2615                                 uapsd = true;
2616                         params[ac].mu_edca = !!mu_edca;
2617                         if (mu_edca)
2618                                 params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2619                         break;
2620                 case 3: /* AC_VO */
2621                         ac = IEEE80211_AC_VO;
2622                         if (acm)
2623                                 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
2624                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
2625                                 uapsd = true;
2626                         params[ac].mu_edca = !!mu_edca;
2627                         if (mu_edca)
2628                                 params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2629                         break;
2630                 case 0: /* AC_BE */
2631                 default:
2632                         ac = IEEE80211_AC_BE;
2633                         if (acm)
2634                                 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
2635                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
2636                                 uapsd = true;
2637                         params[ac].mu_edca = !!mu_edca;
2638                         if (mu_edca)
2639                                 params[ac].mu_edca_param_rec = mu_edca->ac_be;
2640                         break;
2641                 }
2642
2643                 params[ac].aifs = pos[0] & 0x0f;
2644
2645                 if (params[ac].aifs < 2) {
2646                         sdata_info(sdata,
2647                                    "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2648                                    params[ac].aifs, aci);
2649                         params[ac].aifs = 2;
2650                 }
2651                 params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
2652                 params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
2653                 params[ac].txop = get_unaligned_le16(pos + 2);
2654                 params[ac].acm = acm;
2655                 params[ac].uapsd = uapsd;
2656
2657                 if (params[ac].cw_min == 0 ||
2658                     params[ac].cw_min > params[ac].cw_max) {
2659                         sdata_info(sdata,
2660                                    "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
2661                                    params[ac].cw_min, params[ac].cw_max, aci);
2662                         return false;
2663                 }
2664                 ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2665         }
2666
2667         /* WMM specification requires all 4 ACIs. */
2668         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2669                 if (params[ac].cw_min == 0) {
2670                         sdata_info(sdata,
2671                                    "AP has invalid WMM params (missing AC %d), using defaults\n",
2672                                    ac);
2673                         return false;
2674                 }
2675         }
2676
2677         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2678                 link->tx_conf[ac] = params[ac];
2679
2680         ieee80211_mgd_set_link_qos_params(link);
2681
2682         /* enable WMM or activate new settings */
2683         link->conf->qos = true;
2684         return true;
2685 }
2686
2687 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2688 {
2689         lockdep_assert_held(&sdata->local->mtx);
2690
2691         sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2692         ieee80211_run_deferred_scan(sdata->local);
2693 }
2694
2695 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2696 {
2697         mutex_lock(&sdata->local->mtx);
2698         __ieee80211_stop_poll(sdata);
2699         mutex_unlock(&sdata->local->mtx);
2700 }
2701
2702 static u32 ieee80211_handle_bss_capability(struct ieee80211_link_data *link,
2703                                            u16 capab, bool erp_valid, u8 erp)
2704 {
2705         struct ieee80211_bss_conf *bss_conf = link->conf;
2706         struct ieee80211_supported_band *sband;
2707         u32 changed = 0;
2708         bool use_protection;
2709         bool use_short_preamble;
2710         bool use_short_slot;
2711
2712         sband = ieee80211_get_link_sband(link);
2713         if (!sband)
2714                 return changed;
2715
2716         if (erp_valid) {
2717                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
2718                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
2719         } else {
2720                 use_protection = false;
2721                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
2722         }
2723
2724         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2725         if (sband->band == NL80211_BAND_5GHZ ||
2726             sband->band == NL80211_BAND_6GHZ)
2727                 use_short_slot = true;
2728
2729         if (use_protection != bss_conf->use_cts_prot) {
2730                 bss_conf->use_cts_prot = use_protection;
2731                 changed |= BSS_CHANGED_ERP_CTS_PROT;
2732         }
2733
2734         if (use_short_preamble != bss_conf->use_short_preamble) {
2735                 bss_conf->use_short_preamble = use_short_preamble;
2736                 changed |= BSS_CHANGED_ERP_PREAMBLE;
2737         }
2738
2739         if (use_short_slot != bss_conf->use_short_slot) {
2740                 bss_conf->use_short_slot = use_short_slot;
2741                 changed |= BSS_CHANGED_ERP_SLOT;
2742         }
2743
2744         return changed;
2745 }
2746
2747 static u64 ieee80211_link_set_associated(struct ieee80211_link_data *link,
2748                                          struct cfg80211_bss *cbss)
2749 {
2750         struct ieee80211_sub_if_data *sdata = link->sdata;
2751         struct ieee80211_bss_conf *bss_conf = link->conf;
2752         struct ieee80211_bss *bss = (void *)cbss->priv;
2753         u32 changed = BSS_CHANGED_QOS;
2754
2755         /* not really used in MLO */
2756         sdata->u.mgd.beacon_timeout =
2757                 usecs_to_jiffies(ieee80211_tu_to_usec(beacon_loss_count *
2758                                                       bss_conf->beacon_int));
2759
2760         changed |= ieee80211_handle_bss_capability(link,
2761                                                    bss_conf->assoc_capability,
2762                                                    bss->has_erp_value,
2763                                                    bss->erp_value);
2764
2765         ieee80211_check_rate_mask(link);
2766
2767         link->u.mgd.bss = cbss;
2768         memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2769
2770         if (sdata->vif.p2p ||
2771             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2772                 const struct cfg80211_bss_ies *ies;
2773
2774                 rcu_read_lock();
2775                 ies = rcu_dereference(cbss->ies);
2776                 if (ies) {
2777                         int ret;
2778
2779                         ret = cfg80211_get_p2p_attr(
2780                                         ies->data, ies->len,
2781                                         IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
2782                                         (u8 *) &bss_conf->p2p_noa_attr,
2783                                         sizeof(bss_conf->p2p_noa_attr));
2784                         if (ret >= 2) {
2785                                 link->u.mgd.p2p_noa_index =
2786                                         bss_conf->p2p_noa_attr.index;
2787                                 changed |= BSS_CHANGED_P2P_PS;
2788                         }
2789                 }
2790                 rcu_read_unlock();
2791         }
2792
2793         if (link->u.mgd.have_beacon) {
2794                 bss_conf->beacon_rate = bss->beacon_rate;
2795                 changed |= BSS_CHANGED_BEACON_INFO;
2796         } else {
2797                 bss_conf->beacon_rate = NULL;
2798         }
2799
2800         /* Tell the driver to monitor connection quality (if supported) */
2801         if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2802             bss_conf->cqm_rssi_thold)
2803                 changed |= BSS_CHANGED_CQM;
2804
2805         return changed;
2806 }
2807
2808 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2809                                      struct ieee80211_mgd_assoc_data *assoc_data,
2810                                      u64 changed[IEEE80211_MLD_MAX_NUM_LINKS])
2811 {
2812         struct ieee80211_local *local = sdata->local;
2813         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
2814         u64 vif_changed = BSS_CHANGED_ASSOC;
2815         unsigned int link_id;
2816
2817         sdata->u.mgd.associated = true;
2818
2819         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
2820                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
2821                 struct ieee80211_link_data *link;
2822
2823                 if (!cbss ||
2824                     assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
2825                         continue;
2826
2827                 link = sdata_dereference(sdata->link[link_id], sdata);
2828                 if (WARN_ON(!link))
2829                         return;
2830
2831                 changed[link_id] |= ieee80211_link_set_associated(link, cbss);
2832         }
2833
2834         /* just to be sure */
2835         ieee80211_stop_poll(sdata);
2836
2837         ieee80211_led_assoc(local, 1);
2838
2839         vif_cfg->assoc = 1;
2840
2841         /* Enable ARP filtering */
2842         if (vif_cfg->arp_addr_cnt)
2843                 vif_changed |= BSS_CHANGED_ARP_FILTER;
2844
2845         if (sdata->vif.valid_links) {
2846                 for (link_id = 0;
2847                      link_id < IEEE80211_MLD_MAX_NUM_LINKS;
2848                      link_id++) {
2849                         struct ieee80211_link_data *link;
2850                         struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
2851
2852                         if (!cbss ||
2853                             assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
2854                                 continue;
2855
2856                         link = sdata_dereference(sdata->link[link_id], sdata);
2857                         if (WARN_ON(!link))
2858                                 return;
2859
2860                         ieee80211_link_info_change_notify(sdata, link,
2861                                                           changed[link_id]);
2862
2863                         ieee80211_recalc_smps(sdata, link);
2864                 }
2865
2866                 ieee80211_vif_cfg_change_notify(sdata, vif_changed);
2867         } else {
2868                 ieee80211_bss_info_change_notify(sdata,
2869                                                  vif_changed | changed[0]);
2870         }
2871
2872         mutex_lock(&local->iflist_mtx);
2873         ieee80211_recalc_ps(local);
2874         mutex_unlock(&local->iflist_mtx);
2875
2876         /* leave this here to not change ordering in non-MLO cases */
2877         if (!sdata->vif.valid_links)
2878                 ieee80211_recalc_smps(sdata, &sdata->deflink);
2879         ieee80211_recalc_ps_vif(sdata);
2880
2881         netif_carrier_on(sdata->dev);
2882 }
2883
2884 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2885                                    u16 stype, u16 reason, bool tx,
2886                                    u8 *frame_buf)
2887 {
2888         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2889         struct ieee80211_local *local = sdata->local;
2890         unsigned int link_id;
2891         u32 changed = 0;
2892         struct ieee80211_prep_tx_info info = {
2893                 .subtype = stype,
2894         };
2895
2896         sdata_assert_lock(sdata);
2897
2898         if (WARN_ON_ONCE(tx && !frame_buf))
2899                 return;
2900
2901         if (WARN_ON(!ifmgd->associated))
2902                 return;
2903
2904         ieee80211_stop_poll(sdata);
2905
2906         ifmgd->associated = false;
2907
2908         /* other links will be destroyed */
2909         sdata->deflink.u.mgd.bss = NULL;
2910
2911         netif_carrier_off(sdata->dev);
2912
2913         /*
2914          * if we want to get out of ps before disassoc (why?) we have
2915          * to do it before sending disassoc, as otherwise the null-packet
2916          * won't be valid.
2917          */
2918         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2919                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2920                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2921         }
2922         local->ps_sdata = NULL;
2923
2924         /* disable per-vif ps */
2925         ieee80211_recalc_ps_vif(sdata);
2926
2927         /* make sure ongoing transmission finishes */
2928         synchronize_net();
2929
2930         /*
2931          * drop any frame before deauth/disassoc, this can be data or
2932          * management frame. Since we are disconnecting, we should not
2933          * insist sending these frames which can take time and delay
2934          * the disconnection and possible the roaming.
2935          */
2936         if (tx)
2937                 ieee80211_flush_queues(local, sdata, true);
2938
2939         /* deauthenticate/disassociate now */
2940         if (tx || frame_buf) {
2941                 /*
2942                  * In multi channel scenarios guarantee that the virtual
2943                  * interface is granted immediate airtime to transmit the
2944                  * deauthentication frame by calling mgd_prepare_tx, if the
2945                  * driver requested so.
2946                  */
2947                 if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
2948                     !sdata->deflink.u.mgd.have_beacon) {
2949                         drv_mgd_prepare_tx(sdata->local, sdata, &info);
2950                 }
2951
2952                 ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr,
2953                                                sdata->vif.cfg.ap_addr, stype,
2954                                                reason, tx, frame_buf);
2955         }
2956
2957         /* flush out frame - make sure the deauth was actually sent */
2958         if (tx)
2959                 ieee80211_flush_queues(local, sdata, false);
2960
2961         drv_mgd_complete_tx(sdata->local, sdata, &info);
2962
2963         /* clear AP addr only after building the needed mgmt frames */
2964         eth_zero_addr(sdata->deflink.u.mgd.bssid);
2965         eth_zero_addr(sdata->vif.cfg.ap_addr);
2966
2967         sdata->vif.cfg.ssid_len = 0;
2968
2969         /* remove AP and TDLS peers */
2970         sta_info_flush(sdata);
2971
2972         /* finally reset all BSS / config parameters */
2973         if (!sdata->vif.valid_links)
2974                 changed |= ieee80211_reset_erp_info(sdata);
2975
2976         ieee80211_led_assoc(local, 0);
2977         changed |= BSS_CHANGED_ASSOC;
2978         sdata->vif.cfg.assoc = false;
2979
2980         sdata->deflink.u.mgd.p2p_noa_index = -1;
2981         memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
2982                sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2983
2984         /* on the next assoc, re-program HT/VHT parameters */
2985         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
2986         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2987         memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
2988         memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2989
2990         /*
2991          * reset MU-MIMO ownership and group data in default link,
2992          * if used, other links are destroyed
2993          */
2994         memset(sdata->vif.bss_conf.mu_group.membership, 0,
2995                sizeof(sdata->vif.bss_conf.mu_group.membership));
2996         memset(sdata->vif.bss_conf.mu_group.position, 0,
2997                sizeof(sdata->vif.bss_conf.mu_group.position));
2998         if (!sdata->vif.valid_links)
2999                 changed |= BSS_CHANGED_MU_GROUPS;
3000         sdata->vif.bss_conf.mu_mimo_owner = false;
3001
3002         sdata->deflink.ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
3003
3004         del_timer_sync(&local->dynamic_ps_timer);
3005         cancel_work_sync(&local->dynamic_ps_enable_work);
3006
3007         /* Disable ARP filtering */
3008         if (sdata->vif.cfg.arp_addr_cnt)
3009                 changed |= BSS_CHANGED_ARP_FILTER;
3010
3011         sdata->vif.bss_conf.qos = false;
3012         if (!sdata->vif.valid_links) {
3013                 changed |= BSS_CHANGED_QOS;
3014                 /* The BSSID (not really interesting) and HT changed */
3015                 changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
3016                 ieee80211_bss_info_change_notify(sdata, changed);
3017         } else {
3018                 ieee80211_vif_cfg_change_notify(sdata, changed);
3019         }
3020
3021         /* disassociated - set to defaults now */
3022         ieee80211_set_wmm_default(&sdata->deflink, false, false);
3023
3024         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
3025         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
3026         del_timer_sync(&sdata->u.mgd.timer);
3027         del_timer_sync(&sdata->deflink.u.mgd.chswitch_timer);
3028
3029         sdata->vif.bss_conf.dtim_period = 0;
3030         sdata->vif.bss_conf.beacon_rate = NULL;
3031
3032         sdata->deflink.u.mgd.have_beacon = false;
3033         sdata->deflink.u.mgd.tracking_signal_avg = false;
3034         sdata->deflink.u.mgd.disable_wmm_tracking = false;
3035
3036         ifmgd->flags = 0;
3037         sdata->deflink.u.mgd.conn_flags = 0;
3038         mutex_lock(&local->mtx);
3039
3040         for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
3041                 struct ieee80211_link_data *link;
3042
3043                 link = sdata_dereference(sdata->link[link_id], sdata);
3044                 if (!link)
3045                         continue;
3046                 ieee80211_link_release_channel(link);
3047         }
3048
3049         sdata->vif.bss_conf.csa_active = false;
3050         sdata->deflink.u.mgd.csa_waiting_bcn = false;
3051         sdata->deflink.u.mgd.csa_ignored_same_chan = false;
3052         if (sdata->deflink.csa_block_tx) {
3053                 ieee80211_wake_vif_queues(local, sdata,
3054                                           IEEE80211_QUEUE_STOP_REASON_CSA);
3055                 sdata->deflink.csa_block_tx = false;
3056         }
3057         mutex_unlock(&local->mtx);
3058
3059         /* existing TX TSPEC sessions no longer exist */
3060         memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
3061         cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
3062
3063         sdata->vif.bss_conf.pwr_reduction = 0;
3064         sdata->vif.bss_conf.tx_pwr_env_num = 0;
3065         memset(sdata->vif.bss_conf.tx_pwr_env, 0,
3066                sizeof(sdata->vif.bss_conf.tx_pwr_env));
3067
3068         ieee80211_vif_set_links(sdata, 0);
3069 }
3070
3071 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
3072 {
3073         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3074         struct ieee80211_local *local = sdata->local;
3075
3076         mutex_lock(&local->mtx);
3077         if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
3078                 goto out;
3079
3080         __ieee80211_stop_poll(sdata);
3081
3082         mutex_lock(&local->iflist_mtx);
3083         ieee80211_recalc_ps(local);
3084         mutex_unlock(&local->iflist_mtx);
3085
3086         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
3087                 goto out;
3088
3089         /*
3090          * We've received a probe response, but are not sure whether
3091          * we have or will be receiving any beacons or data, so let's
3092          * schedule the timers again, just in case.
3093          */
3094         ieee80211_sta_reset_beacon_monitor(sdata);
3095
3096         mod_timer(&ifmgd->conn_mon_timer,
3097                   round_jiffies_up(jiffies +
3098                                    IEEE80211_CONNECTION_IDLE_TIME));
3099 out:
3100         mutex_unlock(&local->mtx);
3101 }
3102
3103 static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
3104                                            struct ieee80211_hdr *hdr,
3105                                            u16 tx_time)
3106 {
3107         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3108         u16 tid;
3109         int ac;
3110         struct ieee80211_sta_tx_tspec *tx_tspec;
3111         unsigned long now = jiffies;
3112
3113         if (!ieee80211_is_data_qos(hdr->frame_control))
3114                 return;
3115
3116         tid = ieee80211_get_tid(hdr);
3117         ac = ieee80211_ac_from_tid(tid);
3118         tx_tspec = &ifmgd->tx_tspec[ac];
3119
3120         if (likely(!tx_tspec->admitted_time))
3121                 return;
3122
3123         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
3124                 tx_tspec->consumed_tx_time = 0;
3125                 tx_tspec->time_slice_start = now;
3126
3127                 if (tx_tspec->downgraded) {
3128                         tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
3129                         schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
3130                 }
3131         }
3132
3133         if (tx_tspec->downgraded)
3134                 return;
3135
3136         tx_tspec->consumed_tx_time += tx_time;
3137
3138         if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
3139                 tx_tspec->downgraded = true;
3140                 tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
3141                 schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
3142         }
3143 }
3144
3145 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
3146                              struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
3147 {
3148         ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
3149
3150         if (!ieee80211_is_any_nullfunc(hdr->frame_control) ||
3151             !sdata->u.mgd.probe_send_count)
3152                 return;
3153
3154         if (ack)
3155                 sdata->u.mgd.probe_send_count = 0;
3156         else
3157                 sdata->u.mgd.nullfunc_failed = true;
3158         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3159 }
3160
3161 static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
3162                                           const u8 *src, const u8 *dst,
3163                                           const u8 *ssid, size_t ssid_len,
3164                                           struct ieee80211_channel *channel)
3165 {
3166         struct sk_buff *skb;
3167
3168         skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
3169                                         ssid, ssid_len, NULL, 0,
3170                                         IEEE80211_PROBE_FLAG_DIRECTED);
3171         if (skb)
3172                 ieee80211_tx_skb(sdata, skb);
3173 }
3174
3175 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
3176 {
3177         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3178         u8 *dst = sdata->vif.cfg.ap_addr;
3179         u8 unicast_limit = max(1, max_probe_tries - 3);
3180         struct sta_info *sta;
3181
3182         if (WARN_ON(sdata->vif.valid_links))
3183                 return;
3184
3185         /*
3186          * Try sending broadcast probe requests for the last three
3187          * probe requests after the first ones failed since some
3188          * buggy APs only support broadcast probe requests.
3189          */
3190         if (ifmgd->probe_send_count >= unicast_limit)
3191                 dst = NULL;
3192
3193         /*
3194          * When the hardware reports an accurate Tx ACK status, it's
3195          * better to send a nullfunc frame instead of a probe request,
3196          * as it will kick us off the AP quickly if we aren't associated
3197          * anymore. The timeout will be reset if the frame is ACKed by
3198          * the AP.
3199          */
3200         ifmgd->probe_send_count++;
3201
3202         if (dst) {
3203                 mutex_lock(&sdata->local->sta_mtx);
3204                 sta = sta_info_get(sdata, dst);
3205                 if (!WARN_ON(!sta))
3206                         ieee80211_check_fast_rx(sta);
3207                 mutex_unlock(&sdata->local->sta_mtx);
3208         }
3209
3210         if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
3211                 ifmgd->nullfunc_failed = false;
3212                 ieee80211_send_nullfunc(sdata->local, sdata, false);
3213         } else {
3214                 ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
3215                                               sdata->vif.cfg.ssid,
3216                                               sdata->vif.cfg.ssid_len,
3217                                               sdata->deflink.u.mgd.bss->channel);
3218         }
3219
3220         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
3221         run_again(sdata, ifmgd->probe_timeout);
3222 }
3223
3224 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
3225                                    bool beacon)
3226 {
3227         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3228         bool already = false;
3229
3230         if (WARN_ON_ONCE(sdata->vif.valid_links))
3231                 return;
3232
3233         if (!ieee80211_sdata_running(sdata))
3234                 return;
3235
3236         sdata_lock(sdata);
3237
3238         if (!ifmgd->associated)
3239                 goto out;
3240
3241         mutex_lock(&sdata->local->mtx);
3242
3243         if (sdata->local->tmp_channel || sdata->local->scanning) {
3244                 mutex_unlock(&sdata->local->mtx);
3245                 goto out;
3246         }
3247
3248         if (sdata->local->suspending) {
3249                 /* reschedule after resume */
3250                 mutex_unlock(&sdata->local->mtx);
3251                 ieee80211_reset_ap_probe(sdata);
3252                 goto out;
3253         }
3254
3255         if (beacon) {
3256                 mlme_dbg_ratelimited(sdata,
3257                                      "detected beacon loss from AP (missed %d beacons) - probing\n",
3258                                      beacon_loss_count);
3259
3260                 ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
3261         }
3262
3263         /*
3264          * The driver/our work has already reported this event or the
3265          * connection monitoring has kicked in and we have already sent
3266          * a probe request. Or maybe the AP died and the driver keeps
3267          * reporting until we disassociate...
3268          *
3269          * In either case we have to ignore the current call to this
3270          * function (except for setting the correct probe reason bit)
3271          * because otherwise we would reset the timer every time and
3272          * never check whether we received a probe response!
3273          */
3274         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
3275                 already = true;
3276
3277         ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
3278
3279         mutex_unlock(&sdata->local->mtx);
3280
3281         if (already)
3282                 goto out;
3283
3284         mutex_lock(&sdata->local->iflist_mtx);
3285         ieee80211_recalc_ps(sdata->local);
3286         mutex_unlock(&sdata->local->iflist_mtx);
3287
3288         ifmgd->probe_send_count = 0;
3289         ieee80211_mgd_probe_ap_send(sdata);
3290  out:
3291         sdata_unlock(sdata);
3292 }
3293
3294 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
3295                                           struct ieee80211_vif *vif)
3296 {
3297         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3298         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3299         struct cfg80211_bss *cbss;
3300         struct sk_buff *skb;
3301         const struct element *ssid;
3302         int ssid_len;
3303
3304         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
3305                     sdata->vif.valid_links))
3306                 return NULL;
3307
3308         sdata_assert_lock(sdata);
3309
3310         if (ifmgd->associated)
3311                 cbss = sdata->deflink.u.mgd.bss;
3312         else if (ifmgd->auth_data)
3313                 cbss = ifmgd->auth_data->bss;
3314         else if (ifmgd->assoc_data && ifmgd->assoc_data->link[0].bss)
3315                 cbss = ifmgd->assoc_data->link[0].bss;
3316         else
3317                 return NULL;
3318
3319         rcu_read_lock();
3320         ssid = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
3321         if (WARN_ONCE(!ssid || ssid->datalen > IEEE80211_MAX_SSID_LEN,
3322                       "invalid SSID element (len=%d)",
3323                       ssid ? ssid->datalen : -1))
3324                 ssid_len = 0;
3325         else
3326                 ssid_len = ssid->datalen;
3327
3328         skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
3329                                         (u32) -1, cbss->channel,
3330                                         ssid->data, ssid_len,
3331                                         NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
3332         rcu_read_unlock();
3333
3334         return skb;
3335 }
3336 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
3337
3338 static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
3339                                         const u8 *buf, size_t len, bool tx,
3340                                         u16 reason, bool reconnect)
3341 {
3342         struct ieee80211_event event = {
3343                 .type = MLME_EVENT,
3344                 .u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
3345                 .u.mlme.reason = reason,
3346         };
3347
3348         if (tx)
3349                 cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
3350         else
3351                 cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
3352
3353         drv_event_callback(sdata->local, sdata, &event);
3354 }
3355
3356 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
3357 {
3358         struct ieee80211_local *local = sdata->local;
3359         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3360         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3361         bool tx;
3362
3363         sdata_lock(sdata);
3364         if (!ifmgd->associated) {
3365                 sdata_unlock(sdata);
3366                 return;
3367         }
3368
3369         /* in MLO assume we have a link where we can TX the frame */
3370         tx = sdata->vif.valid_links || !sdata->deflink.csa_block_tx;
3371
3372         if (!ifmgd->driver_disconnect) {
3373                 unsigned int link_id;
3374
3375                 /*
3376                  * AP is probably out of range (or not reachable for another
3377                  * reason) so remove the bss structs for that AP. In the case
3378                  * of multi-link, it's not clear that all of them really are
3379                  * out of range, but if they weren't the driver likely would
3380                  * have switched to just have a single link active?
3381                  */
3382                 for (link_id = 0;
3383                      link_id < ARRAY_SIZE(sdata->link);
3384                      link_id++) {
3385                         struct ieee80211_link_data *link;
3386
3387                         link = sdata_dereference(sdata->link[link_id], sdata);
3388                         if (!link)
3389                                 continue;
3390                         cfg80211_unlink_bss(local->hw.wiphy, link->u.mgd.bss);
3391                         link->u.mgd.bss = NULL;
3392                 }
3393         }
3394
3395         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3396                                ifmgd->driver_disconnect ?
3397                                         WLAN_REASON_DEAUTH_LEAVING :
3398                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3399                                tx, frame_buf);
3400         mutex_lock(&local->mtx);
3401         /* the other links will be destroyed */
3402         sdata->vif.bss_conf.csa_active = false;
3403         sdata->deflink.u.mgd.csa_waiting_bcn = false;
3404         if (sdata->deflink.csa_block_tx) {
3405                 ieee80211_wake_vif_queues(local, sdata,
3406                                           IEEE80211_QUEUE_STOP_REASON_CSA);
3407                 sdata->deflink.csa_block_tx = false;
3408         }
3409         mutex_unlock(&local->mtx);
3410
3411         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
3412                                     WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3413                                     ifmgd->reconnect);
3414         ifmgd->reconnect = false;
3415
3416         sdata_unlock(sdata);
3417 }
3418
3419 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
3420 {
3421         struct ieee80211_sub_if_data *sdata =
3422                 container_of(work, struct ieee80211_sub_if_data,
3423                              u.mgd.beacon_connection_loss_work);
3424         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3425
3426         if (ifmgd->connection_loss) {
3427                 sdata_info(sdata, "Connection to AP %pM lost\n",
3428                            sdata->vif.cfg.ap_addr);
3429                 __ieee80211_disconnect(sdata);
3430                 ifmgd->connection_loss = false;
3431         } else if (ifmgd->driver_disconnect) {
3432                 sdata_info(sdata,
3433                            "Driver requested disconnection from AP %pM\n",
3434                            sdata->vif.cfg.ap_addr);
3435                 __ieee80211_disconnect(sdata);
3436                 ifmgd->driver_disconnect = false;
3437         } else {
3438                 if (ifmgd->associated)
3439                         sdata->deflink.u.mgd.beacon_loss_count++;
3440                 ieee80211_mgd_probe_ap(sdata, true);
3441         }
3442 }
3443
3444 static void ieee80211_csa_connection_drop_work(struct work_struct *work)
3445 {
3446         struct ieee80211_sub_if_data *sdata =
3447                 container_of(work, struct ieee80211_sub_if_data,
3448                              u.mgd.csa_connection_drop_work);
3449
3450         __ieee80211_disconnect(sdata);
3451 }
3452
3453 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
3454 {
3455         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3456         struct ieee80211_hw *hw = &sdata->local->hw;
3457
3458         trace_api_beacon_loss(sdata);
3459
3460         sdata->u.mgd.connection_loss = false;
3461         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
3462 }
3463 EXPORT_SYMBOL(ieee80211_beacon_loss);
3464
3465 void ieee80211_connection_loss(struct ieee80211_vif *vif)
3466 {
3467         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3468         struct ieee80211_hw *hw = &sdata->local->hw;
3469
3470         trace_api_connection_loss(sdata);
3471
3472         sdata->u.mgd.connection_loss = true;
3473         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
3474 }
3475 EXPORT_SYMBOL(ieee80211_connection_loss);
3476
3477 void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
3478 {
3479         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3480         struct ieee80211_hw *hw = &sdata->local->hw;
3481
3482         trace_api_disconnect(sdata, reconnect);
3483
3484         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
3485                 return;
3486
3487         sdata->u.mgd.driver_disconnect = true;
3488         sdata->u.mgd.reconnect = reconnect;
3489         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
3490 }
3491 EXPORT_SYMBOL(ieee80211_disconnect);
3492
3493 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
3494                                         bool assoc)
3495 {
3496         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3497
3498         sdata_assert_lock(sdata);
3499
3500         if (!assoc) {
3501                 /*
3502                  * we are not authenticated yet, the only timer that could be
3503                  * running is the timeout for the authentication response which
3504                  * which is not relevant anymore.
3505                  */
3506                 del_timer_sync(&sdata->u.mgd.timer);
3507                 sta_info_destroy_addr(sdata, auth_data->ap_addr);
3508
3509                 /* other links are destroyed */
3510                 sdata->deflink.u.mgd.conn_flags = 0;
3511                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
3512                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3513                                                   BSS_CHANGED_BSSID);
3514                 sdata->u.mgd.flags = 0;
3515
3516                 mutex_lock(&sdata->local->mtx);
3517                 ieee80211_link_release_channel(&sdata->deflink);
3518                 ieee80211_vif_set_links(sdata, 0);
3519                 mutex_unlock(&sdata->local->mtx);
3520         }
3521
3522         cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
3523         kfree(auth_data);
3524         sdata->u.mgd.auth_data = NULL;
3525 }
3526
3527 enum assoc_status {
3528         ASSOC_SUCCESS,
3529         ASSOC_REJECTED,
3530         ASSOC_TIMEOUT,
3531         ASSOC_ABANDON,
3532 };
3533
3534 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
3535                                          enum assoc_status status)
3536 {
3537         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3538
3539         sdata_assert_lock(sdata);
3540
3541         if (status != ASSOC_SUCCESS) {
3542                 /*
3543                  * we are not associated yet, the only timer that could be
3544                  * running is the timeout for the association response which
3545                  * which is not relevant anymore.
3546                  */
3547                 del_timer_sync(&sdata->u.mgd.timer);
3548                 sta_info_destroy_addr(sdata, assoc_data->ap_addr);
3549
3550                 sdata->deflink.u.mgd.conn_flags = 0;
3551                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
3552                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3553                                                   BSS_CHANGED_BSSID);
3554                 sdata->u.mgd.flags = 0;
3555                 sdata->vif.bss_conf.mu_mimo_owner = false;
3556
3557                 if (status != ASSOC_REJECTED) {
3558                         struct cfg80211_assoc_failure data = {
3559                                 .timeout = status == ASSOC_TIMEOUT,
3560                         };
3561                         int i;
3562
3563                         BUILD_BUG_ON(ARRAY_SIZE(data.bss) !=
3564                                      ARRAY_SIZE(assoc_data->link));
3565
3566                         for (i = 0; i < ARRAY_SIZE(data.bss); i++)
3567                                 data.bss[i] = assoc_data->link[i].bss;
3568
3569                         if (sdata->vif.valid_links)
3570                                 data.ap_mld_addr = assoc_data->ap_addr;
3571
3572                         cfg80211_assoc_failure(sdata->dev, &data);
3573                 }
3574
3575                 mutex_lock(&sdata->local->mtx);
3576                 ieee80211_link_release_channel(&sdata->deflink);
3577                 ieee80211_vif_set_links(sdata, 0);
3578                 mutex_unlock(&sdata->local->mtx);
3579         }
3580
3581         kfree(assoc_data);
3582         sdata->u.mgd.assoc_data = NULL;
3583 }
3584
3585 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
3586                                      struct ieee80211_mgmt *mgmt, size_t len)
3587 {
3588         struct ieee80211_local *local = sdata->local;
3589         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3590         const struct element *challenge;
3591         u8 *pos;
3592         u32 tx_flags = 0;
3593         struct ieee80211_prep_tx_info info = {
3594                 .subtype = IEEE80211_STYPE_AUTH,
3595         };
3596
3597         pos = mgmt->u.auth.variable;
3598         challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
3599                                        len - (pos - (u8 *)mgmt));
3600         if (!challenge)
3601                 return;
3602         auth_data->expected_transaction = 4;
3603         drv_mgd_prepare_tx(sdata->local, sdata, &info);
3604         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3605                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3606                            IEEE80211_TX_INTFL_MLME_CONN_TX;
3607         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
3608                             (void *)challenge,
3609                             challenge->datalen + sizeof(*challenge),
3610                             auth_data->ap_addr, auth_data->ap_addr,
3611                             auth_data->key, auth_data->key_len,
3612                             auth_data->key_idx, tx_flags);
3613 }
3614
3615 static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata)
3616 {
3617         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3618         const u8 *ap_addr = ifmgd->auth_data->ap_addr;
3619         struct sta_info *sta;
3620         bool result = true;
3621
3622         sdata_info(sdata, "authenticated\n");
3623         ifmgd->auth_data->done = true;
3624         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
3625         ifmgd->auth_data->timeout_started = true;
3626         run_again(sdata, ifmgd->auth_data->timeout);
3627
3628         /* move station state to auth */
3629         mutex_lock(&sdata->local->sta_mtx);
3630         sta = sta_info_get(sdata, ap_addr);
3631         if (!sta) {
3632                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, ap_addr);
3633                 result = false;
3634                 goto out;
3635         }
3636         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
3637                 sdata_info(sdata, "failed moving %pM to auth\n", ap_addr);
3638                 result = false;
3639                 goto out;
3640         }
3641
3642 out:
3643         mutex_unlock(&sdata->local->sta_mtx);
3644         return result;
3645 }
3646
3647 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
3648                                    struct ieee80211_mgmt *mgmt, size_t len)
3649 {
3650         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3651         u16 auth_alg, auth_transaction, status_code;
3652         struct ieee80211_event event = {
3653                 .type = MLME_EVENT,
3654                 .u.mlme.data = AUTH_EVENT,
3655         };
3656         struct ieee80211_prep_tx_info info = {
3657                 .subtype = IEEE80211_STYPE_AUTH,
3658         };
3659
3660         sdata_assert_lock(sdata);
3661
3662         if (len < 24 + 6)
3663                 return;
3664
3665         if (!ifmgd->auth_data || ifmgd->auth_data->done)
3666                 return;
3667
3668         if (!ether_addr_equal(ifmgd->auth_data->ap_addr, mgmt->bssid))
3669                 return;
3670
3671         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
3672         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
3673         status_code = le16_to_cpu(mgmt->u.auth.status_code);
3674
3675         if (auth_alg != ifmgd->auth_data->algorithm ||
3676             (auth_alg != WLAN_AUTH_SAE &&
3677              auth_transaction != ifmgd->auth_data->expected_transaction) ||
3678             (auth_alg == WLAN_AUTH_SAE &&
3679              (auth_transaction < ifmgd->auth_data->expected_transaction ||
3680               auth_transaction > 2))) {
3681                 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
3682                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
3683                            auth_transaction,
3684                            ifmgd->auth_data->expected_transaction);
3685                 goto notify_driver;
3686         }
3687
3688         if (status_code != WLAN_STATUS_SUCCESS) {
3689                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3690
3691                 if (auth_alg == WLAN_AUTH_SAE &&
3692                     (status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED ||
3693                      (auth_transaction == 1 &&
3694                       (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
3695                        status_code == WLAN_STATUS_SAE_PK)))) {
3696                         /* waiting for userspace now */
3697                         ifmgd->auth_data->waiting = true;
3698                         ifmgd->auth_data->timeout =
3699                                 jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY;
3700                         ifmgd->auth_data->timeout_started = true;
3701                         run_again(sdata, ifmgd->auth_data->timeout);
3702                         goto notify_driver;
3703                 }
3704
3705                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
3706                            mgmt->sa, status_code);
3707                 ieee80211_destroy_auth_data(sdata, false);
3708                 event.u.mlme.status = MLME_DENIED;
3709                 event.u.mlme.reason = status_code;
3710                 drv_event_callback(sdata->local, sdata, &event);
3711                 goto notify_driver;
3712         }
3713
3714         switch (ifmgd->auth_data->algorithm) {
3715         case WLAN_AUTH_OPEN:
3716         case WLAN_AUTH_LEAP:
3717         case WLAN_AUTH_FT:
3718         case WLAN_AUTH_SAE:
3719         case WLAN_AUTH_FILS_SK:
3720         case WLAN_AUTH_FILS_SK_PFS:
3721         case WLAN_AUTH_FILS_PK:
3722                 break;
3723         case WLAN_AUTH_SHARED_KEY:
3724                 if (ifmgd->auth_data->expected_transaction != 4) {
3725                         ieee80211_auth_challenge(sdata, mgmt, len);
3726                         /* need another frame */
3727                         return;
3728                 }
3729                 break;
3730         default:
3731                 WARN_ONCE(1, "invalid auth alg %d",
3732                           ifmgd->auth_data->algorithm);
3733                 goto notify_driver;
3734         }
3735
3736         event.u.mlme.status = MLME_SUCCESS;
3737         info.success = 1;
3738         drv_event_callback(sdata->local, sdata, &event);
3739         if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
3740             (auth_transaction == 2 &&
3741              ifmgd->auth_data->expected_transaction == 2)) {
3742                 if (!ieee80211_mark_sta_auth(sdata))
3743                         return; /* ignore frame -- wait for timeout */
3744         } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
3745                    auth_transaction == 2) {
3746                 sdata_info(sdata, "SAE peer confirmed\n");
3747                 ifmgd->auth_data->peer_confirmed = true;
3748         }
3749
3750         cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3751 notify_driver:
3752         drv_mgd_complete_tx(sdata->local, sdata, &info);
3753 }
3754
3755 #define case_WLAN(type) \
3756         case WLAN_REASON_##type: return #type
3757
3758 const char *ieee80211_get_reason_code_string(u16 reason_code)
3759 {
3760         switch (reason_code) {
3761         case_WLAN(UNSPECIFIED);
3762         case_WLAN(PREV_AUTH_NOT_VALID);
3763         case_WLAN(DEAUTH_LEAVING);
3764         case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
3765         case_WLAN(DISASSOC_AP_BUSY);
3766         case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
3767         case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
3768         case_WLAN(DISASSOC_STA_HAS_LEFT);
3769         case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
3770         case_WLAN(DISASSOC_BAD_POWER);
3771         case_WLAN(DISASSOC_BAD_SUPP_CHAN);
3772         case_WLAN(INVALID_IE);
3773         case_WLAN(MIC_FAILURE);
3774         case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
3775         case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
3776         case_WLAN(IE_DIFFERENT);
3777         case_WLAN(INVALID_GROUP_CIPHER);
3778         case_WLAN(INVALID_PAIRWISE_CIPHER);
3779         case_WLAN(INVALID_AKMP);
3780         case_WLAN(UNSUPP_RSN_VERSION);
3781         case_WLAN(INVALID_RSN_IE_CAP);
3782         case_WLAN(IEEE8021X_FAILED);
3783         case_WLAN(CIPHER_SUITE_REJECTED);
3784         case_WLAN(DISASSOC_UNSPECIFIED_QOS);
3785         case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
3786         case_WLAN(DISASSOC_LOW_ACK);
3787         case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
3788         case_WLAN(QSTA_LEAVE_QBSS);
3789         case_WLAN(QSTA_NOT_USE);
3790         case_WLAN(QSTA_REQUIRE_SETUP);
3791         case_WLAN(QSTA_TIMEOUT);
3792         case_WLAN(QSTA_CIPHER_NOT_SUPP);
3793         case_WLAN(MESH_PEER_CANCELED);
3794         case_WLAN(MESH_MAX_PEERS);
3795         case_WLAN(MESH_CONFIG);
3796         case_WLAN(MESH_CLOSE);
3797         case_WLAN(MESH_MAX_RETRIES);
3798         case_WLAN(MESH_CONFIRM_TIMEOUT);
3799         case_WLAN(MESH_INVALID_GTK);
3800         case_WLAN(MESH_INCONSISTENT_PARAM);
3801         case_WLAN(MESH_INVALID_SECURITY);
3802         case_WLAN(MESH_PATH_ERROR);
3803         case_WLAN(MESH_PATH_NOFORWARD);
3804         case_WLAN(MESH_PATH_DEST_UNREACHABLE);
3805         case_WLAN(MAC_EXISTS_IN_MBSS);
3806         case_WLAN(MESH_CHAN_REGULATORY);
3807         case_WLAN(MESH_CHAN);
3808         default: return "<unknown>";
3809         }
3810 }
3811
3812 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
3813                                      struct ieee80211_mgmt *mgmt, size_t len)
3814 {
3815         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3816         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3817
3818         sdata_assert_lock(sdata);
3819
3820         if (len < 24 + 2)
3821                 return;
3822
3823         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3824                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3825                 return;
3826         }
3827
3828         if (ifmgd->associated &&
3829             ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {
3830                 sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
3831                            sdata->vif.cfg.ap_addr, reason_code,
3832                            ieee80211_get_reason_code_string(reason_code));
3833
3834                 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3835
3836                 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
3837                                             reason_code, false);
3838                 return;
3839         }
3840
3841         if (ifmgd->assoc_data &&
3842             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->ap_addr)) {
3843                 sdata_info(sdata,
3844                            "deauthenticated from %pM while associating (Reason: %u=%s)\n",
3845                            ifmgd->assoc_data->ap_addr, reason_code,
3846                            ieee80211_get_reason_code_string(reason_code));
3847
3848                 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
3849
3850                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3851                 return;
3852         }
3853 }
3854
3855
3856 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
3857                                        struct ieee80211_mgmt *mgmt, size_t len)
3858 {
3859         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3860         u16 reason_code;
3861
3862         sdata_assert_lock(sdata);
3863
3864         if (len < 24 + 2)
3865                 return;
3866
3867         if (!ifmgd->associated ||
3868             !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
3869                 return;
3870
3871         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
3872
3873         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3874                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3875                 return;
3876         }
3877
3878         sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
3879                    sdata->vif.cfg.ap_addr, reason_code,
3880                    ieee80211_get_reason_code_string(reason_code));
3881
3882         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3883
3884         ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
3885                                     false);
3886 }
3887
3888 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
3889                                 u8 *supp_rates, unsigned int supp_rates_len,
3890                                 u32 *rates, u32 *basic_rates,
3891                                 bool *have_higher_than_11mbit,
3892                                 int *min_rate, int *min_rate_index,
3893                                 int shift)
3894 {
3895         int i, j;
3896
3897         for (i = 0; i < supp_rates_len; i++) {
3898                 int rate = supp_rates[i] & 0x7f;
3899                 bool is_basic = !!(supp_rates[i] & 0x80);
3900
3901                 if ((rate * 5 * (1 << shift)) > 110)
3902                         *have_higher_than_11mbit = true;
3903
3904                 /*
3905                  * Skip HT, VHT, HE and SAE H2E only BSS membership selectors
3906                  * since they're not rates.
3907                  *
3908                  * Note: Even though the membership selector and the basic
3909                  *       rate flag share the same bit, they are not exactly
3910                  *       the same.
3911                  */
3912                 if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3913                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
3914                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY) ||
3915                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E))
3916                         continue;
3917
3918                 for (j = 0; j < sband->n_bitrates; j++) {
3919                         struct ieee80211_rate *br;
3920                         int brate;
3921
3922                         br = &sband->bitrates[j];
3923
3924                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
3925                         if (brate == rate) {
3926                                 *rates |= BIT(j);
3927                                 if (is_basic)
3928                                         *basic_rates |= BIT(j);
3929                                 if ((rate * 5) < *min_rate) {
3930                                         *min_rate = rate * 5;
3931                                         *min_rate_index = j;
3932                                 }
3933                                 break;
3934                         }
3935                 }
3936         }
3937 }
3938
3939 static bool ieee80211_twt_req_supported(struct ieee80211_sub_if_data *sdata,
3940                                         struct ieee80211_supported_band *sband,
3941                                         const struct link_sta_info *link_sta,
3942                                         const struct ieee802_11_elems *elems)
3943 {
3944         const struct ieee80211_sta_he_cap *own_he_cap =
3945                 ieee80211_get_he_iftype_cap(sband,
3946                                             ieee80211_vif_type_p2p(&sdata->vif));
3947
3948         if (elems->ext_capab_len < 10)
3949                 return false;
3950
3951         if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
3952                 return false;
3953
3954         return link_sta->pub->he_cap.he_cap_elem.mac_cap_info[0] &
3955                 IEEE80211_HE_MAC_CAP0_TWT_RES &&
3956                 own_he_cap &&
3957                 (own_he_cap->he_cap_elem.mac_cap_info[0] &
3958                         IEEE80211_HE_MAC_CAP0_TWT_REQ);
3959 }
3960
3961 static int ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
3962                                     struct ieee80211_supported_band *sband,
3963                                     struct ieee80211_link_data *link,
3964                                     struct link_sta_info *link_sta,
3965                                     struct ieee802_11_elems *elems)
3966 {
3967         bool twt = ieee80211_twt_req_supported(sdata, sband, link_sta, elems);
3968
3969         if (link->conf->twt_requester != twt) {
3970                 link->conf->twt_requester = twt;
3971                 return BSS_CHANGED_TWT;
3972         }
3973         return 0;
3974 }
3975
3976 static bool ieee80211_twt_bcast_support(struct ieee80211_sub_if_data *sdata,
3977                                         struct ieee80211_bss_conf *bss_conf,
3978                                         struct ieee80211_supported_band *sband,
3979                                         struct link_sta_info *link_sta)
3980 {
3981         const struct ieee80211_sta_he_cap *own_he_cap =
3982                 ieee80211_get_he_iftype_cap(sband,
3983                                             ieee80211_vif_type_p2p(&sdata->vif));
3984
3985         return bss_conf->he_support &&
3986                 (link_sta->pub->he_cap.he_cap_elem.mac_cap_info[2] &
3987                         IEEE80211_HE_MAC_CAP2_BCAST_TWT) &&
3988                 own_he_cap &&
3989                 (own_he_cap->he_cap_elem.mac_cap_info[2] &
3990                         IEEE80211_HE_MAC_CAP2_BCAST_TWT);
3991 }
3992
3993 static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
3994                                         struct link_sta_info *link_sta,
3995                                         struct cfg80211_bss *cbss,
3996                                         struct ieee80211_mgmt *mgmt,
3997                                         const u8 *elem_start,
3998                                         unsigned int elem_len,
3999                                         u64 *changed)
4000 {
4001         struct ieee80211_sub_if_data *sdata = link->sdata;
4002         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
4003         struct ieee80211_bss_conf *bss_conf = link->conf;
4004         struct ieee80211_local *local = sdata->local;
4005         unsigned int link_id = link->link_id;
4006         struct ieee80211_elems_parse_params parse_params = {
4007                 .start = elem_start,
4008                 .len = elem_len,
4009                 .link_id = link_id == assoc_data->assoc_link_id ? -1 : link_id,
4010                 .from_ap = true,
4011         };
4012         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4013         bool is_s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
4014         const struct cfg80211_bss_ies *bss_ies = NULL;
4015         struct ieee80211_supported_band *sband;
4016         struct ieee802_11_elems *elems;
4017         u16 capab_info;
4018         bool ret;
4019
4020         elems = ieee802_11_parse_elems_full(&parse_params);
4021         if (!elems)
4022                 return false;
4023
4024         if (link_id == assoc_data->assoc_link_id) {
4025                 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
4026
4027                 /*
4028                  * we should not get to this flow unless the association was
4029                  * successful, so set the status directly to success
4030                  */
4031                 assoc_data->link[link_id].status = WLAN_STATUS_SUCCESS;
4032         } else if (!elems->prof) {
4033                 ret = false;
4034                 goto out;
4035         } else {
4036                 const u8 *ptr = elems->prof->variable +
4037                                 elems->prof->sta_info_len - 1;
4038
4039                 /*
4040                  * During parsing, we validated that these fields exist,
4041                  * otherwise elems->prof would have been set to NULL.
4042                  */
4043                 capab_info = get_unaligned_le16(ptr);
4044                 assoc_data->link[link_id].status = get_unaligned_le16(ptr + 2);
4045
4046                 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
4047                         link_info(link, "association response status code=%u\n",
4048                                   assoc_data->link[link_id].status);
4049                         ret = true;
4050                         goto out;
4051                 }
4052         }
4053
4054         if (!is_s1g && !elems->supp_rates) {
4055                 sdata_info(sdata, "no SuppRates element in AssocResp\n");
4056                 ret = false;
4057                 goto out;
4058         }
4059
4060         link->u.mgd.tdls_chan_switch_prohibited =
4061                 elems->ext_capab && elems->ext_capab_len >= 5 &&
4062                 (elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
4063
4064         /*
4065          * Some APs are erroneously not including some information in their
4066          * (re)association response frames. Try to recover by using the data
4067          * from the beacon or probe response. This seems to afflict mobile
4068          * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
4069          * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
4070          */
4071         if (!is_6ghz &&
4072             ((assoc_data->wmm && !elems->wmm_param) ||
4073              (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
4074               (!elems->ht_cap_elem || !elems->ht_operation)) ||
4075              (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
4076               (!elems->vht_cap_elem || !elems->vht_operation)))) {
4077                 const struct cfg80211_bss_ies *ies;
4078                 struct ieee802_11_elems *bss_elems;
4079
4080                 rcu_read_lock();
4081                 ies = rcu_dereference(cbss->ies);
4082                 if (ies)
4083                         bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
4084                                           GFP_ATOMIC);
4085                 rcu_read_unlock();
4086                 if (!bss_ies) {
4087                         ret = false;
4088                         goto out;
4089                 }
4090
4091                 parse_params.start = bss_ies->data;
4092                 parse_params.len = bss_ies->len;
4093                 parse_params.bss = cbss;
4094                 bss_elems = ieee802_11_parse_elems_full(&parse_params);
4095                 if (!bss_elems) {
4096                         ret = false;
4097                         goto out;
4098                 }
4099
4100                 if (assoc_data->wmm &&
4101                     !elems->wmm_param && bss_elems->wmm_param) {
4102                         elems->wmm_param = bss_elems->wmm_param;
4103                         sdata_info(sdata,
4104                                    "AP bug: WMM param missing from AssocResp\n");
4105                 }
4106
4107                 /*
4108                  * Also check if we requested HT/VHT, otherwise the AP doesn't
4109                  * have to include the IEs in the (re)association response.
4110                  */
4111                 if (!elems->ht_cap_elem && bss_elems->ht_cap_elem &&
4112                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
4113                         elems->ht_cap_elem = bss_elems->ht_cap_elem;
4114                         sdata_info(sdata,
4115                                    "AP bug: HT capability missing from AssocResp\n");
4116                 }
4117                 if (!elems->ht_operation && bss_elems->ht_operation &&
4118                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
4119                         elems->ht_operation = bss_elems->ht_operation;
4120                         sdata_info(sdata,
4121                                    "AP bug: HT operation missing from AssocResp\n");
4122                 }
4123                 if (!elems->vht_cap_elem && bss_elems->vht_cap_elem &&
4124                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4125                         elems->vht_cap_elem = bss_elems->vht_cap_elem;
4126                         sdata_info(sdata,
4127                                    "AP bug: VHT capa missing from AssocResp\n");
4128                 }
4129                 if (!elems->vht_operation && bss_elems->vht_operation &&
4130                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4131                         elems->vht_operation = bss_elems->vht_operation;
4132                         sdata_info(sdata,
4133                                    "AP bug: VHT operation missing from AssocResp\n");
4134                 }
4135
4136                 kfree(bss_elems);
4137         }
4138
4139         /*
4140          * We previously checked these in the beacon/probe response, so
4141          * they should be present here. This is just a safety net.
4142          */
4143         if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
4144             (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
4145                 sdata_info(sdata,
4146                            "HT AP is missing WMM params or HT capability/operation\n");
4147                 ret = false;
4148                 goto out;
4149         }
4150
4151         if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
4152             (!elems->vht_cap_elem || !elems->vht_operation)) {
4153                 sdata_info(sdata,
4154                            "VHT AP is missing VHT capability/operation\n");
4155                 ret = false;
4156                 goto out;
4157         }
4158
4159         if (is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4160             !elems->he_6ghz_capa) {
4161                 sdata_info(sdata,
4162                            "HE 6 GHz AP is missing HE 6 GHz band capability\n");
4163                 ret = false;
4164                 goto out;
4165         }
4166
4167         if (WARN_ON(!link->conf->chandef.chan)) {
4168                 ret = false;
4169                 goto out;
4170         }
4171         sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
4172
4173         if (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4174             (!elems->he_cap || !elems->he_operation)) {
4175                 sdata_info(sdata,
4176                            "HE AP is missing HE capability/operation\n");
4177                 ret = false;
4178                 goto out;
4179         }
4180
4181         /* Set up internal HT/VHT capabilities */
4182         if (elems->ht_cap_elem && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT))
4183                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
4184                                                   elems->ht_cap_elem,
4185                                                   link_sta);
4186
4187         if (elems->vht_cap_elem && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT))
4188                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
4189                                                     elems->vht_cap_elem,
4190                                                     link_sta);
4191
4192         if (elems->he_operation && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4193             elems->he_cap) {
4194                 ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
4195                                                   elems->he_cap,
4196                                                   elems->he_cap_len,
4197                                                   elems->he_6ghz_capa,
4198                                                   link_sta);
4199
4200                 bss_conf->he_support = link_sta->pub->he_cap.has_he;
4201                 if (elems->rsnx && elems->rsnx_len &&
4202                     (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
4203                     wiphy_ext_feature_isset(local->hw.wiphy,
4204                                             NL80211_EXT_FEATURE_PROTECTED_TWT))
4205                         bss_conf->twt_protected = true;
4206                 else
4207                         bss_conf->twt_protected = false;
4208
4209                 *changed |= ieee80211_recalc_twt_req(sdata, sband, link,
4210                                                      link_sta, elems);
4211
4212                 if (elems->eht_operation && elems->eht_cap &&
4213                     !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
4214                         ieee80211_eht_cap_ie_to_sta_eht_cap(sdata, sband,
4215                                                             elems->he_cap,
4216                                                             elems->he_cap_len,
4217                                                             elems->eht_cap,
4218                                                             elems->eht_cap_len,
4219                                                             link_sta);
4220
4221                         bss_conf->eht_support = link_sta->pub->eht_cap.has_eht;
4222                         *changed |= BSS_CHANGED_EHT_PUNCTURING;
4223                 } else {
4224                         bss_conf->eht_support = false;
4225                 }
4226         } else {
4227                 bss_conf->he_support = false;
4228                 bss_conf->twt_requester = false;
4229                 bss_conf->twt_protected = false;
4230                 bss_conf->eht_support = false;
4231         }
4232
4233         bss_conf->twt_broadcast =
4234                 ieee80211_twt_bcast_support(sdata, bss_conf, sband, link_sta);
4235
4236         if (bss_conf->he_support) {
4237                 bss_conf->he_bss_color.color =
4238                         le32_get_bits(elems->he_operation->he_oper_params,
4239                                       IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
4240                 bss_conf->he_bss_color.partial =
4241                         le32_get_bits(elems->he_operation->he_oper_params,
4242                                       IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
4243                 bss_conf->he_bss_color.enabled =
4244                         !le32_get_bits(elems->he_operation->he_oper_params,
4245                                        IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
4246
4247                 if (bss_conf->he_bss_color.enabled)
4248                         *changed |= BSS_CHANGED_HE_BSS_COLOR;
4249
4250                 bss_conf->htc_trig_based_pkt_ext =
4251                         le32_get_bits(elems->he_operation->he_oper_params,
4252                                       IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
4253                 bss_conf->frame_time_rts_th =
4254                         le32_get_bits(elems->he_operation->he_oper_params,
4255                                       IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
4256
4257                 bss_conf->uora_exists = !!elems->uora_element;
4258                 if (elems->uora_element)
4259                         bss_conf->uora_ocw_range = elems->uora_element[0];
4260
4261                 ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
4262                 ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
4263                 /* TODO: OPEN: what happens if BSS color disable is set? */
4264         }
4265
4266         if (cbss->transmitted_bss) {
4267                 bss_conf->nontransmitted = true;
4268                 ether_addr_copy(bss_conf->transmitter_bssid,
4269                                 cbss->transmitted_bss->bssid);
4270                 bss_conf->bssid_indicator = cbss->max_bssid_indicator;
4271                 bss_conf->bssid_index = cbss->bssid_index;
4272         }
4273
4274         /*
4275          * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
4276          * in their association response, so ignore that data for our own
4277          * configuration. If it changed since the last beacon, we'll get the
4278          * next beacon and update then.
4279          */
4280
4281         /*
4282          * If an operating mode notification IE is present, override the
4283          * NSS calculation (that would be done in rate_control_rate_init())
4284          * and use the # of streams from that element.
4285          */
4286         if (elems->opmode_notif &&
4287             !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
4288                 u8 nss;
4289
4290                 nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
4291                 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
4292                 nss += 1;
4293                 link_sta->pub->rx_nss = nss;
4294         }
4295
4296         /*
4297          * Always handle WMM once after association regardless
4298          * of the first value the AP uses. Setting -1 here has
4299          * that effect because the AP values is an unsigned
4300          * 4-bit value.
4301          */
4302         link->u.mgd.wmm_last_param_set = -1;
4303         link->u.mgd.mu_edca_last_param_set = -1;
4304
4305         if (link->u.mgd.disable_wmm_tracking) {
4306                 ieee80211_set_wmm_default(link, false, false);
4307         } else if (!ieee80211_sta_wmm_params(local, link, elems->wmm_param,
4308                                              elems->wmm_param_len,
4309                                              elems->mu_edca_param_set)) {
4310                 /* still enable QoS since we might have HT/VHT */
4311                 ieee80211_set_wmm_default(link, false, true);
4312                 /* disable WMM tracking in this case to disable
4313                  * tracking WMM parameter changes in the beacon if
4314                  * the parameters weren't actually valid. Doing so
4315                  * avoids changing parameters very strangely when
4316                  * the AP is going back and forth between valid and
4317                  * invalid parameters.
4318                  */
4319                 link->u.mgd.disable_wmm_tracking = true;
4320         }
4321
4322         if (elems->max_idle_period_ie) {
4323                 bss_conf->max_idle_period =
4324                         le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
4325                 bss_conf->protected_keep_alive =
4326                         !!(elems->max_idle_period_ie->idle_options &
4327                            WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
4328                 *changed |= BSS_CHANGED_KEEP_ALIVE;
4329         } else {
4330                 bss_conf->max_idle_period = 0;
4331                 bss_conf->protected_keep_alive = false;
4332         }
4333
4334         /* set assoc capability (AID was already set earlier),
4335          * ieee80211_set_associated() will tell the driver */
4336         bss_conf->assoc_capability = capab_info;
4337
4338         ret = true;
4339 out:
4340         kfree(elems);
4341         kfree(bss_ies);
4342         return ret;
4343 }
4344
4345 static int ieee80211_mgd_setup_link_sta(struct ieee80211_link_data *link,
4346                                         struct sta_info *sta,
4347                                         struct link_sta_info *link_sta,
4348                                         struct cfg80211_bss *cbss)
4349 {
4350         struct ieee80211_sub_if_data *sdata = link->sdata;
4351         struct ieee80211_local *local = sdata->local;
4352         struct ieee80211_bss *bss = (void *)cbss->priv;
4353         u32 rates = 0, basic_rates = 0;
4354         bool have_higher_than_11mbit = false;
4355         int min_rate = INT_MAX, min_rate_index = -1;
4356         /* this is clearly wrong for MLO but we'll just remove it later */
4357         int shift = ieee80211_vif_get_shift(&sdata->vif);
4358         struct ieee80211_supported_band *sband;
4359
4360         memcpy(link_sta->addr, cbss->bssid, ETH_ALEN);
4361         memcpy(link_sta->pub->addr, cbss->bssid, ETH_ALEN);
4362
4363         /* TODO: S1G Basic Rate Set is expressed elsewhere */
4364         if (cbss->channel->band == NL80211_BAND_S1GHZ) {
4365                 ieee80211_s1g_sta_rate_init(sta);
4366                 return 0;
4367         }
4368
4369         sband = local->hw.wiphy->bands[cbss->channel->band];
4370
4371         ieee80211_get_rates(sband, bss->supp_rates, bss->supp_rates_len,
4372                             &rates, &basic_rates, &have_higher_than_11mbit,
4373                             &min_rate, &min_rate_index, shift);
4374
4375         /*
4376          * This used to be a workaround for basic rates missing
4377          * in the association response frame. Now that we no
4378          * longer use the basic rates from there, it probably
4379          * doesn't happen any more, but keep the workaround so
4380          * in case some *other* APs are buggy in different ways
4381          * we can connect -- with a warning.
4382          * Allow this workaround only in case the AP provided at least
4383          * one rate.
4384          */
4385         if (min_rate_index < 0) {
4386                 link_info(link, "No legacy rates in association response\n");
4387                 return -EINVAL;
4388         } else if (!basic_rates) {
4389                 link_info(link, "No basic rates, using min rate instead\n");
4390                 basic_rates = BIT(min_rate_index);
4391         }
4392
4393         if (rates)
4394                 link_sta->pub->supp_rates[cbss->channel->band] = rates;
4395         else
4396                 link_info(link, "No rates found, keeping mandatory only\n");
4397
4398         link->conf->basic_rates = basic_rates;
4399
4400         /* cf. IEEE 802.11 9.2.12 */
4401         link->operating_11g_mode = sband->band == NL80211_BAND_2GHZ &&
4402                                    have_higher_than_11mbit;
4403
4404         return 0;
4405 }
4406
4407 static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
4408                                   struct cfg80211_bss *cbss)
4409 {
4410         struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
4411         const struct element *ht_cap_elem, *vht_cap_elem;
4412         const struct cfg80211_bss_ies *ies;
4413         const struct ieee80211_ht_cap *ht_cap;
4414         const struct ieee80211_vht_cap *vht_cap;
4415         const struct ieee80211_he_cap_elem *he_cap;
4416         const struct element *he_cap_elem;
4417         u16 mcs_80_map, mcs_160_map;
4418         int i, mcs_nss_size;
4419         bool support_160;
4420         u8 chains = 1;
4421
4422         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)
4423                 return chains;
4424
4425         ht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_CAPABILITY);
4426         if (ht_cap_elem && ht_cap_elem->datalen >= sizeof(*ht_cap)) {
4427                 ht_cap = (void *)ht_cap_elem->data;
4428                 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
4429                 /*
4430                  * TODO: use "Tx Maximum Number Spatial Streams Supported" and
4431                  *       "Tx Unequal Modulation Supported" fields.
4432                  */
4433         }
4434
4435         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
4436                 return chains;
4437
4438         vht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
4439         if (vht_cap_elem && vht_cap_elem->datalen >= sizeof(*vht_cap)) {
4440                 u8 nss;
4441                 u16 tx_mcs_map;
4442
4443                 vht_cap = (void *)vht_cap_elem->data;
4444                 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
4445                 for (nss = 8; nss > 0; nss--) {
4446                         if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
4447                                         IEEE80211_VHT_MCS_NOT_SUPPORTED)
4448                                 break;
4449                 }
4450                 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
4451                 chains = max(chains, nss);
4452         }
4453
4454         if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE)
4455                 return chains;
4456
4457         ies = rcu_dereference(cbss->ies);
4458         he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
4459                                              ies->data, ies->len);
4460
4461         if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
4462                 return chains;
4463
4464         /* skip one byte ext_tag_id */
4465         he_cap = (void *)(he_cap_elem->data + 1);
4466         mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
4467
4468         /* invalid HE IE */
4469         if (he_cap_elem->datalen < 1 + mcs_nss_size + sizeof(*he_cap))
4470                 return chains;
4471
4472         /* mcs_nss is right after he_cap info */
4473         he_mcs_nss_supp = (void *)(he_cap + 1);
4474
4475         mcs_80_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
4476
4477         for (i = 7; i >= 0; i--) {
4478                 u8 mcs_80 = mcs_80_map >> (2 * i) & 3;
4479
4480                 if (mcs_80 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4481                         chains = max_t(u8, chains, i + 1);
4482                         break;
4483                 }
4484         }
4485
4486         support_160 = he_cap->phy_cap_info[0] &
4487                       IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
4488
4489         if (!support_160)
4490                 return chains;
4491
4492         mcs_160_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_160);
4493         for (i = 7; i >= 0; i--) {
4494                 u8 mcs_160 = mcs_160_map >> (2 * i) & 3;
4495
4496                 if (mcs_160 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4497                         chains = max_t(u8, chains, i + 1);
4498                         break;
4499                 }
4500         }
4501
4502         return chains;
4503 }
4504
4505 static bool
4506 ieee80211_verify_peer_he_mcs_support(struct ieee80211_sub_if_data *sdata,
4507                                      const struct cfg80211_bss_ies *ies,
4508                                      const struct ieee80211_he_operation *he_op)
4509 {
4510         const struct element *he_cap_elem;
4511         const struct ieee80211_he_cap_elem *he_cap;
4512         struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
4513         u16 mcs_80_map_tx, mcs_80_map_rx;
4514         u16 ap_min_req_set;
4515         int mcs_nss_size;
4516         int nss;
4517
4518         he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
4519                                              ies->data, ies->len);
4520
4521         if (!he_cap_elem)
4522                 return false;
4523
4524         /* invalid HE IE */
4525         if (he_cap_elem->datalen < 1 + sizeof(*he_cap)) {
4526                 sdata_info(sdata,
4527                            "Invalid HE elem, Disable HE\n");
4528                 return false;
4529         }
4530
4531         /* skip one byte ext_tag_id */
4532         he_cap = (void *)(he_cap_elem->data + 1);
4533         mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
4534
4535         /* invalid HE IE */
4536         if (he_cap_elem->datalen < 1 + sizeof(*he_cap) + mcs_nss_size) {
4537                 sdata_info(sdata,
4538                            "Invalid HE elem with nss size, Disable HE\n");
4539                 return false;
4540         }
4541
4542         /* mcs_nss is right after he_cap info */
4543         he_mcs_nss_supp = (void *)(he_cap + 1);
4544
4545         mcs_80_map_tx = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
4546         mcs_80_map_rx = le16_to_cpu(he_mcs_nss_supp->rx_mcs_80);
4547
4548         /* P802.11-REVme/D0.3
4549          * 27.1.1 Introduction to the HE PHY
4550          * ...
4551          * An HE STA shall support the following features:
4552          * ...
4553          * Single spatial stream HE-MCSs 0 to 7 (transmit and receive) in all
4554          * supported channel widths for HE SU PPDUs
4555          */
4556         if ((mcs_80_map_tx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4557             (mcs_80_map_rx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED) {
4558                 sdata_info(sdata,
4559                            "Missing mandatory rates for 1 Nss, rx 0x%x, tx 0x%x, disable HE\n",
4560                            mcs_80_map_tx, mcs_80_map_rx);
4561                 return false;
4562         }
4563
4564         if (!he_op)
4565                 return true;
4566
4567         ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
4568
4569         /*
4570          * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
4571          * zeroes, which is nonsense, and completely inconsistent with itself
4572          * (it doesn't have 8 streams). Accept the settings in this case anyway.
4573          */
4574         if (!ap_min_req_set)
4575                 return true;
4576
4577         /* make sure the AP is consistent with itself
4578          *
4579          * P802.11-REVme/D0.3
4580          * 26.17.1 Basic HE BSS operation
4581          *
4582          * A STA that is operating in an HE BSS shall be able to receive and
4583          * transmit at each of the <HE-MCS, NSS> tuple values indicated by the
4584          * Basic HE-MCS And NSS Set field of the HE Operation parameter of the
4585          * MLME-START.request primitive and shall be able to receive at each of
4586          * the <HE-MCS, NSS> tuple values indicated by the Supported HE-MCS and
4587          * NSS Set field in the HE Capabilities parameter of the MLMESTART.request
4588          * primitive
4589          */
4590         for (nss = 8; nss > 0; nss--) {
4591                 u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
4592                 u8 ap_rx_val;
4593                 u8 ap_tx_val;
4594
4595                 if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
4596                         continue;
4597
4598                 ap_rx_val = (mcs_80_map_rx >> (2 * (nss - 1))) & 3;
4599                 ap_tx_val = (mcs_80_map_tx >> (2 * (nss - 1))) & 3;
4600
4601                 if (ap_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4602                     ap_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4603                     ap_rx_val < ap_op_val || ap_tx_val < ap_op_val) {
4604                         sdata_info(sdata,
4605                                    "Invalid rates for %d Nss, rx %d, tx %d oper %d, disable HE\n",
4606                                    nss, ap_rx_val, ap_rx_val, ap_op_val);
4607                         return false;
4608                 }
4609         }
4610
4611         return true;
4612 }
4613
4614 static bool
4615 ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
4616                                     struct ieee80211_supported_band *sband,
4617                                     const struct ieee80211_he_operation *he_op)
4618 {
4619         const struct ieee80211_sta_he_cap *sta_he_cap =
4620                 ieee80211_get_he_iftype_cap(sband,
4621                                             ieee80211_vif_type_p2p(&sdata->vif));
4622         u16 ap_min_req_set;
4623         int i;
4624
4625         if (!sta_he_cap || !he_op)
4626                 return false;
4627
4628         ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
4629
4630         /*
4631          * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
4632          * zeroes, which is nonsense, and completely inconsistent with itself
4633          * (it doesn't have 8 streams). Accept the settings in this case anyway.
4634          */
4635         if (!ap_min_req_set)
4636                 return true;
4637
4638         /* Need to go over for 80MHz, 160MHz and for 80+80 */
4639         for (i = 0; i < 3; i++) {
4640                 const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
4641                         &sta_he_cap->he_mcs_nss_supp;
4642                 u16 sta_mcs_map_rx =
4643                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
4644                 u16 sta_mcs_map_tx =
4645                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
4646                 u8 nss;
4647                 bool verified = true;
4648
4649                 /*
4650                  * For each band there is a maximum of 8 spatial streams
4651                  * possible. Each of the sta_mcs_map_* is a 16-bit struct built
4652                  * of 2 bits per NSS (1-8), with the values defined in enum
4653                  * ieee80211_he_mcs_support. Need to make sure STA TX and RX
4654                  * capabilities aren't less than the AP's minimum requirements
4655                  * for this HE BSS per SS.
4656                  * It is enough to find one such band that meets the reqs.
4657                  */
4658                 for (nss = 8; nss > 0; nss--) {
4659                         u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
4660                         u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
4661                         u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
4662
4663                         if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
4664                                 continue;
4665
4666                         /*
4667                          * Make sure the HE AP doesn't require MCSs that aren't
4668                          * supported by the client as required by spec
4669                          *
4670                          * P802.11-REVme/D0.3
4671                          * 26.17.1 Basic HE BSS operation
4672                          *
4673                          * An HE STA shall not attempt to join * (MLME-JOIN.request primitive)
4674                          * a BSS, unless it supports (i.e., is able to both transmit and
4675                          * receive using) all of the <HE-MCS, NSS> tuples in the basic
4676                          * HE-MCS and NSS set.
4677                          */
4678                         if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4679                             sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4680                             (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
4681                                 verified = false;
4682                                 break;
4683                         }
4684                 }
4685
4686                 if (verified)
4687                         return true;
4688         }
4689
4690         /* If here, STA doesn't meet AP's HE min requirements */
4691         return false;
4692 }
4693
4694 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
4695                                   struct ieee80211_link_data *link,
4696                                   struct cfg80211_bss *cbss,
4697                                   ieee80211_conn_flags_t *conn_flags)
4698 {
4699         struct ieee80211_local *local = sdata->local;
4700         const struct ieee80211_ht_cap *ht_cap = NULL;
4701         const struct ieee80211_ht_operation *ht_oper = NULL;
4702         const struct ieee80211_vht_operation *vht_oper = NULL;
4703         const struct ieee80211_he_operation *he_oper = NULL;
4704         const struct ieee80211_eht_operation *eht_oper = NULL;
4705         const struct ieee80211_s1g_oper_ie *s1g_oper = NULL;
4706         struct ieee80211_supported_band *sband;
4707         struct cfg80211_chan_def chandef;
4708         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4709         bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
4710         struct ieee80211_bss *bss = (void *)cbss->priv;
4711         struct ieee80211_elems_parse_params parse_params = {
4712                 .bss = cbss,
4713                 .link_id = -1,
4714                 .from_ap = true,
4715         };
4716         struct ieee802_11_elems *elems;
4717         const struct cfg80211_bss_ies *ies;
4718         int ret;
4719         u32 i;
4720         bool have_80mhz;
4721
4722         rcu_read_lock();
4723
4724         ies = rcu_dereference(cbss->ies);
4725         parse_params.start = ies->data;
4726         parse_params.len = ies->len;
4727         elems = ieee802_11_parse_elems_full(&parse_params);
4728         if (!elems) {
4729                 rcu_read_unlock();
4730                 return -ENOMEM;
4731         }
4732
4733         sband = local->hw.wiphy->bands[cbss->channel->band];
4734
4735         *conn_flags &= ~(IEEE80211_CONN_DISABLE_40MHZ |
4736                          IEEE80211_CONN_DISABLE_80P80MHZ |
4737                          IEEE80211_CONN_DISABLE_160MHZ);
4738
4739         /* disable HT/VHT/HE if we don't support them */
4740         if (!sband->ht_cap.ht_supported && !is_6ghz) {
4741                 mlme_dbg(sdata, "HT not supported, disabling HT/VHT/HE/EHT\n");
4742                 *conn_flags |= IEEE80211_CONN_DISABLE_HT;
4743                 *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4744                 *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4745                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4746         }
4747
4748         if (!sband->vht_cap.vht_supported && is_5ghz) {
4749                 mlme_dbg(sdata, "VHT not supported, disabling VHT/HE/EHT\n");
4750                 *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4751                 *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4752                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4753         }
4754
4755         if (!ieee80211_get_he_iftype_cap(sband,
4756                                          ieee80211_vif_type_p2p(&sdata->vif))) {
4757                 mlme_dbg(sdata, "HE not supported, disabling HE and EHT\n");
4758                 *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4759                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4760         }
4761
4762         if (!ieee80211_get_eht_iftype_cap(sband,
4763                                           ieee80211_vif_type_p2p(&sdata->vif))) {
4764                 mlme_dbg(sdata, "EHT not supported, disabling EHT\n");
4765                 *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4766         }
4767
4768         if (!(*conn_flags & IEEE80211_CONN_DISABLE_HT) && !is_6ghz) {
4769                 ht_oper = elems->ht_operation;
4770                 ht_cap = elems->ht_cap_elem;
4771
4772                 if (!ht_cap) {
4773                         *conn_flags |= IEEE80211_CONN_DISABLE_HT;
4774                         ht_oper = NULL;
4775                 }
4776         }
4777
4778         if (!(*conn_flags & IEEE80211_CONN_DISABLE_VHT) && !is_6ghz) {
4779                 vht_oper = elems->vht_operation;
4780                 if (vht_oper && !ht_oper) {
4781                         vht_oper = NULL;
4782                         sdata_info(sdata,
4783                                    "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4784                         *conn_flags |= IEEE80211_CONN_DISABLE_HT;
4785                         *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4786                         *conn_flags |= IEEE80211_CONN_DISABLE_HE;
4787                         *conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4788                 }
4789
4790                 if (!elems->vht_cap_elem) {
4791                         *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4792                         vht_oper = NULL;
4793                 }
4794         }
4795
4796         if (!(*conn_flags & IEEE80211_CONN_DISABLE_HE)) {
4797                 he_oper = elems->he_operation;
4798
4799                 if (link && is_6ghz) {
4800                         struct ieee80211_bss_conf *bss_conf;
4801                         u8 j = 0;
4802
4803                         bss_conf = link->conf;
4804
4805                         if (elems->pwr_constr_elem)
4806                                 bss_conf->pwr_reduction = *elems->pwr_constr_elem;
4807
4808                         BUILD_BUG_ON(ARRAY_SIZE(bss_conf->tx_pwr_env) !=
4809                                      ARRAY_SIZE(elems->tx_pwr_env));
4810
4811                         for (i = 0; i < elems->tx_pwr_env_num; i++) {
4812                                 if (elems->tx_pwr_env_len[i] >
4813                                     sizeof(bss_conf->tx_pwr_env[j]))
4814                                         continue;
4815
4816                                 bss_conf->tx_pwr_env_num++;
4817                                 memcpy(&bss_conf->tx_pwr_env[j], elems->tx_pwr_env[i],
4818                                        elems->tx_pwr_env_len[i]);
4819                                 j++;
4820                         }
4821                 }
4822
4823                 if (!ieee80211_verify_peer_he_mcs_support(sdata, ies, he_oper) ||
4824                     !ieee80211_verify_sta_he_mcs_support(sdata, sband, he_oper))
4825                         *conn_flags |= IEEE80211_CONN_DISABLE_HE |
4826                                        IEEE80211_CONN_DISABLE_EHT;
4827         }
4828
4829         /*
4830          * EHT requires HE to be supported as well. Specifically for 6 GHz
4831          * channels, the operation channel information can only be deduced from
4832          * both the 6 GHz operation information (from the HE operation IE) and
4833          * EHT operation.
4834          */
4835         if (!(*conn_flags &
4836                         (IEEE80211_CONN_DISABLE_HE |
4837                          IEEE80211_CONN_DISABLE_EHT)) &&
4838             he_oper) {
4839                 const struct cfg80211_bss_ies *cbss_ies;
4840                 const u8 *eht_oper_ie;
4841
4842                 cbss_ies = rcu_dereference(cbss->ies);
4843                 eht_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_EHT_OPERATION,
4844                                                    cbss_ies->data, cbss_ies->len);
4845                 if (eht_oper_ie && eht_oper_ie[1] >=
4846                     1 + sizeof(struct ieee80211_eht_operation))
4847                         eht_oper = (void *)(eht_oper_ie + 3);
4848                 else
4849                         eht_oper = NULL;
4850         }
4851
4852         /* Allow VHT if at least one channel on the sband supports 80 MHz */
4853         have_80mhz = false;
4854         for (i = 0; i < sband->n_channels; i++) {
4855                 if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
4856                                                 IEEE80211_CHAN_NO_80MHZ))
4857                         continue;
4858
4859                 have_80mhz = true;
4860                 break;
4861         }
4862
4863         if (!have_80mhz) {
4864                 sdata_info(sdata, "80 MHz not supported, disabling VHT\n");
4865                 *conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4866         }
4867
4868         if (sband->band == NL80211_BAND_S1GHZ) {
4869                 s1g_oper = elems->s1g_oper;
4870                 if (!s1g_oper)
4871                         sdata_info(sdata,
4872                                    "AP missing S1G operation element?\n");
4873         }
4874
4875         *conn_flags |=
4876                 ieee80211_determine_chantype(sdata, link, *conn_flags,
4877                                              sband,
4878                                              cbss->channel,
4879                                              bss->vht_cap_info,
4880                                              ht_oper, vht_oper,
4881                                              he_oper, eht_oper,
4882                                              s1g_oper,
4883                                              &chandef, false);
4884
4885         if (link)
4886                 link->needed_rx_chains =
4887                         min(ieee80211_max_rx_chains(link, cbss),
4888                             local->rx_chains);
4889
4890         rcu_read_unlock();
4891         /* the element data was RCU protected so no longer valid anyway */
4892         kfree(elems);
4893         elems = NULL;
4894
4895         if (*conn_flags & IEEE80211_CONN_DISABLE_HE && is_6ghz) {
4896                 sdata_info(sdata, "Rejecting non-HE 6/7 GHz connection");
4897                 return -EINVAL;
4898         }
4899
4900         if (!link)
4901                 return 0;
4902
4903         /* will change later if needed */
4904         link->smps_mode = IEEE80211_SMPS_OFF;
4905
4906         mutex_lock(&local->mtx);
4907         /*
4908          * If this fails (possibly due to channel context sharing
4909          * on incompatible channels, e.g. 80+80 and 160 sharing the
4910          * same control channel) try to use a smaller bandwidth.
4911          */
4912         ret = ieee80211_link_use_channel(link, &chandef,
4913                                          IEEE80211_CHANCTX_SHARED);
4914
4915         /* don't downgrade for 5 and 10 MHz channels, though. */
4916         if (chandef.width == NL80211_CHAN_WIDTH_5 ||
4917             chandef.width == NL80211_CHAN_WIDTH_10)
4918                 goto out;
4919
4920         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4921                 *conn_flags |=
4922                         ieee80211_chandef_downgrade(&chandef);
4923                 ret = ieee80211_link_use_channel(link, &chandef,
4924                                                  IEEE80211_CHANCTX_SHARED);
4925         }
4926  out:
4927         mutex_unlock(&local->mtx);
4928         return ret;
4929 }
4930
4931 static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
4932                                u8 *dtim_count, u8 *dtim_period)
4933 {
4934         const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
4935         const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
4936                                          ies->len);
4937         const struct ieee80211_tim_ie *tim = NULL;
4938         const struct ieee80211_bssid_index *idx;
4939         bool valid = tim_ie && tim_ie[1] >= 2;
4940
4941         if (valid)
4942                 tim = (void *)(tim_ie + 2);
4943
4944         if (dtim_count)
4945                 *dtim_count = valid ? tim->dtim_count : 0;
4946
4947         if (dtim_period)
4948                 *dtim_period = valid ? tim->dtim_period : 0;
4949
4950         /* Check if value is overridden by non-transmitted profile */
4951         if (!idx_ie || idx_ie[1] < 3)
4952                 return valid;
4953
4954         idx = (void *)(idx_ie + 2);
4955
4956         if (dtim_count)
4957                 *dtim_count = idx->dtim_count;
4958
4959         if (dtim_period)
4960                 *dtim_period = idx->dtim_period;
4961
4962         return true;
4963 }
4964
4965 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
4966                                     struct ieee80211_mgmt *mgmt,
4967                                     struct ieee802_11_elems *elems,
4968                                     const u8 *elem_start, unsigned int elem_len)
4969 {
4970         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4971         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
4972         struct ieee80211_local *local = sdata->local;
4973         unsigned int link_id;
4974         struct sta_info *sta;
4975         u64 changed[IEEE80211_MLD_MAX_NUM_LINKS] = {};
4976         u16 valid_links = 0;
4977         int err;
4978
4979         mutex_lock(&sdata->local->sta_mtx);
4980         /*
4981          * station info was already allocated and inserted before
4982          * the association and should be available to us
4983          */
4984         sta = sta_info_get(sdata, assoc_data->ap_addr);
4985         if (WARN_ON(!sta))
4986                 goto out_err;
4987
4988         if (sdata->vif.valid_links) {
4989                 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
4990                         if (!assoc_data->link[link_id].bss)
4991                                 continue;
4992                         valid_links |= BIT(link_id);
4993
4994                         if (link_id != assoc_data->assoc_link_id) {
4995                                 err = ieee80211_sta_allocate_link(sta, link_id);
4996                                 if (err)
4997                                         goto out_err;
4998                         }
4999                 }
5000
5001                 ieee80211_vif_set_links(sdata, valid_links);
5002         }
5003
5004         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5005                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
5006                 struct ieee80211_link_data *link;
5007                 struct link_sta_info *link_sta;
5008
5009                 if (!cbss)
5010                         continue;
5011
5012                 link = sdata_dereference(sdata->link[link_id], sdata);
5013                 if (WARN_ON(!link))
5014                         goto out_err;
5015
5016                 if (sdata->vif.valid_links)
5017                         link_info(link,
5018                                   "local address %pM, AP link address %pM%s\n",
5019                                   link->conf->addr,
5020                                   assoc_data->link[link_id].bss->bssid,
5021                                   link_id == assoc_data->assoc_link_id ?
5022                                         " (assoc)" : "");
5023
5024                 link_sta = rcu_dereference_protected(sta->link[link_id],
5025                                                      lockdep_is_held(&local->sta_mtx));
5026                 if (WARN_ON(!link_sta))
5027                         goto out_err;
5028
5029                 if (!link->u.mgd.have_beacon) {
5030                         const struct cfg80211_bss_ies *ies;
5031
5032                         rcu_read_lock();
5033                         ies = rcu_dereference(cbss->beacon_ies);
5034                         if (ies)
5035                                 link->u.mgd.have_beacon = true;
5036                         else
5037                                 ies = rcu_dereference(cbss->ies);
5038                         ieee80211_get_dtim(ies,
5039                                            &link->conf->sync_dtim_count,
5040                                            &link->u.mgd.dtim_period);
5041                         link->conf->beacon_int = cbss->beacon_interval;
5042                         rcu_read_unlock();
5043                 }
5044
5045                 link->conf->dtim_period = link->u.mgd.dtim_period ?: 1;
5046
5047                 if (link_id != assoc_data->assoc_link_id) {
5048                         err = ieee80211_prep_channel(sdata, link, cbss,
5049                                                      &link->u.mgd.conn_flags);
5050                         if (err) {
5051                                 link_info(link, "prep_channel failed\n");
5052                                 goto out_err;
5053                         }
5054                 }
5055
5056                 err = ieee80211_mgd_setup_link_sta(link, sta, link_sta,
5057                                                    assoc_data->link[link_id].bss);
5058                 if (err)
5059                         goto out_err;
5060
5061                 if (!ieee80211_assoc_config_link(link, link_sta,
5062                                                  assoc_data->link[link_id].bss,
5063                                                  mgmt, elem_start, elem_len,
5064                                                  &changed[link_id]))
5065                         goto out_err;
5066
5067                 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
5068                         valid_links &= ~BIT(link_id);
5069                         ieee80211_sta_remove_link(sta, link_id);
5070                         continue;
5071                 }
5072
5073                 if (link_id != assoc_data->assoc_link_id) {
5074                         err = ieee80211_sta_activate_link(sta, link_id);
5075                         if (err)
5076                                 goto out_err;
5077                 }
5078         }
5079
5080         /* links might have changed due to rejected ones, set them again */
5081         ieee80211_vif_set_links(sdata, valid_links);
5082
5083         rate_control_rate_init(sta);
5084
5085         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
5086                 set_sta_flag(sta, WLAN_STA_MFP);
5087                 sta->sta.mfp = true;
5088         } else {
5089                 sta->sta.mfp = false;
5090         }
5091
5092         ieee80211_sta_set_max_amsdu_subframes(sta, elems->ext_capab,
5093                                               elems->ext_capab_len);
5094
5095         sta->sta.wme = (elems->wmm_param || elems->s1g_capab) &&
5096                        local->hw.queues >= IEEE80211_NUM_ACS;
5097
5098         err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
5099         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
5100                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
5101         if (err) {
5102                 sdata_info(sdata,
5103                            "failed to move station %pM to desired state\n",
5104                            sta->sta.addr);
5105                 WARN_ON(__sta_info_destroy(sta));
5106                 goto out_err;
5107         }
5108
5109         if (sdata->wdev.use_4addr)
5110                 drv_sta_set_4addr(local, sdata, &sta->sta, true);
5111
5112         mutex_unlock(&sdata->local->sta_mtx);
5113
5114         ieee80211_set_associated(sdata, assoc_data, changed);
5115
5116         /*
5117          * If we're using 4-addr mode, let the AP know that we're
5118          * doing so, so that it can create the STA VLAN on its side
5119          */
5120         if (ifmgd->use_4addr)
5121                 ieee80211_send_4addr_nullfunc(local, sdata);
5122
5123         /*
5124          * Start timer to probe the connection to the AP now.
5125          * Also start the timer that will detect beacon loss.
5126          */
5127         ieee80211_sta_reset_beacon_monitor(sdata);
5128         ieee80211_sta_reset_conn_monitor(sdata);
5129
5130         return true;
5131 out_err:
5132         eth_zero_addr(sdata->vif.cfg.ap_addr);
5133         mutex_unlock(&sdata->local->sta_mtx);
5134         return false;
5135 }
5136
5137 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
5138                                          struct ieee80211_mgmt *mgmt,
5139                                          size_t len)
5140 {
5141         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5142         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
5143         u16 capab_info, status_code, aid;
5144         struct ieee80211_elems_parse_params parse_params = {
5145                 .bss = NULL,
5146                 .link_id = -1,
5147                 .from_ap = true,
5148         };
5149         struct ieee802_11_elems *elems;
5150         int ac;
5151         const u8 *elem_start;
5152         unsigned int elem_len;
5153         bool reassoc;
5154         struct ieee80211_event event = {
5155                 .type = MLME_EVENT,
5156                 .u.mlme.data = ASSOC_EVENT,
5157         };
5158         struct ieee80211_prep_tx_info info = {};
5159         struct cfg80211_rx_assoc_resp resp = {
5160                 .uapsd_queues = -1,
5161         };
5162         u8 ap_mld_addr[ETH_ALEN] __aligned(2);
5163         unsigned int link_id;
5164
5165         sdata_assert_lock(sdata);
5166
5167         if (!assoc_data)
5168                 return;
5169
5170         if (!ether_addr_equal(assoc_data->ap_addr, mgmt->bssid) ||
5171             !ether_addr_equal(assoc_data->ap_addr, mgmt->sa))
5172                 return;
5173
5174         /*
5175          * AssocResp and ReassocResp have identical structure, so process both
5176          * of them in this function.
5177          */
5178
5179         if (len < 24 + 6)
5180                 return;
5181
5182         reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
5183         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
5184         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
5185         if (assoc_data->s1g)
5186                 elem_start = mgmt->u.s1g_assoc_resp.variable;
5187         else
5188                 elem_start = mgmt->u.assoc_resp.variable;
5189
5190         /*
5191          * Note: this may not be perfect, AP might misbehave - if
5192          * anyone needs to rely on perfect complete notification
5193          * with the exact right subtype, then we need to track what
5194          * we actually transmitted.
5195          */
5196         info.subtype = reassoc ? IEEE80211_STYPE_REASSOC_REQ :
5197                                  IEEE80211_STYPE_ASSOC_REQ;
5198
5199         if (assoc_data->fils_kek_len &&
5200             fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
5201                 return;
5202
5203         elem_len = len - (elem_start - (u8 *)mgmt);
5204         parse_params.start = elem_start;
5205         parse_params.len = elem_len;
5206         elems = ieee802_11_parse_elems_full(&parse_params);
5207         if (!elems)
5208                 goto notify_driver;
5209
5210         if (elems->aid_resp)
5211                 aid = le16_to_cpu(elems->aid_resp->aid);
5212         else if (assoc_data->s1g)
5213                 aid = 0; /* TODO */
5214         else
5215                 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
5216
5217         /*
5218          * The 5 MSB of the AID field are reserved
5219          * (802.11-2016 9.4.1.8 AID field)
5220          */
5221         aid &= 0x7ff;
5222
5223         sdata_info(sdata,
5224                    "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
5225                    reassoc ? "Rea" : "A", assoc_data->ap_addr,
5226                    capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
5227
5228         ifmgd->broken_ap = false;
5229
5230         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
5231             elems->timeout_int &&
5232             elems->timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
5233                 u32 tu, ms;
5234
5235                 cfg80211_assoc_comeback(sdata->dev, assoc_data->ap_addr,
5236                                         le32_to_cpu(elems->timeout_int->value));
5237
5238                 tu = le32_to_cpu(elems->timeout_int->value);
5239                 ms = tu * 1024 / 1000;
5240                 sdata_info(sdata,
5241                            "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
5242                            assoc_data->ap_addr, tu, ms);
5243                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
5244                 assoc_data->timeout_started = true;
5245                 if (ms > IEEE80211_ASSOC_TIMEOUT)
5246                         run_again(sdata, assoc_data->timeout);
5247                 goto notify_driver;
5248         }
5249
5250         if (status_code != WLAN_STATUS_SUCCESS) {
5251                 sdata_info(sdata, "%pM denied association (code=%d)\n",
5252                            assoc_data->ap_addr, status_code);
5253                 event.u.mlme.status = MLME_DENIED;
5254                 event.u.mlme.reason = status_code;
5255                 drv_event_callback(sdata->local, sdata, &event);
5256         } else {
5257                 if (aid == 0 || aid > IEEE80211_MAX_AID) {
5258                         sdata_info(sdata,
5259                                    "invalid AID value %d (out of range), turn off PS\n",
5260                                    aid);
5261                         aid = 0;
5262                         ifmgd->broken_ap = true;
5263                 }
5264
5265                 if (sdata->vif.valid_links) {
5266                         if (!elems->multi_link) {
5267                                 sdata_info(sdata,
5268                                            "MLO association with %pM but no multi-link element in response!\n",
5269                                            assoc_data->ap_addr);
5270                                 goto abandon_assoc;
5271                         }
5272
5273                         if (le16_get_bits(elems->multi_link->control,
5274                                           IEEE80211_ML_CONTROL_TYPE) !=
5275                                         IEEE80211_ML_CONTROL_TYPE_BASIC) {
5276                                 sdata_info(sdata,
5277                                            "bad multi-link element (control=0x%x)\n",
5278                                            le16_to_cpu(elems->multi_link->control));
5279                                 goto abandon_assoc;
5280                         } else {
5281                                 struct ieee80211_mle_basic_common_info *common;
5282
5283                                 common = (void *)elems->multi_link->variable;
5284
5285                                 if (memcmp(assoc_data->ap_addr,
5286                                            common->mld_mac_addr, ETH_ALEN)) {
5287                                         sdata_info(sdata,
5288                                                    "AP MLD MAC address mismatch: got %pM expected %pM\n",
5289                                                    common->mld_mac_addr,
5290                                                    assoc_data->ap_addr);
5291                                         goto abandon_assoc;
5292                                 }
5293                         }
5294                 }
5295
5296                 sdata->vif.cfg.aid = aid;
5297
5298                 if (!ieee80211_assoc_success(sdata, mgmt, elems,
5299                                              elem_start, elem_len)) {
5300                         /* oops -- internal error -- send timeout for now */
5301                         ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
5302                         goto notify_driver;
5303                 }
5304                 event.u.mlme.status = MLME_SUCCESS;
5305                 drv_event_callback(sdata->local, sdata, &event);
5306                 sdata_info(sdata, "associated\n");
5307
5308                 info.success = 1;
5309         }
5310
5311         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5312                 struct ieee80211_link_data *link;
5313
5314                 link = sdata_dereference(sdata->link[link_id], sdata);
5315                 if (!link)
5316                         continue;
5317
5318                 if (!assoc_data->link[link_id].bss)
5319                         continue;
5320
5321                 resp.links[link_id].bss = assoc_data->link[link_id].bss;
5322                 resp.links[link_id].addr = link->conf->addr;
5323                 resp.links[link_id].status = assoc_data->link[link_id].status;
5324
5325                 /* get uapsd queues configuration - same for all links */
5326                 resp.uapsd_queues = 0;
5327                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5328                         if (link->tx_conf[ac].uapsd)
5329                                 resp.uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
5330         }
5331
5332         if (sdata->vif.valid_links) {
5333                 ether_addr_copy(ap_mld_addr, sdata->vif.cfg.ap_addr);
5334                 resp.ap_mld_addr = ap_mld_addr;
5335         }
5336
5337         ieee80211_destroy_assoc_data(sdata,
5338                                      status_code == WLAN_STATUS_SUCCESS ?
5339                                         ASSOC_SUCCESS :
5340                                         ASSOC_REJECTED);
5341
5342         resp.buf = (u8 *)mgmt;
5343         resp.len = len;
5344         resp.req_ies = ifmgd->assoc_req_ies;
5345         resp.req_ies_len = ifmgd->assoc_req_ies_len;
5346         cfg80211_rx_assoc_resp(sdata->dev, &resp);
5347 notify_driver:
5348         drv_mgd_complete_tx(sdata->local, sdata, &info);
5349         kfree(elems);
5350         return;
5351 abandon_assoc:
5352         ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
5353         goto notify_driver;
5354 }
5355
5356 static void ieee80211_rx_bss_info(struct ieee80211_link_data *link,
5357                                   struct ieee80211_mgmt *mgmt, size_t len,
5358                                   struct ieee80211_rx_status *rx_status)
5359 {
5360         struct ieee80211_sub_if_data *sdata = link->sdata;
5361         struct ieee80211_local *local = sdata->local;
5362         struct ieee80211_bss *bss;
5363         struct ieee80211_channel *channel;
5364
5365         sdata_assert_lock(sdata);
5366
5367         channel = ieee80211_get_channel_khz(local->hw.wiphy,
5368                                         ieee80211_rx_status_to_khz(rx_status));
5369         if (!channel)
5370                 return;
5371
5372         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
5373         if (bss) {
5374                 link->conf->beacon_rate = bss->beacon_rate;
5375                 ieee80211_rx_bss_put(local, bss);
5376         }
5377 }
5378
5379
5380 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_link_data *link,
5381                                          struct sk_buff *skb)
5382 {
5383         struct ieee80211_sub_if_data *sdata = link->sdata;
5384         struct ieee80211_mgmt *mgmt = (void *)skb->data;
5385         struct ieee80211_if_managed *ifmgd;
5386         struct ieee80211_rx_status *rx_status = (void *) skb->cb;
5387         struct ieee80211_channel *channel;
5388         size_t baselen, len = skb->len;
5389
5390         ifmgd = &sdata->u.mgd;
5391
5392         sdata_assert_lock(sdata);
5393
5394         /*
5395          * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
5396          * "If a 6 GHz AP receives a Probe Request frame  and responds with
5397          * a Probe Response frame [..], the Address 1 field of the Probe
5398          * Response frame shall be set to the broadcast address [..]"
5399          * So, on 6GHz band we should also accept broadcast responses.
5400          */
5401         channel = ieee80211_get_channel(sdata->local->hw.wiphy,
5402                                         rx_status->freq);
5403         if (!channel)
5404                 return;
5405
5406         if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
5407             (channel->band != NL80211_BAND_6GHZ ||
5408              !is_broadcast_ether_addr(mgmt->da)))
5409                 return; /* ignore ProbeResp to foreign address */
5410
5411         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
5412         if (baselen > len)
5413                 return;
5414
5415         ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5416
5417         if (ifmgd->associated &&
5418             ether_addr_equal(mgmt->bssid, link->u.mgd.bssid))
5419                 ieee80211_reset_ap_probe(sdata);
5420 }
5421
5422 /*
5423  * This is the canonical list of information elements we care about,
5424  * the filter code also gives us all changes to the Microsoft OUI
5425  * (00:50:F2) vendor IE which is used for WMM which we need to track,
5426  * as well as the DTPC IE (part of the Cisco OUI) used for signaling
5427  * changes to requested client power.
5428  *
5429  * We implement beacon filtering in software since that means we can
5430  * avoid processing the frame here and in cfg80211, and userspace
5431  * will not be able to tell whether the hardware supports it or not.
5432  *
5433  * XXX: This list needs to be dynamic -- userspace needs to be able to
5434  *      add items it requires. It also needs to be able to tell us to
5435  *      look out for other vendor IEs.
5436  */
5437 static const u64 care_about_ies =
5438         (1ULL << WLAN_EID_COUNTRY) |
5439         (1ULL << WLAN_EID_ERP_INFO) |
5440         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
5441         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
5442         (1ULL << WLAN_EID_HT_CAPABILITY) |
5443         (1ULL << WLAN_EID_HT_OPERATION) |
5444         (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
5445
5446 static void ieee80211_handle_beacon_sig(struct ieee80211_link_data *link,
5447                                         struct ieee80211_if_managed *ifmgd,
5448                                         struct ieee80211_bss_conf *bss_conf,
5449                                         struct ieee80211_local *local,
5450                                         struct ieee80211_rx_status *rx_status)
5451 {
5452         struct ieee80211_sub_if_data *sdata = link->sdata;
5453
5454         /* Track average RSSI from the Beacon frames of the current AP */
5455
5456         if (!link->u.mgd.tracking_signal_avg) {
5457                 link->u.mgd.tracking_signal_avg = true;
5458                 ewma_beacon_signal_init(&link->u.mgd.ave_beacon_signal);
5459                 link->u.mgd.last_cqm_event_signal = 0;
5460                 link->u.mgd.count_beacon_signal = 1;
5461                 link->u.mgd.last_ave_beacon_signal = 0;
5462         } else {
5463                 link->u.mgd.count_beacon_signal++;
5464         }
5465
5466         ewma_beacon_signal_add(&link->u.mgd.ave_beacon_signal,
5467                                -rx_status->signal);
5468
5469         if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
5470             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5471                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5472                 int last_sig = link->u.mgd.last_ave_beacon_signal;
5473                 struct ieee80211_event event = {
5474                         .type = RSSI_EVENT,
5475                 };
5476
5477                 /*
5478                  * if signal crosses either of the boundaries, invoke callback
5479                  * with appropriate parameters
5480                  */
5481                 if (sig > ifmgd->rssi_max_thold &&
5482                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
5483                         link->u.mgd.last_ave_beacon_signal = sig;
5484                         event.u.rssi.data = RSSI_EVENT_HIGH;
5485                         drv_event_callback(local, sdata, &event);
5486                 } else if (sig < ifmgd->rssi_min_thold &&
5487                            (last_sig >= ifmgd->rssi_max_thold ||
5488                            last_sig == 0)) {
5489                         link->u.mgd.last_ave_beacon_signal = sig;
5490                         event.u.rssi.data = RSSI_EVENT_LOW;
5491                         drv_event_callback(local, sdata, &event);
5492                 }
5493         }
5494
5495         if (bss_conf->cqm_rssi_thold &&
5496             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
5497             !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
5498                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5499                 int last_event = link->u.mgd.last_cqm_event_signal;
5500                 int thold = bss_conf->cqm_rssi_thold;
5501                 int hyst = bss_conf->cqm_rssi_hyst;
5502
5503                 if (sig < thold &&
5504                     (last_event == 0 || sig < last_event - hyst)) {
5505                         link->u.mgd.last_cqm_event_signal = sig;
5506                         ieee80211_cqm_rssi_notify(
5507                                 &sdata->vif,
5508                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5509                                 sig, GFP_KERNEL);
5510                 } else if (sig > thold &&
5511                            (last_event == 0 || sig > last_event + hyst)) {
5512                         link->u.mgd.last_cqm_event_signal = sig;
5513                         ieee80211_cqm_rssi_notify(
5514                                 &sdata->vif,
5515                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5516                                 sig, GFP_KERNEL);
5517                 }
5518         }
5519
5520         if (bss_conf->cqm_rssi_low &&
5521             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5522                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5523                 int last_event = link->u.mgd.last_cqm_event_signal;
5524                 int low = bss_conf->cqm_rssi_low;
5525                 int high = bss_conf->cqm_rssi_high;
5526
5527                 if (sig < low &&
5528                     (last_event == 0 || last_event >= low)) {
5529                         link->u.mgd.last_cqm_event_signal = sig;
5530                         ieee80211_cqm_rssi_notify(
5531                                 &sdata->vif,
5532                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5533                                 sig, GFP_KERNEL);
5534                 } else if (sig > high &&
5535                            (last_event == 0 || last_event <= high)) {
5536                         link->u.mgd.last_cqm_event_signal = sig;
5537                         ieee80211_cqm_rssi_notify(
5538                                 &sdata->vif,
5539                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5540                                 sig, GFP_KERNEL);
5541                 }
5542         }
5543 }
5544
5545 static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
5546                                     struct cfg80211_bss *bss)
5547 {
5548         if (ether_addr_equal(tx_bssid, bss->bssid))
5549                 return true;
5550         if (!bss->transmitted_bss)
5551                 return false;
5552         return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
5553 }
5554
5555 static bool ieee80211_config_puncturing(struct ieee80211_link_data *link,
5556                                         const struct ieee80211_eht_operation *eht_oper,
5557                                         u64 *changed)
5558 {
5559         u16 bitmap = 0, extracted;
5560
5561         if ((eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
5562             (eht_oper->params &
5563              IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
5564                 const struct ieee80211_eht_operation_info *info =
5565                         (void *)eht_oper->optional;
5566                 const u8 *disable_subchannel_bitmap = info->optional;
5567
5568                 bitmap = get_unaligned_le16(disable_subchannel_bitmap);
5569         }
5570
5571         extracted = ieee80211_extract_dis_subch_bmap(eht_oper,
5572                                                      &link->conf->chandef,
5573                                                      bitmap);
5574
5575         /* accept if there are no changes */
5576         if (!(*changed & BSS_CHANGED_BANDWIDTH) &&
5577             extracted == link->conf->eht_puncturing)
5578                 return true;
5579
5580         if (!cfg80211_valid_disable_subchannel_bitmap(&bitmap,
5581                                                       &link->conf->chandef)) {
5582                 link_info(link,
5583                           "Got an invalid disable subchannel bitmap from AP %pM: bitmap = 0x%x, bw = 0x%x. disconnect\n",
5584                           link->u.mgd.bssid,
5585                           bitmap,
5586                           link->conf->chandef.width);
5587                 return false;
5588         }
5589
5590         ieee80211_handle_puncturing_bitmap(link, eht_oper, bitmap, changed);
5591         return true;
5592 }
5593
5594 static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
5595                                      struct ieee80211_hdr *hdr, size_t len,
5596                                      struct ieee80211_rx_status *rx_status)
5597 {
5598         struct ieee80211_sub_if_data *sdata = link->sdata;
5599         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5600         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
5601         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
5602         struct ieee80211_mgmt *mgmt = (void *) hdr;
5603         size_t baselen;
5604         struct ieee802_11_elems *elems;
5605         struct ieee80211_local *local = sdata->local;
5606         struct ieee80211_chanctx_conf *chanctx_conf;
5607         struct ieee80211_supported_band *sband;
5608         struct ieee80211_channel *chan;
5609         struct link_sta_info *link_sta;
5610         struct sta_info *sta;
5611         u64 changed = 0;
5612         bool erp_valid;
5613         u8 erp_value = 0;
5614         u32 ncrc = 0;
5615         u8 *bssid, *variable = mgmt->u.beacon.variable;
5616         u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
5617         struct ieee80211_elems_parse_params parse_params = {
5618                 .link_id = -1,
5619                 .from_ap = true,
5620         };
5621
5622         sdata_assert_lock(sdata);
5623
5624         /* Process beacon from the current BSS */
5625         bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
5626         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
5627                 struct ieee80211_ext *ext = (void *) mgmt;
5628
5629                 if (ieee80211_is_s1g_short_beacon(ext->frame_control))
5630                         variable = ext->u.s1g_short_beacon.variable;
5631                 else
5632                         variable = ext->u.s1g_beacon.variable;
5633         }
5634
5635         baselen = (u8 *) variable - (u8 *) mgmt;
5636         if (baselen > len)
5637                 return;
5638
5639         parse_params.start = variable;
5640         parse_params.len = len - baselen;
5641
5642         rcu_read_lock();
5643         chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
5644         if (!chanctx_conf) {
5645                 rcu_read_unlock();
5646                 return;
5647         }
5648
5649         if (ieee80211_rx_status_to_khz(rx_status) !=
5650             ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
5651                 rcu_read_unlock();
5652                 return;
5653         }
5654         chan = chanctx_conf->def.chan;
5655         rcu_read_unlock();
5656
5657         if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
5658             !WARN_ON(sdata->vif.valid_links) &&
5659             ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) {
5660                 parse_params.bss = ifmgd->assoc_data->link[0].bss;
5661                 elems = ieee802_11_parse_elems_full(&parse_params);
5662                 if (!elems)
5663                         return;
5664
5665                 ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5666
5667                 if (elems->dtim_period)
5668                         link->u.mgd.dtim_period = elems->dtim_period;
5669                 link->u.mgd.have_beacon = true;
5670                 ifmgd->assoc_data->need_beacon = false;
5671                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5672                         link->conf->sync_tsf =
5673                                 le64_to_cpu(mgmt->u.beacon.timestamp);
5674                         link->conf->sync_device_ts =
5675                                 rx_status->device_timestamp;
5676                         link->conf->sync_dtim_count = elems->dtim_count;
5677                 }
5678
5679                 if (elems->mbssid_config_ie)
5680                         bss_conf->profile_periodicity =
5681                                 elems->mbssid_config_ie->profile_periodicity;
5682                 else
5683                         bss_conf->profile_periodicity = 0;
5684
5685                 if (elems->ext_capab_len >= 11 &&
5686                     (elems->ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
5687                         bss_conf->ema_ap = true;
5688                 else
5689                         bss_conf->ema_ap = false;
5690
5691                 /* continue assoc process */
5692                 ifmgd->assoc_data->timeout = jiffies;
5693                 ifmgd->assoc_data->timeout_started = true;
5694                 run_again(sdata, ifmgd->assoc_data->timeout);
5695                 kfree(elems);
5696                 return;
5697         }
5698
5699         if (!ifmgd->associated ||
5700             !ieee80211_rx_our_beacon(bssid, link->u.mgd.bss))
5701                 return;
5702         bssid = link->u.mgd.bssid;
5703
5704         if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
5705                 ieee80211_handle_beacon_sig(link, ifmgd, bss_conf,
5706                                             local, rx_status);
5707
5708         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
5709                 mlme_dbg_ratelimited(sdata,
5710                                      "cancelling AP probe due to a received beacon\n");
5711                 ieee80211_reset_ap_probe(sdata);
5712         }
5713
5714         /*
5715          * Push the beacon loss detection into the future since
5716          * we are processing a beacon from the AP just now.
5717          */
5718         ieee80211_sta_reset_beacon_monitor(sdata);
5719
5720         /* TODO: CRC urrently not calculated on S1G Beacon Compatibility
5721          * element (which carries the beacon interval). Don't forget to add a
5722          * bit to care_about_ies[] above if mac80211 is interested in a
5723          * changing S1G element.
5724          */
5725         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
5726                 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
5727         parse_params.bss = link->u.mgd.bss;
5728         parse_params.filter = care_about_ies;
5729         parse_params.crc = ncrc;
5730         elems = ieee802_11_parse_elems_full(&parse_params);
5731         if (!elems)
5732                 return;
5733         ncrc = elems->crc;
5734
5735         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
5736             ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid)) {
5737                 if (local->hw.conf.dynamic_ps_timeout > 0) {
5738                         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
5739                                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
5740                                 ieee80211_hw_config(local,
5741                                                     IEEE80211_CONF_CHANGE_PS);
5742                         }
5743                         ieee80211_send_nullfunc(local, sdata, false);
5744                 } else if (!local->pspolling && sdata->u.mgd.powersave) {
5745                         local->pspolling = true;
5746
5747                         /*
5748                          * Here is assumed that the driver will be
5749                          * able to send ps-poll frame and receive a
5750                          * response even though power save mode is
5751                          * enabled, but some drivers might require
5752                          * to disable power save here. This needs
5753                          * to be investigated.
5754                          */
5755                         ieee80211_send_pspoll(local, sdata);
5756                 }
5757         }
5758
5759         if (sdata->vif.p2p ||
5760             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
5761                 struct ieee80211_p2p_noa_attr noa = {};
5762                 int ret;
5763
5764                 ret = cfg80211_get_p2p_attr(variable,
5765                                             len - baselen,
5766                                             IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
5767                                             (u8 *) &noa, sizeof(noa));
5768                 if (ret >= 2) {
5769                         if (link->u.mgd.p2p_noa_index != noa.index) {
5770                                 /* valid noa_attr and index changed */
5771                                 link->u.mgd.p2p_noa_index = noa.index;
5772                                 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
5773                                 changed |= BSS_CHANGED_P2P_PS;
5774                                 /*
5775                                  * make sure we update all information, the CRC
5776                                  * mechanism doesn't look at P2P attributes.
5777                                  */
5778                                 link->u.mgd.beacon_crc_valid = false;
5779                         }
5780                 } else if (link->u.mgd.p2p_noa_index != -1) {
5781                         /* noa_attr not found and we had valid noa_attr before */
5782                         link->u.mgd.p2p_noa_index = -1;
5783                         memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
5784                         changed |= BSS_CHANGED_P2P_PS;
5785                         link->u.mgd.beacon_crc_valid = false;
5786                 }
5787         }
5788
5789         if (link->u.mgd.csa_waiting_bcn)
5790                 ieee80211_chswitch_post_beacon(link);
5791
5792         /*
5793          * Update beacon timing and dtim count on every beacon appearance. This
5794          * will allow the driver to use the most updated values. Do it before
5795          * comparing this one with last received beacon.
5796          * IMPORTANT: These parameters would possibly be out of sync by the time
5797          * the driver will use them. The synchronized view is currently
5798          * guaranteed only in certain callbacks.
5799          */
5800         if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
5801             !ieee80211_is_s1g_beacon(hdr->frame_control)) {
5802                 link->conf->sync_tsf =
5803                         le64_to_cpu(mgmt->u.beacon.timestamp);
5804                 link->conf->sync_device_ts =
5805                         rx_status->device_timestamp;
5806                 link->conf->sync_dtim_count = elems->dtim_count;
5807         }
5808
5809         if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) ||
5810             ieee80211_is_s1g_short_beacon(mgmt->frame_control))
5811                 goto free;
5812         link->u.mgd.beacon_crc = ncrc;
5813         link->u.mgd.beacon_crc_valid = true;
5814
5815         ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5816
5817         ieee80211_sta_process_chanswitch(link, rx_status->mactime,
5818                                          rx_status->device_timestamp,
5819                                          elems, true);
5820
5821         if (!link->u.mgd.disable_wmm_tracking &&
5822             ieee80211_sta_wmm_params(local, link, elems->wmm_param,
5823                                      elems->wmm_param_len,
5824                                      elems->mu_edca_param_set))
5825                 changed |= BSS_CHANGED_QOS;
5826
5827         /*
5828          * If we haven't had a beacon before, tell the driver about the
5829          * DTIM period (and beacon timing if desired) now.
5830          */
5831         if (!link->u.mgd.have_beacon) {
5832                 /* a few bogus AP send dtim_period = 0 or no TIM IE */
5833                 bss_conf->dtim_period = elems->dtim_period ?: 1;
5834
5835                 changed |= BSS_CHANGED_BEACON_INFO;
5836                 link->u.mgd.have_beacon = true;
5837
5838                 mutex_lock(&local->iflist_mtx);
5839                 ieee80211_recalc_ps(local);
5840                 mutex_unlock(&local->iflist_mtx);
5841
5842                 ieee80211_recalc_ps_vif(sdata);
5843         }
5844
5845         if (elems->erp_info) {
5846                 erp_valid = true;
5847                 erp_value = elems->erp_info[0];
5848         } else {
5849                 erp_valid = false;
5850         }
5851
5852         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
5853                 changed |= ieee80211_handle_bss_capability(link,
5854                                 le16_to_cpu(mgmt->u.beacon.capab_info),
5855                                 erp_valid, erp_value);
5856
5857         mutex_lock(&local->sta_mtx);
5858         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
5859         if (WARN_ON(!sta)) {
5860                 mutex_unlock(&local->sta_mtx);
5861                 goto free;
5862         }
5863         link_sta = rcu_dereference_protected(sta->link[link->link_id],
5864                                              lockdep_is_held(&local->sta_mtx));
5865         if (WARN_ON(!link_sta)) {
5866                 mutex_unlock(&local->sta_mtx);
5867                 goto free;
5868         }
5869
5870         if (WARN_ON(!link->conf->chandef.chan))
5871                 goto free;
5872
5873         sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
5874
5875         changed |= ieee80211_recalc_twt_req(sdata, sband, link, link_sta, elems);
5876
5877         if (ieee80211_config_bw(link, elems->ht_cap_elem,
5878                                 elems->vht_cap_elem, elems->ht_operation,
5879                                 elems->vht_operation, elems->he_operation,
5880                                 elems->eht_operation,
5881                                 elems->s1g_oper, bssid, &changed)) {
5882                 mutex_unlock(&local->sta_mtx);
5883                 sdata_info(sdata,
5884                            "failed to follow AP %pM bandwidth change, disconnect\n",
5885                            bssid);
5886                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
5887                                        WLAN_REASON_DEAUTH_LEAVING,
5888                                        true, deauth_buf);
5889                 ieee80211_report_disconnect(sdata, deauth_buf,
5890                                             sizeof(deauth_buf), true,
5891                                             WLAN_REASON_DEAUTH_LEAVING,
5892                                             false);
5893                 goto free;
5894         }
5895
5896         if (elems->opmode_notif)
5897                 ieee80211_vht_handle_opmode(sdata, link_sta,
5898                                             *elems->opmode_notif,
5899                                             rx_status->band);
5900         mutex_unlock(&local->sta_mtx);
5901
5902         changed |= ieee80211_handle_pwr_constr(link, chan, mgmt,
5903                                                elems->country_elem,
5904                                                elems->country_elem_len,
5905                                                elems->pwr_constr_elem,
5906                                                elems->cisco_dtpc_elem);
5907
5908         if (elems->eht_operation &&
5909             !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
5910                 if (!ieee80211_config_puncturing(link, elems->eht_operation,
5911                                                  &changed)) {
5912                         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
5913                                                WLAN_REASON_DEAUTH_LEAVING,
5914                                                true, deauth_buf);
5915                         ieee80211_report_disconnect(sdata, deauth_buf,
5916                                                     sizeof(deauth_buf), true,
5917                                                     WLAN_REASON_DEAUTH_LEAVING,
5918                                                     false);
5919                         goto free;
5920                 }
5921         }
5922
5923         ieee80211_link_info_change_notify(sdata, link, changed);
5924 free:
5925         kfree(elems);
5926 }
5927
5928 void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
5929                                  struct sk_buff *skb)
5930 {
5931         struct ieee80211_link_data *link = &sdata->deflink;
5932         struct ieee80211_rx_status *rx_status;
5933         struct ieee80211_hdr *hdr;
5934         u16 fc;
5935
5936         rx_status = (struct ieee80211_rx_status *) skb->cb;
5937         hdr = (struct ieee80211_hdr *) skb->data;
5938         fc = le16_to_cpu(hdr->frame_control);
5939
5940         sdata_lock(sdata);
5941         switch (fc & IEEE80211_FCTL_STYPE) {
5942         case IEEE80211_STYPE_S1G_BEACON:
5943                 ieee80211_rx_mgmt_beacon(link, hdr, skb->len, rx_status);
5944                 break;
5945         }
5946         sdata_unlock(sdata);
5947 }
5948
5949 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
5950                                   struct sk_buff *skb)
5951 {
5952         struct ieee80211_link_data *link = &sdata->deflink;
5953         struct ieee80211_rx_status *rx_status;
5954         struct ieee80211_mgmt *mgmt;
5955         u16 fc;
5956         int ies_len;
5957
5958         rx_status = (struct ieee80211_rx_status *) skb->cb;
5959         mgmt = (struct ieee80211_mgmt *) skb->data;
5960         fc = le16_to_cpu(mgmt->frame_control);
5961
5962         sdata_lock(sdata);
5963
5964         if (rx_status->link_valid) {
5965                 link = sdata_dereference(sdata->link[rx_status->link_id],
5966                                          sdata);
5967                 if (!link)
5968                         goto out;
5969         }
5970
5971         switch (fc & IEEE80211_FCTL_STYPE) {
5972         case IEEE80211_STYPE_BEACON:
5973                 ieee80211_rx_mgmt_beacon(link, (void *)mgmt,
5974                                          skb->len, rx_status);
5975                 break;
5976         case IEEE80211_STYPE_PROBE_RESP:
5977                 ieee80211_rx_mgmt_probe_resp(link, skb);
5978                 break;
5979         case IEEE80211_STYPE_AUTH:
5980                 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
5981                 break;
5982         case IEEE80211_STYPE_DEAUTH:
5983                 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
5984                 break;
5985         case IEEE80211_STYPE_DISASSOC:
5986                 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
5987                 break;
5988         case IEEE80211_STYPE_ASSOC_RESP:
5989         case IEEE80211_STYPE_REASSOC_RESP:
5990                 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
5991                 break;
5992         case IEEE80211_STYPE_ACTION:
5993                 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
5994                         struct ieee802_11_elems *elems;
5995
5996                         ies_len = skb->len -
5997                                   offsetof(struct ieee80211_mgmt,
5998                                            u.action.u.chan_switch.variable);
5999
6000                         if (ies_len < 0)
6001                                 break;
6002
6003                         /* CSA IE cannot be overridden, no need for BSSID */
6004                         elems = ieee802_11_parse_elems(
6005                                         mgmt->u.action.u.chan_switch.variable,
6006                                         ies_len, true, NULL);
6007
6008                         if (elems && !elems->parse_error)
6009                                 ieee80211_sta_process_chanswitch(link,
6010                                                                  rx_status->mactime,
6011                                                                  rx_status->device_timestamp,
6012                                                                  elems, false);
6013                         kfree(elems);
6014                 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
6015                         struct ieee802_11_elems *elems;
6016
6017                         ies_len = skb->len -
6018                                   offsetof(struct ieee80211_mgmt,
6019                                            u.action.u.ext_chan_switch.variable);
6020
6021                         if (ies_len < 0)
6022                                 break;
6023
6024                         /*
6025                          * extended CSA IE can't be overridden, no need for
6026                          * BSSID
6027                          */
6028                         elems = ieee802_11_parse_elems(
6029                                         mgmt->u.action.u.ext_chan_switch.variable,
6030                                         ies_len, true, NULL);
6031
6032                         if (elems && !elems->parse_error) {
6033                                 /* for the handling code pretend it was an IE */
6034                                 elems->ext_chansw_ie =
6035                                         &mgmt->u.action.u.ext_chan_switch.data;
6036
6037                                 ieee80211_sta_process_chanswitch(link,
6038                                                                  rx_status->mactime,
6039                                                                  rx_status->device_timestamp,
6040                                                                  elems, false);
6041                         }
6042
6043                         kfree(elems);
6044                 }
6045                 break;
6046         }
6047 out:
6048         sdata_unlock(sdata);
6049 }
6050
6051 static void ieee80211_sta_timer(struct timer_list *t)
6052 {
6053         struct ieee80211_sub_if_data *sdata =
6054                 from_timer(sdata, t, u.mgd.timer);
6055
6056         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
6057 }
6058
6059 void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
6060                                    u8 reason, bool tx)
6061 {
6062         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6063
6064         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
6065                                tx, frame_buf);
6066
6067         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
6068                                     reason, false);
6069 }
6070
6071 static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
6072 {
6073         struct ieee80211_local *local = sdata->local;
6074         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6075         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
6076         u32 tx_flags = 0;
6077         u16 trans = 1;
6078         u16 status = 0;
6079         struct ieee80211_prep_tx_info info = {
6080                 .subtype = IEEE80211_STYPE_AUTH,
6081         };
6082
6083         sdata_assert_lock(sdata);
6084
6085         if (WARN_ON_ONCE(!auth_data))
6086                 return -EINVAL;
6087
6088         auth_data->tries++;
6089
6090         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
6091                 sdata_info(sdata, "authentication with %pM timed out\n",
6092                            auth_data->ap_addr);
6093
6094                 /*
6095                  * Most likely AP is not in the range so remove the
6096                  * bss struct for that AP.
6097                  */
6098                 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
6099
6100                 return -ETIMEDOUT;
6101         }
6102
6103         if (auth_data->algorithm == WLAN_AUTH_SAE)
6104                 info.duration = jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);
6105
6106         drv_mgd_prepare_tx(local, sdata, &info);
6107
6108         sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
6109                    auth_data->ap_addr, auth_data->tries,
6110                    IEEE80211_AUTH_MAX_TRIES);
6111
6112         auth_data->expected_transaction = 2;
6113
6114         if (auth_data->algorithm == WLAN_AUTH_SAE) {
6115                 trans = auth_data->sae_trans;
6116                 status = auth_data->sae_status;
6117                 auth_data->expected_transaction = trans;
6118         }
6119
6120         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
6121                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
6122                            IEEE80211_TX_INTFL_MLME_CONN_TX;
6123
6124         ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
6125                             auth_data->data, auth_data->data_len,
6126                             auth_data->ap_addr, auth_data->ap_addr,
6127                             NULL, 0, 0, tx_flags);
6128
6129         if (tx_flags == 0) {
6130                 if (auth_data->algorithm == WLAN_AUTH_SAE)
6131                         auth_data->timeout = jiffies +
6132                                 IEEE80211_AUTH_TIMEOUT_SAE;
6133                 else
6134                         auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
6135         } else {
6136                 auth_data->timeout =
6137                         round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
6138         }
6139
6140         auth_data->timeout_started = true;
6141         run_again(sdata, auth_data->timeout);
6142
6143         return 0;
6144 }
6145
6146 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
6147 {
6148         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
6149         struct ieee80211_local *local = sdata->local;
6150         int ret;
6151
6152         sdata_assert_lock(sdata);
6153
6154         assoc_data->tries++;
6155         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
6156                 sdata_info(sdata, "association with %pM timed out\n",
6157                            assoc_data->ap_addr);
6158
6159                 /*
6160                  * Most likely AP is not in the range so remove the
6161                  * bss struct for that AP.
6162                  */
6163                 cfg80211_unlink_bss(local->hw.wiphy,
6164                                     assoc_data->link[assoc_data->assoc_link_id].bss);
6165
6166                 return -ETIMEDOUT;
6167         }
6168
6169         sdata_info(sdata, "associate with %pM (try %d/%d)\n",
6170                    assoc_data->ap_addr, assoc_data->tries,
6171                    IEEE80211_ASSOC_MAX_TRIES);
6172         ret = ieee80211_send_assoc(sdata);
6173         if (ret)
6174                 return ret;
6175
6176         if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
6177                 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
6178                 assoc_data->timeout_started = true;
6179                 run_again(sdata, assoc_data->timeout);
6180         } else {
6181                 assoc_data->timeout =
6182                         round_jiffies_up(jiffies +
6183                                          IEEE80211_ASSOC_TIMEOUT_LONG);
6184                 assoc_data->timeout_started = true;
6185                 run_again(sdata, assoc_data->timeout);
6186         }
6187
6188         return 0;
6189 }
6190
6191 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
6192                                   __le16 fc, bool acked)
6193 {
6194         struct ieee80211_local *local = sdata->local;
6195
6196         sdata->u.mgd.status_fc = fc;
6197         sdata->u.mgd.status_acked = acked;
6198         sdata->u.mgd.status_received = true;
6199
6200         ieee80211_queue_work(&local->hw, &sdata->work);
6201 }
6202
6203 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
6204 {
6205         struct ieee80211_local *local = sdata->local;
6206         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6207
6208         sdata_lock(sdata);
6209
6210         if (ifmgd->status_received) {
6211                 __le16 fc = ifmgd->status_fc;
6212                 bool status_acked = ifmgd->status_acked;
6213
6214                 ifmgd->status_received = false;
6215                 if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
6216                         if (status_acked) {
6217                                 if (ifmgd->auth_data->algorithm ==
6218                                     WLAN_AUTH_SAE)
6219                                         ifmgd->auth_data->timeout =
6220                                                 jiffies +
6221                                                 IEEE80211_AUTH_TIMEOUT_SAE;
6222                                 else
6223                                         ifmgd->auth_data->timeout =
6224                                                 jiffies +
6225                                                 IEEE80211_AUTH_TIMEOUT_SHORT;
6226                                 run_again(sdata, ifmgd->auth_data->timeout);
6227                         } else {
6228                                 ifmgd->auth_data->timeout = jiffies - 1;
6229                         }
6230                         ifmgd->auth_data->timeout_started = true;
6231                 } else if (ifmgd->assoc_data &&
6232                            (ieee80211_is_assoc_req(fc) ||
6233                             ieee80211_is_reassoc_req(fc))) {
6234                         if (status_acked) {
6235                                 ifmgd->assoc_data->timeout =
6236                                         jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
6237                                 run_again(sdata, ifmgd->assoc_data->timeout);
6238                         } else {
6239                                 ifmgd->assoc_data->timeout = jiffies - 1;
6240                         }
6241                         ifmgd->assoc_data->timeout_started = true;
6242                 }
6243         }
6244
6245         if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
6246             time_after(jiffies, ifmgd->auth_data->timeout)) {
6247                 if (ifmgd->auth_data->done || ifmgd->auth_data->waiting) {
6248                         /*
6249                          * ok ... we waited for assoc or continuation but
6250                          * userspace didn't do it, so kill the auth data
6251                          */
6252                         ieee80211_destroy_auth_data(sdata, false);
6253                 } else if (ieee80211_auth(sdata)) {
6254                         u8 ap_addr[ETH_ALEN];
6255                         struct ieee80211_event event = {
6256                                 .type = MLME_EVENT,
6257                                 .u.mlme.data = AUTH_EVENT,
6258                                 .u.mlme.status = MLME_TIMEOUT,
6259                         };
6260
6261                         memcpy(ap_addr, ifmgd->auth_data->ap_addr, ETH_ALEN);
6262
6263                         ieee80211_destroy_auth_data(sdata, false);
6264
6265                         cfg80211_auth_timeout(sdata->dev, ap_addr);
6266                         drv_event_callback(sdata->local, sdata, &event);
6267                 }
6268         } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
6269                 run_again(sdata, ifmgd->auth_data->timeout);
6270
6271         if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
6272             time_after(jiffies, ifmgd->assoc_data->timeout)) {
6273                 if ((ifmgd->assoc_data->need_beacon &&
6274                      !sdata->deflink.u.mgd.have_beacon) ||
6275                     ieee80211_do_assoc(sdata)) {
6276                         struct ieee80211_event event = {
6277                                 .type = MLME_EVENT,
6278                                 .u.mlme.data = ASSOC_EVENT,
6279                                 .u.mlme.status = MLME_TIMEOUT,
6280                         };
6281
6282                         ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
6283                         drv_event_callback(sdata->local, sdata, &event);
6284                 }
6285         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
6286                 run_again(sdata, ifmgd->assoc_data->timeout);
6287
6288         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
6289             ifmgd->associated) {
6290                 u8 *bssid = sdata->deflink.u.mgd.bssid;
6291                 int max_tries;
6292
6293                 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
6294                         max_tries = max_nullfunc_tries;
6295                 else
6296                         max_tries = max_probe_tries;
6297
6298                 /* ACK received for nullfunc probing frame */
6299                 if (!ifmgd->probe_send_count)
6300                         ieee80211_reset_ap_probe(sdata);
6301                 else if (ifmgd->nullfunc_failed) {
6302                         if (ifmgd->probe_send_count < max_tries) {
6303                                 mlme_dbg(sdata,
6304                                          "No ack for nullfunc frame to AP %pM, try %d/%i\n",
6305                                          bssid, ifmgd->probe_send_count,
6306                                          max_tries);
6307                                 ieee80211_mgd_probe_ap_send(sdata);
6308                         } else {
6309                                 mlme_dbg(sdata,
6310                                          "No ack for nullfunc frame to AP %pM, disconnecting.\n",
6311                                          bssid);
6312                                 ieee80211_sta_connection_lost(sdata,
6313                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
6314                                         false);
6315                         }
6316                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
6317                         run_again(sdata, ifmgd->probe_timeout);
6318                 else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
6319                         mlme_dbg(sdata,
6320                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
6321                                  bssid, probe_wait_ms);
6322                         ieee80211_sta_connection_lost(sdata,
6323                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
6324                 } else if (ifmgd->probe_send_count < max_tries) {
6325                         mlme_dbg(sdata,
6326                                  "No probe response from AP %pM after %dms, try %d/%i\n",
6327                                  bssid, probe_wait_ms,
6328                                  ifmgd->probe_send_count, max_tries);
6329                         ieee80211_mgd_probe_ap_send(sdata);
6330                 } else {
6331                         /*
6332                          * We actually lost the connection ... or did we?
6333                          * Let's make sure!
6334                          */
6335                         mlme_dbg(sdata,
6336                                  "No probe response from AP %pM after %dms, disconnecting.\n",
6337                                  bssid, probe_wait_ms);
6338
6339                         ieee80211_sta_connection_lost(sdata,
6340                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
6341                 }
6342         }
6343
6344         sdata_unlock(sdata);
6345 }
6346
6347 static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
6348 {
6349         struct ieee80211_sub_if_data *sdata =
6350                 from_timer(sdata, t, u.mgd.bcn_mon_timer);
6351
6352         if (WARN_ON(sdata->vif.valid_links))
6353                 return;
6354
6355         if (sdata->vif.bss_conf.csa_active &&
6356             !sdata->deflink.u.mgd.csa_waiting_bcn)
6357                 return;
6358
6359         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
6360                 return;
6361
6362         sdata->u.mgd.connection_loss = false;
6363         ieee80211_queue_work(&sdata->local->hw,
6364                              &sdata->u.mgd.beacon_connection_loss_work);
6365 }
6366
6367 static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
6368 {
6369         struct ieee80211_sub_if_data *sdata =
6370                 from_timer(sdata, t, u.mgd.conn_mon_timer);
6371         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6372         struct ieee80211_local *local = sdata->local;
6373         struct sta_info *sta;
6374         unsigned long timeout;
6375
6376         if (WARN_ON(sdata->vif.valid_links))
6377                 return;
6378
6379         if (sdata->vif.bss_conf.csa_active &&
6380             !sdata->deflink.u.mgd.csa_waiting_bcn)
6381                 return;
6382
6383         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
6384         if (!sta)
6385                 return;
6386
6387         timeout = sta->deflink.status_stats.last_ack;
6388         if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx))
6389                 timeout = sta->deflink.rx_stats.last_rx;
6390         timeout += IEEE80211_CONNECTION_IDLE_TIME;
6391
6392         /* If timeout is after now, then update timer to fire at
6393          * the later date, but do not actually probe at this time.
6394          */
6395         if (time_is_after_jiffies(timeout)) {
6396                 mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
6397                 return;
6398         }
6399
6400         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
6401 }
6402
6403 static void ieee80211_sta_monitor_work(struct work_struct *work)
6404 {
6405         struct ieee80211_sub_if_data *sdata =
6406                 container_of(work, struct ieee80211_sub_if_data,
6407                              u.mgd.monitor_work);
6408
6409         ieee80211_mgd_probe_ap(sdata, false);
6410 }
6411
6412 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
6413 {
6414         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
6415                 __ieee80211_stop_poll(sdata);
6416
6417                 /* let's probe the connection once */
6418                 if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
6419                         ieee80211_queue_work(&sdata->local->hw,
6420                                              &sdata->u.mgd.monitor_work);
6421         }
6422 }
6423
6424 #ifdef CONFIG_PM
6425 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
6426 {
6427         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6428         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6429
6430         sdata_lock(sdata);
6431
6432         if (ifmgd->auth_data || ifmgd->assoc_data) {
6433                 const u8 *ap_addr = ifmgd->auth_data ?
6434                                 ifmgd->auth_data->ap_addr :
6435                                 ifmgd->assoc_data->ap_addr;
6436
6437                 /*
6438                  * If we are trying to authenticate / associate while suspending,
6439                  * cfg80211 won't know and won't actually abort those attempts,
6440                  * thus we need to do that ourselves.
6441                  */
6442                 ieee80211_send_deauth_disassoc(sdata, ap_addr, ap_addr,
6443                                                IEEE80211_STYPE_DEAUTH,
6444                                                WLAN_REASON_DEAUTH_LEAVING,
6445                                                false, frame_buf);
6446                 if (ifmgd->assoc_data)
6447                         ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
6448                 if (ifmgd->auth_data)
6449                         ieee80211_destroy_auth_data(sdata, false);
6450                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
6451                                       IEEE80211_DEAUTH_FRAME_LEN,
6452                                       false);
6453         }
6454
6455         /* This is a bit of a hack - we should find a better and more generic
6456          * solution to this. Normally when suspending, cfg80211 will in fact
6457          * deauthenticate. However, it doesn't (and cannot) stop an ongoing
6458          * auth (not so important) or assoc (this is the problem) process.
6459          *
6460          * As a consequence, it can happen that we are in the process of both
6461          * associating and suspending, and receive an association response
6462          * after cfg80211 has checked if it needs to disconnect, but before
6463          * we actually set the flag to drop incoming frames. This will then
6464          * cause the workqueue flush to process the association response in
6465          * the suspend, resulting in a successful association just before it
6466          * tries to remove the interface from the driver, which now though
6467          * has a channel context assigned ... this results in issues.
6468          *
6469          * To work around this (for now) simply deauth here again if we're
6470          * now connected.
6471          */
6472         if (ifmgd->associated && !sdata->local->wowlan) {
6473                 u8 bssid[ETH_ALEN];
6474                 struct cfg80211_deauth_request req = {
6475                         .reason_code = WLAN_REASON_DEAUTH_LEAVING,
6476                         .bssid = bssid,
6477                 };
6478
6479                 memcpy(bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
6480                 ieee80211_mgd_deauth(sdata, &req);
6481         }
6482
6483         sdata_unlock(sdata);
6484 }
6485 #endif
6486
6487 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
6488 {
6489         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6490
6491         sdata_lock(sdata);
6492         if (!ifmgd->associated) {
6493                 sdata_unlock(sdata);
6494                 return;
6495         }
6496
6497         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
6498                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
6499                 mlme_dbg(sdata, "driver requested disconnect after resume\n");
6500                 ieee80211_sta_connection_lost(sdata,
6501                                               WLAN_REASON_UNSPECIFIED,
6502                                               true);
6503                 sdata_unlock(sdata);
6504                 return;
6505         }
6506
6507         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_HW_RESTART) {
6508                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_HW_RESTART;
6509                 mlme_dbg(sdata, "driver requested disconnect after hardware restart\n");
6510                 ieee80211_sta_connection_lost(sdata,
6511                                               WLAN_REASON_UNSPECIFIED,
6512                                               true);
6513                 sdata_unlock(sdata);
6514                 return;
6515         }
6516
6517         sdata_unlock(sdata);
6518 }
6519
6520 static void ieee80211_request_smps_mgd_work(struct work_struct *work)
6521 {
6522         struct ieee80211_link_data *link =
6523                 container_of(work, struct ieee80211_link_data,
6524                              u.mgd.request_smps_work);
6525
6526         sdata_lock(link->sdata);
6527         __ieee80211_request_smps_mgd(link->sdata, link,
6528                                      link->u.mgd.driver_smps_mode);
6529         sdata_unlock(link->sdata);
6530 }
6531
6532 /* interface setup */
6533 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
6534 {
6535         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6536
6537         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
6538         INIT_WORK(&ifmgd->beacon_connection_loss_work,
6539                   ieee80211_beacon_connection_loss_work);
6540         INIT_WORK(&ifmgd->csa_connection_drop_work,
6541                   ieee80211_csa_connection_drop_work);
6542         INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
6543                           ieee80211_tdls_peer_del_work);
6544         timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
6545         timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
6546         timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
6547         INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
6548                           ieee80211_sta_handle_tspec_ac_params_wk);
6549
6550         ifmgd->flags = 0;
6551         ifmgd->powersave = sdata->wdev.ps;
6552         ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
6553         ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
6554         /* Setup TDLS data */
6555         spin_lock_init(&ifmgd->teardown_lock);
6556         ifmgd->teardown_skb = NULL;
6557         ifmgd->orig_teardown_skb = NULL;
6558 }
6559
6560 void ieee80211_mgd_setup_link(struct ieee80211_link_data *link)
6561 {
6562         struct ieee80211_sub_if_data *sdata = link->sdata;
6563         struct ieee80211_local *local = sdata->local;
6564         unsigned int link_id = link->link_id;
6565
6566         link->u.mgd.p2p_noa_index = -1;
6567         link->u.mgd.conn_flags = 0;
6568         link->conf->bssid = link->u.mgd.bssid;
6569
6570         INIT_WORK(&link->u.mgd.request_smps_work,
6571                   ieee80211_request_smps_mgd_work);
6572         if (local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
6573                 link->u.mgd.req_smps = IEEE80211_SMPS_AUTOMATIC;
6574         else
6575                 link->u.mgd.req_smps = IEEE80211_SMPS_OFF;
6576
6577         INIT_WORK(&link->u.mgd.chswitch_work, ieee80211_chswitch_work);
6578         timer_setup(&link->u.mgd.chswitch_timer, ieee80211_chswitch_timer, 0);
6579
6580         if (sdata->u.mgd.assoc_data)
6581                 ether_addr_copy(link->conf->addr,
6582                                 sdata->u.mgd.assoc_data->link[link_id].addr);
6583         else if (!is_valid_ether_addr(link->conf->addr))
6584                 eth_random_addr(link->conf->addr);
6585 }
6586
6587 /* scan finished notification */
6588 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
6589 {
6590         struct ieee80211_sub_if_data *sdata;
6591
6592         /* Restart STA timers */
6593         rcu_read_lock();
6594         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
6595                 if (ieee80211_sdata_running(sdata))
6596                         ieee80211_restart_sta_timer(sdata);
6597         }
6598         rcu_read_unlock();
6599 }
6600
6601 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
6602                                      struct cfg80211_bss *cbss, s8 link_id,
6603                                      const u8 *ap_mld_addr, bool assoc,
6604                                      bool override)
6605 {
6606         struct ieee80211_local *local = sdata->local;
6607         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6608         struct ieee80211_bss *bss = (void *)cbss->priv;
6609         struct sta_info *new_sta = NULL;
6610         struct ieee80211_link_data *link;
6611         bool have_sta = false;
6612         bool mlo;
6613         int err;
6614
6615         if (link_id >= 0) {
6616                 mlo = true;
6617                 if (WARN_ON(!ap_mld_addr))
6618                         return -EINVAL;
6619                 err = ieee80211_vif_set_links(sdata, BIT(link_id));
6620         } else {
6621                 if (WARN_ON(ap_mld_addr))
6622                         return -EINVAL;
6623                 ap_mld_addr = cbss->bssid;
6624                 err = ieee80211_vif_set_links(sdata, 0);
6625                 link_id = 0;
6626                 mlo = false;
6627         }
6628
6629         if (err)
6630                 return err;
6631
6632         link = sdata_dereference(sdata->link[link_id], sdata);
6633         if (WARN_ON(!link)) {
6634                 err = -ENOLINK;
6635                 goto out_err;
6636         }
6637
6638         if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) {
6639                 err = -EINVAL;
6640                 goto out_err;
6641         }
6642
6643         /* If a reconfig is happening, bail out */
6644         if (local->in_reconfig) {
6645                 err = -EBUSY;
6646                 goto out_err;
6647         }
6648
6649         if (assoc) {
6650                 rcu_read_lock();
6651                 have_sta = sta_info_get(sdata, ap_mld_addr);
6652                 rcu_read_unlock();
6653         }
6654
6655         if (!have_sta) {
6656                 if (mlo)
6657                         new_sta = sta_info_alloc_with_link(sdata, ap_mld_addr,
6658                                                            link_id, cbss->bssid,
6659                                                            GFP_KERNEL);
6660                 else
6661                         new_sta = sta_info_alloc(sdata, ap_mld_addr, GFP_KERNEL);
6662
6663                 if (!new_sta) {
6664                         err = -ENOMEM;
6665                         goto out_err;
6666                 }
6667
6668                 new_sta->sta.mlo = mlo;
6669         }
6670
6671         /*
6672          * Set up the information for the new channel before setting the
6673          * new channel. We can't - completely race-free - change the basic
6674          * rates bitmap and the channel (sband) that it refers to, but if
6675          * we set it up before we at least avoid calling into the driver's
6676          * bss_info_changed() method with invalid information (since we do
6677          * call that from changing the channel - only for IDLE and perhaps
6678          * some others, but ...).
6679          *
6680          * So to avoid that, just set up all the new information before the
6681          * channel, but tell the driver to apply it only afterwards, since
6682          * it might need the new channel for that.
6683          */
6684         if (new_sta) {
6685                 const struct cfg80211_bss_ies *ies;
6686                 struct link_sta_info *link_sta;
6687
6688                 rcu_read_lock();
6689                 link_sta = rcu_dereference(new_sta->link[link_id]);
6690                 if (WARN_ON(!link_sta)) {
6691                         rcu_read_unlock();
6692                         sta_info_free(local, new_sta);
6693                         err = -EINVAL;
6694                         goto out_err;
6695                 }
6696
6697                 err = ieee80211_mgd_setup_link_sta(link, new_sta,
6698                                                    link_sta, cbss);
6699                 if (err) {
6700                         rcu_read_unlock();
6701                         sta_info_free(local, new_sta);
6702                         goto out_err;
6703                 }
6704
6705                 memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
6706
6707                 /* set timing information */
6708                 link->conf->beacon_int = cbss->beacon_interval;
6709                 ies = rcu_dereference(cbss->beacon_ies);
6710                 if (ies) {
6711                         link->conf->sync_tsf = ies->tsf;
6712                         link->conf->sync_device_ts =
6713                                 bss->device_ts_beacon;
6714
6715                         ieee80211_get_dtim(ies,
6716                                            &link->conf->sync_dtim_count,
6717                                            NULL);
6718                 } else if (!ieee80211_hw_check(&sdata->local->hw,
6719                                                TIMING_BEACON_ONLY)) {
6720                         ies = rcu_dereference(cbss->proberesp_ies);
6721                         /* must be non-NULL since beacon IEs were NULL */
6722                         link->conf->sync_tsf = ies->tsf;
6723                         link->conf->sync_device_ts =
6724                                 bss->device_ts_presp;
6725                         link->conf->sync_dtim_count = 0;
6726                 } else {
6727                         link->conf->sync_tsf = 0;
6728                         link->conf->sync_device_ts = 0;
6729                         link->conf->sync_dtim_count = 0;
6730                 }
6731                 rcu_read_unlock();
6732         }
6733
6734         if (new_sta || override) {
6735                 err = ieee80211_prep_channel(sdata, link, cbss,
6736                                              &link->u.mgd.conn_flags);
6737                 if (err) {
6738                         if (new_sta)
6739                                 sta_info_free(local, new_sta);
6740                         goto out_err;
6741                 }
6742         }
6743
6744         if (new_sta) {
6745                 /*
6746                  * tell driver about BSSID, basic rates and timing
6747                  * this was set up above, before setting the channel
6748                  */
6749                 ieee80211_link_info_change_notify(sdata, link,
6750                                                   BSS_CHANGED_BSSID |
6751                                                   BSS_CHANGED_BASIC_RATES |
6752                                                   BSS_CHANGED_BEACON_INT);
6753
6754                 if (assoc)
6755                         sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
6756
6757                 err = sta_info_insert(new_sta);
6758                 new_sta = NULL;
6759                 if (err) {
6760                         sdata_info(sdata,
6761                                    "failed to insert STA entry for the AP (error %d)\n",
6762                                    err);
6763                         goto out_err;
6764                 }
6765         } else
6766                 WARN_ON_ONCE(!ether_addr_equal(link->u.mgd.bssid, cbss->bssid));
6767
6768         /* Cancel scan to ensure that nothing interferes with connection */
6769         if (local->scanning)
6770                 ieee80211_scan_cancel(local);
6771
6772         return 0;
6773
6774 out_err:
6775         ieee80211_link_release_channel(&sdata->deflink);
6776         ieee80211_vif_set_links(sdata, 0);
6777         return err;
6778 }
6779
6780 /* config hooks */
6781 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
6782                        struct cfg80211_auth_request *req)
6783 {
6784         struct ieee80211_local *local = sdata->local;
6785         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6786         struct ieee80211_mgd_auth_data *auth_data;
6787         u16 auth_alg;
6788         int err;
6789         bool cont_auth;
6790
6791         /* prepare auth data structure */
6792
6793         switch (req->auth_type) {
6794         case NL80211_AUTHTYPE_OPEN_SYSTEM:
6795                 auth_alg = WLAN_AUTH_OPEN;
6796                 break;
6797         case NL80211_AUTHTYPE_SHARED_KEY:
6798                 if (fips_enabled)
6799                         return -EOPNOTSUPP;
6800                 auth_alg = WLAN_AUTH_SHARED_KEY;
6801                 break;
6802         case NL80211_AUTHTYPE_FT:
6803                 auth_alg = WLAN_AUTH_FT;
6804                 break;
6805         case NL80211_AUTHTYPE_NETWORK_EAP:
6806                 auth_alg = WLAN_AUTH_LEAP;
6807                 break;
6808         case NL80211_AUTHTYPE_SAE:
6809                 auth_alg = WLAN_AUTH_SAE;
6810                 break;
6811         case NL80211_AUTHTYPE_FILS_SK:
6812                 auth_alg = WLAN_AUTH_FILS_SK;
6813                 break;
6814         case NL80211_AUTHTYPE_FILS_SK_PFS:
6815                 auth_alg = WLAN_AUTH_FILS_SK_PFS;
6816                 break;
6817         case NL80211_AUTHTYPE_FILS_PK:
6818                 auth_alg = WLAN_AUTH_FILS_PK;
6819                 break;
6820         default:
6821                 return -EOPNOTSUPP;
6822         }
6823
6824         if (ifmgd->assoc_data)
6825                 return -EBUSY;
6826
6827         auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
6828                             req->ie_len, GFP_KERNEL);
6829         if (!auth_data)
6830                 return -ENOMEM;
6831
6832         memcpy(auth_data->ap_addr,
6833                req->ap_mld_addr ?: req->bss->bssid,
6834                ETH_ALEN);
6835         auth_data->bss = req->bss;
6836         auth_data->link_id = req->link_id;
6837
6838         if (req->auth_data_len >= 4) {
6839                 if (req->auth_type == NL80211_AUTHTYPE_SAE) {
6840                         __le16 *pos = (__le16 *) req->auth_data;
6841
6842                         auth_data->sae_trans = le16_to_cpu(pos[0]);
6843                         auth_data->sae_status = le16_to_cpu(pos[1]);
6844                 }
6845                 memcpy(auth_data->data, req->auth_data + 4,
6846                        req->auth_data_len - 4);
6847                 auth_data->data_len += req->auth_data_len - 4;
6848         }
6849
6850         /* Check if continuing authentication or trying to authenticate with the
6851          * same BSS that we were in the process of authenticating with and avoid
6852          * removal and re-addition of the STA entry in
6853          * ieee80211_prep_connection().
6854          */
6855         cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss &&
6856                     ifmgd->auth_data->link_id == req->link_id;
6857
6858         if (req->ie && req->ie_len) {
6859                 memcpy(&auth_data->data[auth_data->data_len],
6860                        req->ie, req->ie_len);
6861                 auth_data->data_len += req->ie_len;
6862         }
6863
6864         if (req->key && req->key_len) {
6865                 auth_data->key_len = req->key_len;
6866                 auth_data->key_idx = req->key_idx;
6867                 memcpy(auth_data->key, req->key, req->key_len);
6868         }
6869
6870         auth_data->algorithm = auth_alg;
6871
6872         /* try to authenticate/probe */
6873
6874         if (ifmgd->auth_data) {
6875                 if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
6876                         auth_data->peer_confirmed =
6877                                 ifmgd->auth_data->peer_confirmed;
6878                 }
6879                 ieee80211_destroy_auth_data(sdata, cont_auth);
6880         }
6881
6882         /* prep auth_data so we don't go into idle on disassoc */
6883         ifmgd->auth_data = auth_data;
6884
6885         /* If this is continuation of an ongoing SAE authentication exchange
6886          * (i.e., request to send SAE Confirm) and the peer has already
6887          * confirmed, mark authentication completed since we are about to send
6888          * out SAE Confirm.
6889          */
6890         if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
6891             auth_data->peer_confirmed && auth_data->sae_trans == 2)
6892                 ieee80211_mark_sta_auth(sdata);
6893
6894         if (ifmgd->associated) {
6895                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6896
6897                 sdata_info(sdata,
6898                            "disconnect from AP %pM for new auth to %pM\n",
6899                            sdata->vif.cfg.ap_addr, auth_data->ap_addr);
6900                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
6901                                        WLAN_REASON_UNSPECIFIED,
6902                                        false, frame_buf);
6903
6904                 ieee80211_report_disconnect(sdata, frame_buf,
6905                                             sizeof(frame_buf), true,
6906                                             WLAN_REASON_UNSPECIFIED,
6907                                             false);
6908         }
6909
6910         sdata_info(sdata, "authenticate with %pM\n", auth_data->ap_addr);
6911
6912         /* needed for transmitting the auth frame(s) properly */
6913         memcpy(sdata->vif.cfg.ap_addr, auth_data->ap_addr, ETH_ALEN);
6914
6915         err = ieee80211_prep_connection(sdata, req->bss, req->link_id,
6916                                         req->ap_mld_addr, cont_auth, false);
6917         if (err)
6918                 goto err_clear;
6919
6920         err = ieee80211_auth(sdata);
6921         if (err) {
6922                 sta_info_destroy_addr(sdata, auth_data->ap_addr);
6923                 goto err_clear;
6924         }
6925
6926         /* hold our own reference */
6927         cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
6928         return 0;
6929
6930  err_clear:
6931         if (!sdata->vif.valid_links) {
6932                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
6933                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
6934                                                   BSS_CHANGED_BSSID);
6935                 mutex_lock(&sdata->local->mtx);
6936                 ieee80211_link_release_channel(&sdata->deflink);
6937                 mutex_unlock(&sdata->local->mtx);
6938         }
6939         ifmgd->auth_data = NULL;
6940         kfree(auth_data);
6941         return err;
6942 }
6943
6944 static ieee80211_conn_flags_t
6945 ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
6946                            struct ieee80211_mgd_assoc_data *assoc_data,
6947                            struct cfg80211_assoc_request *req,
6948                            ieee80211_conn_flags_t conn_flags,
6949                            unsigned int link_id)
6950 {
6951         struct ieee80211_local *local = sdata->local;
6952         const struct cfg80211_bss_ies *beacon_ies;
6953         struct ieee80211_supported_band *sband;
6954         const struct element *ht_elem, *vht_elem;
6955         struct ieee80211_link_data *link;
6956         struct cfg80211_bss *cbss;
6957         struct ieee80211_bss *bss;
6958         bool is_5ghz, is_6ghz;
6959
6960         cbss = assoc_data->link[link_id].bss;
6961         if (WARN_ON(!cbss))
6962                 return 0;
6963
6964         bss = (void *)cbss->priv;
6965
6966         sband = local->hw.wiphy->bands[cbss->channel->band];
6967         if (WARN_ON(!sband))
6968                 return 0;
6969
6970         link = sdata_dereference(sdata->link[link_id], sdata);
6971         if (WARN_ON(!link))
6972                 return 0;
6973
6974         is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
6975         is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
6976
6977         /* for MLO connections assume advertising all rates is OK */
6978         if (!req->ap_mld_addr) {
6979                 assoc_data->supp_rates = bss->supp_rates;
6980                 assoc_data->supp_rates_len = bss->supp_rates_len;
6981         }
6982
6983         /* copy and link elems for the STA profile */
6984         if (req->links[link_id].elems_len) {
6985                 memcpy(assoc_data->ie_pos, req->links[link_id].elems,
6986                        req->links[link_id].elems_len);
6987                 assoc_data->link[link_id].elems = assoc_data->ie_pos;
6988                 assoc_data->link[link_id].elems_len = req->links[link_id].elems_len;
6989                 assoc_data->ie_pos += req->links[link_id].elems_len;
6990         }
6991
6992         rcu_read_lock();
6993         ht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_OPERATION);
6994         if (ht_elem && ht_elem->datalen >= sizeof(struct ieee80211_ht_operation))
6995                 assoc_data->link[link_id].ap_ht_param =
6996                         ((struct ieee80211_ht_operation *)(ht_elem->data))->ht_param;
6997         else if (!is_6ghz)
6998                 conn_flags |= IEEE80211_CONN_DISABLE_HT;
6999         vht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
7000         if (vht_elem && vht_elem->datalen >= sizeof(struct ieee80211_vht_cap)) {
7001                 memcpy(&assoc_data->link[link_id].ap_vht_cap, vht_elem->data,
7002                        sizeof(struct ieee80211_vht_cap));
7003         } else if (is_5ghz) {
7004                 link_info(link,
7005                           "VHT capa missing/short, disabling VHT/HE/EHT\n");
7006                 conn_flags |= IEEE80211_CONN_DISABLE_VHT |
7007                               IEEE80211_CONN_DISABLE_HE |
7008                               IEEE80211_CONN_DISABLE_EHT;
7009         }
7010         rcu_read_unlock();
7011
7012         link->u.mgd.beacon_crc_valid = false;
7013         link->u.mgd.dtim_period = 0;
7014         link->u.mgd.have_beacon = false;
7015
7016         /* override HT/VHT configuration only if the AP and we support it */
7017         if (!(conn_flags & IEEE80211_CONN_DISABLE_HT)) {
7018                 struct ieee80211_sta_ht_cap sta_ht_cap;
7019
7020                 memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
7021                 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
7022         }
7023
7024         link->conf->eht_puncturing = 0;
7025
7026         rcu_read_lock();
7027         beacon_ies = rcu_dereference(cbss->beacon_ies);
7028         if (beacon_ies) {
7029                 const struct ieee80211_eht_operation *eht_oper;
7030                 const struct element *elem;
7031                 u8 dtim_count = 0;
7032
7033                 ieee80211_get_dtim(beacon_ies, &dtim_count,
7034                                    &link->u.mgd.dtim_period);
7035
7036                 sdata->deflink.u.mgd.have_beacon = true;
7037
7038                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
7039                         link->conf->sync_tsf = beacon_ies->tsf;
7040                         link->conf->sync_device_ts = bss->device_ts_beacon;
7041                         link->conf->sync_dtim_count = dtim_count;
7042                 }
7043
7044                 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
7045                                               beacon_ies->data, beacon_ies->len);
7046                 if (elem && elem->datalen >= 3)
7047                         link->conf->profile_periodicity = elem->data[2];
7048                 else
7049                         link->conf->profile_periodicity = 0;
7050
7051                 elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
7052                                           beacon_ies->data, beacon_ies->len);
7053                 if (elem && elem->datalen >= 11 &&
7054                     (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
7055                         link->conf->ema_ap = true;
7056                 else
7057                         link->conf->ema_ap = false;
7058
7059                 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION,
7060                                               beacon_ies->data, beacon_ies->len);
7061                 eht_oper = (const void *)(elem->data + 1);
7062
7063                 if (elem &&
7064                     ieee80211_eht_oper_size_ok((const void *)(elem->data + 1),
7065                                                elem->datalen - 1) &&
7066                     (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
7067                     (eht_oper->params & IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
7068                         const struct ieee80211_eht_operation_info *info =
7069                                 (void *)eht_oper->optional;
7070                         const u8 *disable_subchannel_bitmap = info->optional;
7071                         u16 bitmap;
7072
7073                         bitmap = get_unaligned_le16(disable_subchannel_bitmap);
7074                         if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
7075                                                                      &link->conf->chandef))
7076                                 ieee80211_handle_puncturing_bitmap(link,
7077                                                                    eht_oper,
7078                                                                    bitmap,
7079                                                                    NULL);
7080                         else
7081                                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7082                 }
7083         }
7084         rcu_read_unlock();
7085
7086         if (bss->corrupt_data) {
7087                 char *corrupt_type = "data";
7088
7089                 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
7090                         if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
7091                                 corrupt_type = "beacon and probe response";
7092                         else
7093                                 corrupt_type = "beacon";
7094                 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) {
7095                         corrupt_type = "probe response";
7096                 }
7097                 sdata_info(sdata, "associating to AP %pM with corrupt %s\n",
7098                            cbss->bssid, corrupt_type);
7099         }
7100
7101         if (link->u.mgd.req_smps == IEEE80211_SMPS_AUTOMATIC) {
7102                 if (sdata->u.mgd.powersave)
7103                         link->smps_mode = IEEE80211_SMPS_DYNAMIC;
7104                 else
7105                         link->smps_mode = IEEE80211_SMPS_OFF;
7106         } else {
7107                 link->smps_mode = link->u.mgd.req_smps;
7108         }
7109
7110         return conn_flags;
7111 }
7112
7113 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
7114                         struct cfg80211_assoc_request *req)
7115 {
7116         unsigned int assoc_link_id = req->link_id < 0 ? 0 : req->link_id;
7117         struct ieee80211_local *local = sdata->local;
7118         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7119         struct ieee80211_mgd_assoc_data *assoc_data;
7120         const struct element *ssid_elem;
7121         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
7122         ieee80211_conn_flags_t conn_flags = 0;
7123         struct ieee80211_link_data *link;
7124         struct cfg80211_bss *cbss;
7125         struct ieee80211_bss *bss;
7126         bool override;
7127         int i, err;
7128         size_t size = sizeof(*assoc_data) + req->ie_len;
7129
7130         for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++)
7131                 size += req->links[i].elems_len;
7132
7133         /* FIXME: no support for 4-addr MLO yet */
7134         if (sdata->u.mgd.use_4addr && req->link_id >= 0)
7135                 return -EOPNOTSUPP;
7136
7137         assoc_data = kzalloc(size, GFP_KERNEL);
7138         if (!assoc_data)
7139                 return -ENOMEM;
7140
7141         cbss = req->link_id < 0 ? req->bss : req->links[req->link_id].bss;
7142
7143         rcu_read_lock();
7144         ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
7145         if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) {
7146                 rcu_read_unlock();
7147                 kfree(assoc_data);
7148                 return -EINVAL;
7149         }
7150         memcpy(assoc_data->ssid, ssid_elem->data, ssid_elem->datalen);
7151         assoc_data->ssid_len = ssid_elem->datalen;
7152         memcpy(vif_cfg->ssid, assoc_data->ssid, assoc_data->ssid_len);
7153         vif_cfg->ssid_len = assoc_data->ssid_len;
7154         rcu_read_unlock();
7155
7156         if (req->ap_mld_addr) {
7157                 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7158                         if (!req->links[i].bss)
7159                                 continue;
7160                         link = sdata_dereference(sdata->link[i], sdata);
7161                         if (link)
7162                                 ether_addr_copy(assoc_data->link[i].addr,
7163                                                 link->conf->addr);
7164                         else
7165                                 eth_random_addr(assoc_data->link[i].addr);
7166                 }
7167         } else {
7168                 memcpy(assoc_data->link[0].addr, sdata->vif.addr, ETH_ALEN);
7169         }
7170
7171         assoc_data->s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
7172
7173         memcpy(assoc_data->ap_addr,
7174                req->ap_mld_addr ?: req->bss->bssid,
7175                ETH_ALEN);
7176
7177         if (ifmgd->associated) {
7178                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7179
7180                 sdata_info(sdata,
7181                            "disconnect from AP %pM for new assoc to %pM\n",
7182                            sdata->vif.cfg.ap_addr, assoc_data->ap_addr);
7183                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7184                                        WLAN_REASON_UNSPECIFIED,
7185                                        false, frame_buf);
7186
7187                 ieee80211_report_disconnect(sdata, frame_buf,
7188                                             sizeof(frame_buf), true,
7189                                             WLAN_REASON_UNSPECIFIED,
7190                                             false);
7191         }
7192
7193         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
7194                 err = -EBUSY;
7195                 goto err_free;
7196         }
7197
7198         if (ifmgd->assoc_data) {
7199                 err = -EBUSY;
7200                 goto err_free;
7201         }
7202
7203         if (ifmgd->auth_data) {
7204                 bool match;
7205
7206                 /* keep sta info, bssid if matching */
7207                 match = ether_addr_equal(ifmgd->auth_data->ap_addr,
7208                                          assoc_data->ap_addr) &&
7209                         ifmgd->auth_data->link_id == req->link_id;
7210                 ieee80211_destroy_auth_data(sdata, match);
7211         }
7212
7213         /* prepare assoc data */
7214
7215         bss = (void *)cbss->priv;
7216         assoc_data->wmm = bss->wmm_used &&
7217                           (local->hw.queues >= IEEE80211_NUM_ACS);
7218
7219         /*
7220          * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
7221          * We still associate in non-HT mode (11a/b/g) if any one of these
7222          * ciphers is configured as pairwise.
7223          * We can set this to true for non-11n hardware, that'll be checked
7224          * separately along with the peer capabilities.
7225          */
7226         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
7227                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
7228                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
7229                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
7230                         conn_flags |= IEEE80211_CONN_DISABLE_HT;
7231                         conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7232                         conn_flags |= IEEE80211_CONN_DISABLE_HE;
7233                         conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7234                         netdev_info(sdata->dev,
7235                                     "disabling HT/VHT/HE due to WEP/TKIP use\n");
7236                 }
7237         }
7238
7239         /* also disable HT/VHT/HE/EHT if the AP doesn't use WMM */
7240         if (!bss->wmm_used) {
7241                 conn_flags |= IEEE80211_CONN_DISABLE_HT;
7242                 conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7243                 conn_flags |= IEEE80211_CONN_DISABLE_HE;
7244                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7245                 netdev_info(sdata->dev,
7246                             "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
7247         }
7248
7249         if (req->flags & ASSOC_REQ_DISABLE_HT) {
7250                 mlme_dbg(sdata, "HT disabled by flag, disabling HT/VHT/HE\n");
7251                 conn_flags |= IEEE80211_CONN_DISABLE_HT;
7252                 conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7253                 conn_flags |= IEEE80211_CONN_DISABLE_HE;
7254                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7255         }
7256
7257         if (req->flags & ASSOC_REQ_DISABLE_VHT) {
7258                 mlme_dbg(sdata, "VHT disabled by flag, disabling VHT\n");
7259                 conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7260         }
7261
7262         if (req->flags & ASSOC_REQ_DISABLE_HE) {
7263                 mlme_dbg(sdata, "HE disabled by flag, disabling HE/EHT\n");
7264                 conn_flags |= IEEE80211_CONN_DISABLE_HE;
7265                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7266         }
7267
7268         if (req->flags & ASSOC_REQ_DISABLE_EHT)
7269                 conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7270
7271         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
7272         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
7273                sizeof(ifmgd->ht_capa_mask));
7274
7275         memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
7276         memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
7277                sizeof(ifmgd->vht_capa_mask));
7278
7279         memcpy(&ifmgd->s1g_capa, &req->s1g_capa, sizeof(ifmgd->s1g_capa));
7280         memcpy(&ifmgd->s1g_capa_mask, &req->s1g_capa_mask,
7281                sizeof(ifmgd->s1g_capa_mask));
7282
7283         if (req->ie && req->ie_len) {
7284                 memcpy(assoc_data->ie, req->ie, req->ie_len);
7285                 assoc_data->ie_len = req->ie_len;
7286                 assoc_data->ie_pos = assoc_data->ie + assoc_data->ie_len;
7287         } else {
7288                 assoc_data->ie_pos = assoc_data->ie;
7289         }
7290
7291         if (req->fils_kek) {
7292                 /* should already be checked in cfg80211 - so warn */
7293                 if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
7294                         err = -EINVAL;
7295                         goto err_free;
7296                 }
7297                 memcpy(assoc_data->fils_kek, req->fils_kek,
7298                        req->fils_kek_len);
7299                 assoc_data->fils_kek_len = req->fils_kek_len;
7300         }
7301
7302         if (req->fils_nonces)
7303                 memcpy(assoc_data->fils_nonces, req->fils_nonces,
7304                        2 * FILS_NONCE_LEN);
7305
7306         /* default timeout */
7307         assoc_data->timeout = jiffies;
7308         assoc_data->timeout_started = true;
7309
7310         assoc_data->assoc_link_id = assoc_link_id;
7311
7312         if (req->ap_mld_addr) {
7313                 for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
7314                         assoc_data->link[i].conn_flags = conn_flags;
7315                         assoc_data->link[i].bss = req->links[i].bss;
7316                 }
7317
7318                 /* if there was no authentication, set up the link */
7319                 err = ieee80211_vif_set_links(sdata, BIT(assoc_link_id));
7320                 if (err)
7321                         goto err_clear;
7322         } else {
7323                 assoc_data->link[0].conn_flags = conn_flags;
7324                 assoc_data->link[0].bss = cbss;
7325         }
7326
7327         link = sdata_dereference(sdata->link[assoc_link_id], sdata);
7328         if (WARN_ON(!link)) {
7329                 err = -EINVAL;
7330                 goto err_clear;
7331         }
7332
7333         /* keep old conn_flags from ieee80211_prep_channel() from auth */
7334         conn_flags |= link->u.mgd.conn_flags;
7335         conn_flags |= ieee80211_setup_assoc_link(sdata, assoc_data, req,
7336                                                  conn_flags, assoc_link_id);
7337         override = link->u.mgd.conn_flags != conn_flags;
7338         link->u.mgd.conn_flags |= conn_flags;
7339
7340         if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
7341                  ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
7342              "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
7343                 sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
7344
7345         if (bss->wmm_used && bss->uapsd_supported &&
7346             (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
7347                 assoc_data->uapsd = true;
7348                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
7349         } else {
7350                 assoc_data->uapsd = false;
7351                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
7352         }
7353
7354         if (req->prev_bssid)
7355                 memcpy(assoc_data->prev_ap_addr, req->prev_bssid, ETH_ALEN);
7356
7357         if (req->use_mfp) {
7358                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
7359                 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
7360         } else {
7361                 ifmgd->mfp = IEEE80211_MFP_DISABLED;
7362                 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
7363         }
7364
7365         if (req->flags & ASSOC_REQ_USE_RRM)
7366                 ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
7367         else
7368                 ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
7369
7370         if (req->crypto.control_port)
7371                 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
7372         else
7373                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
7374
7375         sdata->control_port_protocol = req->crypto.control_port_ethertype;
7376         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
7377         sdata->control_port_over_nl80211 =
7378                                         req->crypto.control_port_over_nl80211;
7379         sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
7380
7381         /* kick off associate process */
7382         ifmgd->assoc_data = assoc_data;
7383
7384         for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
7385                 if (!assoc_data->link[i].bss)
7386                         continue;
7387                 if (i == assoc_data->assoc_link_id)
7388                         continue;
7389                 /* only calculate the flags, hence link == NULL */
7390                 err = ieee80211_prep_channel(sdata, NULL, assoc_data->link[i].bss,
7391                                              &assoc_data->link[i].conn_flags);
7392                 if (err)
7393                         goto err_clear;
7394         }
7395
7396         /* needed for transmitting the assoc frames properly */
7397         memcpy(sdata->vif.cfg.ap_addr, assoc_data->ap_addr, ETH_ALEN);
7398
7399         err = ieee80211_prep_connection(sdata, cbss, req->link_id,
7400                                         req->ap_mld_addr, true, override);
7401         if (err)
7402                 goto err_clear;
7403
7404         assoc_data->link[assoc_data->assoc_link_id].conn_flags =
7405                 link->u.mgd.conn_flags;
7406
7407         if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC)) {
7408                 const struct cfg80211_bss_ies *beacon_ies;
7409
7410                 rcu_read_lock();
7411                 beacon_ies = rcu_dereference(req->bss->beacon_ies);
7412
7413                 if (beacon_ies) {
7414                         /*
7415                          * Wait up to one beacon interval ...
7416                          * should this be more if we miss one?
7417                          */
7418                         sdata_info(sdata, "waiting for beacon from %pM\n",
7419                                    link->u.mgd.bssid);
7420                         assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
7421                         assoc_data->timeout_started = true;
7422                         assoc_data->need_beacon = true;
7423                 }
7424                 rcu_read_unlock();
7425         }
7426
7427         run_again(sdata, assoc_data->timeout);
7428
7429         return 0;
7430  err_clear:
7431         eth_zero_addr(sdata->deflink.u.mgd.bssid);
7432         ieee80211_link_info_change_notify(sdata, &sdata->deflink,
7433                                           BSS_CHANGED_BSSID);
7434         ifmgd->assoc_data = NULL;
7435  err_free:
7436         kfree(assoc_data);
7437         return err;
7438 }
7439
7440 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
7441                          struct cfg80211_deauth_request *req)
7442 {
7443         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7444         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7445         bool tx = !req->local_state_change;
7446         struct ieee80211_prep_tx_info info = {
7447                 .subtype = IEEE80211_STYPE_DEAUTH,
7448         };
7449
7450         if (ifmgd->auth_data &&
7451             ether_addr_equal(ifmgd->auth_data->ap_addr, req->bssid)) {
7452                 sdata_info(sdata,
7453                            "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
7454                            req->bssid, req->reason_code,
7455                            ieee80211_get_reason_code_string(req->reason_code));
7456
7457                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
7458                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
7459                                                IEEE80211_STYPE_DEAUTH,
7460                                                req->reason_code, tx,
7461                                                frame_buf);
7462                 ieee80211_destroy_auth_data(sdata, false);
7463                 ieee80211_report_disconnect(sdata, frame_buf,
7464                                             sizeof(frame_buf), true,
7465                                             req->reason_code, false);
7466                 drv_mgd_complete_tx(sdata->local, sdata, &info);
7467                 return 0;
7468         }
7469
7470         if (ifmgd->assoc_data &&
7471             ether_addr_equal(ifmgd->assoc_data->ap_addr, req->bssid)) {
7472                 sdata_info(sdata,
7473                            "aborting association with %pM by local choice (Reason: %u=%s)\n",
7474                            req->bssid, req->reason_code,
7475                            ieee80211_get_reason_code_string(req->reason_code));
7476
7477                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
7478                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
7479                                                IEEE80211_STYPE_DEAUTH,
7480                                                req->reason_code, tx,
7481                                                frame_buf);
7482                 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
7483                 ieee80211_report_disconnect(sdata, frame_buf,
7484                                             sizeof(frame_buf), true,
7485                                             req->reason_code, false);
7486                 return 0;
7487         }
7488
7489         if (ifmgd->associated &&
7490             ether_addr_equal(sdata->vif.cfg.ap_addr, req->bssid)) {
7491                 sdata_info(sdata,
7492                            "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
7493                            req->bssid, req->reason_code,
7494                            ieee80211_get_reason_code_string(req->reason_code));
7495
7496                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7497                                        req->reason_code, tx, frame_buf);
7498                 ieee80211_report_disconnect(sdata, frame_buf,
7499                                             sizeof(frame_buf), true,
7500                                             req->reason_code, false);
7501                 drv_mgd_complete_tx(sdata->local, sdata, &info);
7502                 return 0;
7503         }
7504
7505         return -ENOTCONN;
7506 }
7507
7508 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
7509                            struct cfg80211_disassoc_request *req)
7510 {
7511         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7512
7513         if (!sdata->u.mgd.associated ||
7514             memcmp(sdata->vif.cfg.ap_addr, req->ap_addr, ETH_ALEN))
7515                 return -ENOTCONN;
7516
7517         sdata_info(sdata,
7518                    "disassociating from %pM by local choice (Reason: %u=%s)\n",
7519                    req->ap_addr, req->reason_code,
7520                    ieee80211_get_reason_code_string(req->reason_code));
7521
7522         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
7523                                req->reason_code, !req->local_state_change,
7524                                frame_buf);
7525
7526         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
7527                                     req->reason_code, false);
7528
7529         return 0;
7530 }
7531
7532 void ieee80211_mgd_stop_link(struct ieee80211_link_data *link)
7533 {
7534         cancel_work_sync(&link->u.mgd.request_smps_work);
7535         cancel_work_sync(&link->u.mgd.chswitch_work);
7536 }
7537
7538 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
7539 {
7540         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7541
7542         /*
7543          * Make sure some work items will not run after this,
7544          * they will not do anything but might not have been
7545          * cancelled when disconnecting.
7546          */
7547         cancel_work_sync(&ifmgd->monitor_work);
7548         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
7549         cancel_work_sync(&ifmgd->csa_connection_drop_work);
7550         cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
7551
7552         sdata_lock(sdata);
7553         if (ifmgd->assoc_data)
7554                 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
7555         if (ifmgd->auth_data)
7556                 ieee80211_destroy_auth_data(sdata, false);
7557         spin_lock_bh(&ifmgd->teardown_lock);
7558         if (ifmgd->teardown_skb) {
7559                 kfree_skb(ifmgd->teardown_skb);
7560                 ifmgd->teardown_skb = NULL;
7561                 ifmgd->orig_teardown_skb = NULL;
7562         }
7563         kfree(ifmgd->assoc_req_ies);
7564         ifmgd->assoc_req_ies = NULL;
7565         ifmgd->assoc_req_ies_len = 0;
7566         spin_unlock_bh(&ifmgd->teardown_lock);
7567         del_timer_sync(&ifmgd->timer);
7568         sdata_unlock(sdata);
7569 }
7570
7571 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
7572                                enum nl80211_cqm_rssi_threshold_event rssi_event,
7573                                s32 rssi_level,
7574                                gfp_t gfp)
7575 {
7576         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7577
7578         trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
7579
7580         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
7581 }
7582 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
7583
7584 void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
7585 {
7586         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7587
7588         trace_api_cqm_beacon_loss_notify(sdata->local, sdata);
7589
7590         cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
7591 }
7592 EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);
7593
7594 static void _ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data *sdata,
7595                                             int rssi_min_thold,
7596                                             int rssi_max_thold)
7597 {
7598         trace_api_enable_rssi_reports(sdata, rssi_min_thold, rssi_max_thold);
7599
7600         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
7601                 return;
7602
7603         /*
7604          * Scale up threshold values before storing it, as the RSSI averaging
7605          * algorithm uses a scaled up value as well. Change this scaling
7606          * factor if the RSSI averaging algorithm changes.
7607          */
7608         sdata->u.mgd.rssi_min_thold = rssi_min_thold*16;
7609         sdata->u.mgd.rssi_max_thold = rssi_max_thold*16;
7610 }
7611
7612 void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
7613                                     int rssi_min_thold,
7614                                     int rssi_max_thold)
7615 {
7616         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7617
7618         WARN_ON(rssi_min_thold == rssi_max_thold ||
7619                 rssi_min_thold > rssi_max_thold);
7620
7621         _ieee80211_enable_rssi_reports(sdata, rssi_min_thold,
7622                                        rssi_max_thold);
7623 }
7624 EXPORT_SYMBOL(ieee80211_enable_rssi_reports);
7625
7626 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
7627 {
7628         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7629
7630         _ieee80211_enable_rssi_reports(sdata, 0, 0);
7631 }
7632 EXPORT_SYMBOL(ieee80211_disable_rssi_reports);