net/mac80211/mlme.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * BSS client mode implementation
   4  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
   5  * Copyright 2004, Instant802 Networks, Inc.
   6  * Copyright 2005, Devicescape Software, Inc.
   7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   9  * Copyright 2013-2014  Intel Mobile Communications GmbH
  10  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
  11  * Copyright (C) 2018 - 2024 Intel Corporation
  12  */
  13
  14 #include <linux/delay.h>
  15 #include <linux/fips.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/etherdevice.h>
  20 #include <linux/moduleparam.h>
  21 #include <linux/rtnetlink.h>
  22 #include <linux/crc32.h>
  23 #include <linux/slab.h>
  24 #include <linux/export.h>
  25 #include <net/mac80211.h>
  26 #include <asm/unaligned.h>
  27
  28 #include "ieee80211_i.h"
  29 #include "driver-ops.h"
  30 #include "rate.h"
  31 #include "led.h"
  32 #include "fils_aead.h"
  33
  34 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
  35 #define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
  36 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
  37 #define IEEE80211_AUTH_TIMEOUT_SAE      (HZ * 2)
  38 #define IEEE80211_AUTH_MAX_TRIES        3
  39 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
  40 #define IEEE80211_AUTH_WAIT_SAE_RETRY   (HZ * 2)
  41 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
  42 #define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
  43 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
  44 #define IEEE80211_ASSOC_MAX_TRIES       3
  45
  46 #define IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS msecs_to_jiffies(100)
  47 #define IEEE80211_ADV_TTLM_ST_UNDERFLOW 0xff00
  48
  49 #define IEEE80211_NEG_TTLM_REQ_TIMEOUT (HZ / 5)
  50
  51 static int max_nullfunc_tries = 2;
  52 module_param(max_nullfunc_tries, int, 0644);
  53 MODULE_PARM_DESC(max_nullfunc_tries,
  54                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
  55
  56 static int max_probe_tries = 5;
  57 module_param(max_probe_tries, int, 0644);
  58 MODULE_PARM_DESC(max_probe_tries,
  59                  "Maximum probe tries before disconnecting (reason 4).");
  60
  61 /*
  62  * Beacon loss timeout is calculated as N frames times the
  63  * advertised beacon interval.  This may need to be somewhat
  64  * higher than what hardware might detect to account for
  65  * delays in the host processing frames. But since we also
  66  * probe on beacon miss before declaring the connection lost
  67  * default to what we want.
  68  */
  69 static int beacon_loss_count = 7;
  70 module_param(beacon_loss_count, int, 0644);
  71 MODULE_PARM_DESC(beacon_loss_count,
  72                  "Number of beacon intervals before we decide beacon was lost.");
  73
  74 /*
  75  * Time the connection can be idle before we probe
  76  * it to see if we can still talk to the AP.
  77  */
  78 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
  79 /*
  80  * Time we wait for a probe response after sending
  81  * a probe request because of beacon loss or for
  82  * checking the connection still works.
  83  */
  84 static int probe_wait_ms = 500;
  85 module_param(probe_wait_ms, int, 0644);
  86 MODULE_PARM_DESC(probe_wait_ms,
  87                  "Maximum time(ms) to wait for probe response"
  88                  " before disconnecting (reason 4).");
  89
  90 /*
  91  * How many Beacon frames need to have been used in average signal strength
  92  * before starting to indicate signal change events.
  93  */
  94 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
  95
  96 /*
  97  * We can have multiple work items (and connection probing)
  98  * scheduling this timer, but we need to take care to only
  99  * reschedule it when it should fire _earlier_ than it was
 100  * asked for before, or if it's not pending right now. This
 101  * function ensures that. Note that it then is required to
 102  * run this function for all timeouts after the first one
 103  * has happened -- the work that runs from this timer will
 104  * do that.
 105  */
 106 static void run_again(struct ieee80211_sub_if_data *sdata,
 107                       unsigned long timeout)
 108 {
 109         lockdep_assert_wiphy(sdata->local->hw.wiphy);
 110
 111         if (!timer_pending(&sdata->u.mgd.timer) ||
 112             time_before(timeout, sdata->u.mgd.timer.expires))
 113                 mod_timer(&sdata->u.mgd.timer, timeout);
 114 }
 115
 116 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 117 {
 118         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
 119                 return;
 120
 121         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 122                 return;
 123
 124         mod_timer(&sdata->u.mgd.bcn_mon_timer,
 125                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 126 }
 127
 128 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 129 {
 130         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 131
 132         if (unlikely(!ifmgd->associated))
 133                 return;
 134
 135         if (ifmgd->probe_send_count)
 136                 ifmgd->probe_send_count = 0;
 137
 138         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 139                 return;
 140
 141         mod_timer(&ifmgd->conn_mon_timer,
 142                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 143 }
 144
 145 static int ecw2cw(int ecw)
 146 {
 147         return (1 << ecw) - 1;
 148 }
 149
 150 static enum ieee80211_conn_mode
 151 ieee80211_determine_ap_chan(struct ieee80211_sub_if_data *sdata,
 152                             struct ieee80211_channel *channel,
 153                             u32 vht_cap_info,
 154                             const struct ieee802_11_elems *elems,
 155                             bool ignore_ht_channel_mismatch,
 156                             const struct ieee80211_conn_settings *conn,
 157                             struct cfg80211_chan_def *chandef)
 158 {
 159         const struct ieee80211_ht_operation *ht_oper = elems->ht_operation;
 160         const struct ieee80211_vht_operation *vht_oper = elems->vht_operation;
 161         const struct ieee80211_he_operation *he_oper = elems->he_operation;
 162         const struct ieee80211_eht_operation *eht_oper = elems->eht_operation;
 163         struct ieee80211_supported_band *sband =
 164                 sdata->local->hw.wiphy->bands[channel->band];
 165         struct cfg80211_chan_def vht_chandef;
 166         bool no_vht = false;
 167         u32 ht_cfreq;
 168
 169         *chandef = (struct cfg80211_chan_def) {
 170                 .chan = channel,
 171                 .width = NL80211_CHAN_WIDTH_20_NOHT,
 172                 .center_freq1 = channel->center_freq,
 173                 .freq1_offset = channel->freq_offset,
 174         };
 175
 176         /* get special S1G case out of the way */
 177         if (sband->band == NL80211_BAND_S1GHZ) {
 178                 if (!ieee80211_chandef_s1g_oper(elems->s1g_oper, chandef)) {
 179                         sdata_info(sdata,
 180                                    "Missing S1G Operation Element? Trying operating == primary\n");
 181                         chandef->width = ieee80211_s1g_channel_width(channel);
 182                 }
 183
 184                 return IEEE80211_CONN_MODE_S1G;
 185         }
 186
 187         /* get special 6 GHz case out of the way */
 188         if (sband->band == NL80211_BAND_6GHZ) {
 189                 enum ieee80211_conn_mode mode = IEEE80211_CONN_MODE_EHT;
 190
 191                 /* this is an error */
 192                 if (conn->mode < IEEE80211_CONN_MODE_HE)
 193                         return IEEE80211_CONN_MODE_LEGACY;
 194
 195                 if (!elems->he_6ghz_capa || !elems->he_cap) {
 196                         sdata_info(sdata,
 197                                    "HE 6 GHz AP is missing HE/HE 6 GHz band capability\n");
 198                         return IEEE80211_CONN_MODE_LEGACY;
 199                 }
 200
 201                 if (!eht_oper || !elems->eht_cap) {
 202                         eht_oper = NULL;
 203                         mode = IEEE80211_CONN_MODE_HE;
 204                 }
 205
 206                 if (!ieee80211_chandef_he_6ghz_oper(sdata->local, he_oper,
 207                                                     eht_oper, chandef)) {
 208                         sdata_info(sdata, "bad HE/EHT 6 GHz operation\n");
 209                         return IEEE80211_CONN_MODE_LEGACY;
 210                 }
 211
 212                 return mode;
 213         }
 214
 215         /* now we have the progression HT, VHT, ... */
 216         if (conn->mode < IEEE80211_CONN_MODE_HT)
 217                 return IEEE80211_CONN_MODE_LEGACY;
 218
 219         if (!ht_oper || !elems->ht_cap_elem)
 220                 return IEEE80211_CONN_MODE_LEGACY;
 221
 222         chandef->width = NL80211_CHAN_WIDTH_20;
 223
 224         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
 225                                                   channel->band);
 226         /* check that channel matches the right operating channel */
 227         if (!ignore_ht_channel_mismatch && channel->center_freq != ht_cfreq) {
 228                 /*
 229                  * It's possible that some APs are confused here;
 230                  * Netgear WNDR3700 sometimes reports 4 higher than
 231                  * the actual channel in association responses, but
 232                  * since we look at probe response/beacon data here
 233                  * it should be OK.
 234                  */
 235                 sdata_info(sdata,
 236                            "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
 237                            channel->center_freq, ht_cfreq,
 238                            ht_oper->primary_chan, channel->band);
 239                 return IEEE80211_CONN_MODE_LEGACY;
 240         }
 241
 242         ieee80211_chandef_ht_oper(ht_oper, chandef);
 243
 244         if (conn->mode < IEEE80211_CONN_MODE_VHT)
 245                 return IEEE80211_CONN_MODE_HT;
 246
 247         vht_chandef = *chandef;
 248
 249         /*
 250          * having he_cap/he_oper parsed out implies we're at
 251          * least operating as HE STA
 252          */
 253         if (elems->he_cap && he_oper &&
 254             he_oper->he_oper_params & cpu_to_le32(IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
 255                 struct ieee80211_vht_operation he_oper_vht_cap;
 256
 257                 /*
 258                  * Set only first 3 bytes (other 2 aren't used in
 259                  * ieee80211_chandef_vht_oper() anyway)
 260                  */
 261                 memcpy(&he_oper_vht_cap, he_oper->optional, 3);
 262                 he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);
 263
 264                 if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
 265                                                 &he_oper_vht_cap, ht_oper,
 266                                                 &vht_chandef)) {
 267                         sdata_info(sdata,
 268                                    "HE AP VHT information is invalid, disabling HE\n");
 269                         /* this will cause us to re-parse as VHT STA */
 270                         return IEEE80211_CONN_MODE_VHT;
 271                 }
 272         } else if (!vht_oper || !elems->vht_cap_elem) {
 273                 if (sband->band == NL80211_BAND_5GHZ) {
 274                         sdata_info(sdata,
 275                                    "VHT information is missing, disabling VHT\n");
 276                         return IEEE80211_CONN_MODE_HT;
 277                 }
 278                 no_vht = true;
 279         } else if (sband->band == NL80211_BAND_2GHZ) {
 280                 no_vht = true;
 281         } else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
 282                                                vht_cap_info,
 283                                                vht_oper, ht_oper,
 284                                                &vht_chandef)) {
 285                 sdata_info(sdata,
 286                            "AP VHT information is invalid, disabling VHT\n");
 287                 return IEEE80211_CONN_MODE_HT;
 288         }
 289
 290         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
 291                 sdata_info(sdata,
 292                            "AP VHT information doesn't match HT, disabling VHT\n");
 293                 return IEEE80211_CONN_MODE_HT;
 294         }
 295
 296         *chandef = vht_chandef;
 297
 298         /* stick to current max mode if we or the AP don't have HE */
 299         if (conn->mode < IEEE80211_CONN_MODE_HE ||
 300             !elems->he_operation || !elems->he_cap) {
 301                 if (no_vht)
 302                         return IEEE80211_CONN_MODE_HT;
 303                 return IEEE80211_CONN_MODE_VHT;
 304         }
 305
 306         /* stick to HE if we or the AP don't have EHT */
 307         if (conn->mode < IEEE80211_CONN_MODE_EHT ||
 308             !eht_oper || !elems->eht_cap)
 309                 return IEEE80211_CONN_MODE_HE;
 310
 311         /*
 312          * handle the case that the EHT operation indicates that it holds EHT
 313          * operation information (in case that the channel width differs from
 314          * the channel width reported in HT/VHT/HE).
 315          */
 316         if (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) {
 317                 struct cfg80211_chan_def eht_chandef = *chandef;
 318
 319                 ieee80211_chandef_eht_oper((const void *)eht_oper->optional,
 320                                            &eht_chandef);
 321
 322                 eht_chandef.punctured =
 323                         ieee80211_eht_oper_dis_subchan_bitmap(eht_oper);
 324
 325                 if (!cfg80211_chandef_valid(&eht_chandef)) {
 326                         sdata_info(sdata,
 327                                    "AP EHT information is invalid, disabling EHT\n");
 328                         return IEEE80211_CONN_MODE_HE;
 329                 }
 330
 331                 if (!cfg80211_chandef_compatible(chandef, &eht_chandef)) {
 332                         sdata_info(sdata,
 333                                    "AP EHT information doesn't match HT/VHT/HE, disabling EHT\n");
 334                         return IEEE80211_CONN_MODE_HE;
 335                 }
 336
 337                 *chandef = eht_chandef;
 338         }
 339
 340         return IEEE80211_CONN_MODE_EHT;
 341 }
 342
 343 static bool
 344 ieee80211_verify_peer_he_mcs_support(struct ieee80211_sub_if_data *sdata,
 345                                      const struct ieee80211_he_cap_elem *he_cap,
 346                                      const struct ieee80211_he_operation *he_op)
 347 {
 348         struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
 349         u16 mcs_80_map_tx, mcs_80_map_rx;
 350         u16 ap_min_req_set;
 351         int nss;
 352
 353         if (!he_cap)
 354                 return false;
 355
 356         /* mcs_nss is right after he_cap info */
 357         he_mcs_nss_supp = (void *)(he_cap + 1);
 358
 359         mcs_80_map_tx = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
 360         mcs_80_map_rx = le16_to_cpu(he_mcs_nss_supp->rx_mcs_80);
 361
 362         /* P802.11-REVme/D0.3
 363          * 27.1.1 Introduction to the HE PHY
 364          * ...
 365          * An HE STA shall support the following features:
 366          * ...
 367          * Single spatial stream HE-MCSs 0 to 7 (transmit and receive) in all
 368          * supported channel widths for HE SU PPDUs
 369          */
 370         if ((mcs_80_map_tx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED ||
 371             (mcs_80_map_rx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED) {
 372                 sdata_info(sdata,
 373                            "Missing mandatory rates for 1 Nss, rx 0x%x, tx 0x%x, disable HE\n",
 374                            mcs_80_map_tx, mcs_80_map_rx);
 375                 return false;
 376         }
 377
 378         if (!he_op)
 379                 return true;
 380
 381         ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
 382
 383         /*
 384          * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
 385          * zeroes, which is nonsense, and completely inconsistent with itself
 386          * (it doesn't have 8 streams). Accept the settings in this case anyway.
 387          */
 388         if (!ap_min_req_set)
 389                 return true;
 390
 391         /* make sure the AP is consistent with itself
 392          *
 393          * P802.11-REVme/D0.3
 394          * 26.17.1 Basic HE BSS operation
 395          *
 396          * A STA that is operating in an HE BSS shall be able to receive and
 397          * transmit at each of the <HE-MCS, NSS> tuple values indicated by the
 398          * Basic HE-MCS And NSS Set field of the HE Operation parameter of the
 399          * MLME-START.request primitive and shall be able to receive at each of
 400          * the <HE-MCS, NSS> tuple values indicated by the Supported HE-MCS and
 401          * NSS Set field in the HE Capabilities parameter of the MLMESTART.request
 402          * primitive
 403          */
 404         for (nss = 8; nss > 0; nss--) {
 405                 u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
 406                 u8 ap_rx_val;
 407                 u8 ap_tx_val;
 408
 409                 if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
 410                         continue;
 411
 412                 ap_rx_val = (mcs_80_map_rx >> (2 * (nss - 1))) & 3;
 413                 ap_tx_val = (mcs_80_map_tx >> (2 * (nss - 1))) & 3;
 414
 415                 if (ap_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
 416                     ap_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
 417                     ap_rx_val < ap_op_val || ap_tx_val < ap_op_val) {
 418                         sdata_info(sdata,
 419                                    "Invalid rates for %d Nss, rx %d, tx %d oper %d, disable HE\n",
 420                                    nss, ap_rx_val, ap_rx_val, ap_op_val);
 421                         return false;
 422                 }
 423         }
 424
 425         return true;
 426 }
 427
 428 static bool
 429 ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
 430                                     struct ieee80211_supported_band *sband,
 431                                     const struct ieee80211_he_operation *he_op)
 432 {
 433         const struct ieee80211_sta_he_cap *sta_he_cap =
 434                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
 435         u16 ap_min_req_set;
 436         int i;
 437
 438         if (!sta_he_cap || !he_op)
 439                 return false;
 440
 441         ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
 442
 443         /*
 444          * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
 445          * zeroes, which is nonsense, and completely inconsistent with itself
 446          * (it doesn't have 8 streams). Accept the settings in this case anyway.
 447          */
 448         if (!ap_min_req_set)
 449                 return true;
 450
 451         /* Need to go over for 80MHz, 160MHz and for 80+80 */
 452         for (i = 0; i < 3; i++) {
 453                 const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
 454                         &sta_he_cap->he_mcs_nss_supp;
 455                 u16 sta_mcs_map_rx =
 456                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
 457                 u16 sta_mcs_map_tx =
 458                         le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
 459                 u8 nss;
 460                 bool verified = true;
 461
 462                 /*
 463                  * For each band there is a maximum of 8 spatial streams
 464                  * possible. Each of the sta_mcs_map_* is a 16-bit struct built
 465                  * of 2 bits per NSS (1-8), with the values defined in enum
 466                  * ieee80211_he_mcs_support. Need to make sure STA TX and RX
 467                  * capabilities aren't less than the AP's minimum requirements
 468                  * for this HE BSS per SS.
 469                  * It is enough to find one such band that meets the reqs.
 470                  */
 471                 for (nss = 8; nss > 0; nss--) {
 472                         u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
 473                         u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
 474                         u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
 475
 476                         if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
 477                                 continue;
 478
 479                         /*
 480                          * Make sure the HE AP doesn't require MCSs that aren't
 481                          * supported by the client as required by spec
 482                          *
 483                          * P802.11-REVme/D0.3
 484                          * 26.17.1 Basic HE BSS operation
 485                          *
 486                          * An HE STA shall not attempt to join * (MLME-JOIN.request primitive)
 487                          * a BSS, unless it supports (i.e., is able to both transmit and
 488                          * receive using) all of the <HE-MCS, NSS> tuples in the basic
 489                          * HE-MCS and NSS set.
 490                          */
 491                         if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
 492                             sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
 493                             (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
 494                                 verified = false;
 495                                 break;
 496                         }
 497                 }
 498
 499                 if (verified)
 500                         return true;
 501         }
 502
 503         /* If here, STA doesn't meet AP's HE min requirements */
 504         return false;
 505 }
 506
 507 static u8
 508 ieee80211_get_eht_cap_mcs_nss(const struct ieee80211_sta_he_cap *sta_he_cap,
 509                               const struct ieee80211_sta_eht_cap *sta_eht_cap,
 510                               unsigned int idx, int bw)
 511 {
 512         u8 he_phy_cap0 = sta_he_cap->he_cap_elem.phy_cap_info[0];
 513         u8 eht_phy_cap0 = sta_eht_cap->eht_cap_elem.phy_cap_info[0];
 514
 515         /* handle us being a 20 MHz-only EHT STA - with four values
 516          * for MCS 0-7, 8-9, 10-11, 12-13.
 517          */
 518         if (!(he_phy_cap0 & IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK_ALL))
 519                 return sta_eht_cap->eht_mcs_nss_supp.only_20mhz.rx_tx_max_nss[idx];
 520
 521         /* the others have MCS 0-9 together, rather than separately from 0-7 */
 522         if (idx > 0)
 523                 idx--;
 524
 525         switch (bw) {
 526         case 0:
 527                 return sta_eht_cap->eht_mcs_nss_supp.bw._80.rx_tx_max_nss[idx];
 528         case 1:
 529                 if (!(he_phy_cap0 &
 530                       (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
 531                        IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)))
 532                         return 0xff; /* pass check */
 533                 return sta_eht_cap->eht_mcs_nss_supp.bw._160.rx_tx_max_nss[idx];
 534         case 2:
 535                 if (!(eht_phy_cap0 & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ))
 536                         return 0xff; /* pass check */
 537                 return sta_eht_cap->eht_mcs_nss_supp.bw._320.rx_tx_max_nss[idx];
 538         }
 539
 540         WARN_ON(1);
 541         return 0;
 542 }
 543
 544 static bool
 545 ieee80211_verify_sta_eht_mcs_support(struct ieee80211_sub_if_data *sdata,
 546                                      struct ieee80211_supported_band *sband,
 547                                      const struct ieee80211_eht_operation *eht_op)
 548 {
 549         const struct ieee80211_sta_he_cap *sta_he_cap =
 550                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
 551         const struct ieee80211_sta_eht_cap *sta_eht_cap =
 552                 ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
 553         const struct ieee80211_eht_mcs_nss_supp_20mhz_only *req;
 554         unsigned int i;
 555
 556         if (!sta_he_cap || !sta_eht_cap || !eht_op)
 557                 return false;
 558
 559         req = &eht_op->basic_mcs_nss;
 560
 561         for (i = 0; i < ARRAY_SIZE(req->rx_tx_max_nss); i++) {
 562                 u8 req_rx_nss, req_tx_nss;
 563                 unsigned int bw;
 564
 565                 req_rx_nss = u8_get_bits(req->rx_tx_max_nss[i],
 566                                          IEEE80211_EHT_MCS_NSS_RX);
 567                 req_tx_nss = u8_get_bits(req->rx_tx_max_nss[i],
 568                                          IEEE80211_EHT_MCS_NSS_TX);
 569
 570                 for (bw = 0; bw < 3; bw++) {
 571                         u8 have, have_rx_nss, have_tx_nss;
 572
 573                         have = ieee80211_get_eht_cap_mcs_nss(sta_he_cap,
 574                                                              sta_eht_cap,
 575                                                              i, bw);
 576                         have_rx_nss = u8_get_bits(have,
 577                                                   IEEE80211_EHT_MCS_NSS_RX);
 578                         have_tx_nss = u8_get_bits(have,
 579                                                   IEEE80211_EHT_MCS_NSS_TX);
 580
 581                         if (req_rx_nss > have_rx_nss ||
 582                             req_tx_nss > have_tx_nss)
 583                                 return false;
 584                 }
 585         }
 586
 587         return true;
 588 }
 589
 590 static bool ieee80211_chandef_usable(struct ieee80211_sub_if_data *sdata,
 591                                      const struct cfg80211_chan_def *chandef,
 592                                      u32 prohibited_flags)
 593 {
 594         if (!cfg80211_chandef_usable(sdata->local->hw.wiphy,
 595                                      chandef, prohibited_flags))
 596                 return false;
 597
 598         if (chandef->punctured &&
 599             ieee80211_hw_check(&sdata->local->hw, DISALLOW_PUNCTURING))
 600                 return false;
 601
 602         return true;
 603 }
 604
 605 static struct ieee802_11_elems *
 606 ieee80211_determine_chan_mode(struct ieee80211_sub_if_data *sdata,
 607                               struct ieee80211_conn_settings *conn,
 608                               struct cfg80211_bss *cbss, int link_id,
 609                               struct ieee80211_chan_req *chanreq)
 610 {
 611         const struct cfg80211_bss_ies *ies = rcu_dereference(cbss->ies);
 612         struct ieee80211_bss *bss = (void *)cbss->priv;
 613         struct ieee80211_channel *channel = cbss->channel;
 614         struct ieee80211_elems_parse_params parse_params = {
 615                 .link_id = -1,
 616                 .from_ap = true,
 617                 .start = ies->data,
 618                 .len = ies->len,
 619         };
 620         struct ieee802_11_elems *elems;
 621         struct ieee80211_supported_band *sband;
 622         struct cfg80211_chan_def ap_chandef;
 623         enum ieee80211_conn_mode ap_mode;
 624         int ret;
 625
 626 again:
 627         parse_params.mode = conn->mode;
 628         elems = ieee802_11_parse_elems_full(&parse_params);
 629         if (!elems)
 630                 return ERR_PTR(-ENOMEM);
 631
 632         ap_mode = ieee80211_determine_ap_chan(sdata, channel, bss->vht_cap_info,
 633                                               elems, false, conn, &ap_chandef);
 634
 635         /* this should be impossible since parsing depends on our mode */
 636         if (WARN_ON(ap_mode > conn->mode)) {
 637                 ret = -EINVAL;
 638                 goto free;
 639         }
 640
 641         if (conn->mode != ap_mode) {
 642                 conn->mode = ap_mode;
 643                 kfree(elems);
 644                 goto again;
 645         }
 646
 647         mlme_link_id_dbg(sdata, link_id, "determined AP %pM to be %s\n",
 648                          cbss->bssid, ieee80211_conn_mode_str(ap_mode));
 649
 650         sband = sdata->local->hw.wiphy->bands[channel->band];
 651
 652         switch (channel->band) {
 653         case NL80211_BAND_S1GHZ:
 654                 if (WARN_ON(ap_mode != IEEE80211_CONN_MODE_S1G)) {
 655                         ret = -EINVAL;
 656                         goto free;
 657                 }
 658                 return elems;
 659         case NL80211_BAND_6GHZ:
 660                 if (ap_mode < IEEE80211_CONN_MODE_HE) {
 661                         sdata_info(sdata,
 662                                    "Rejecting non-HE 6/7 GHz connection");
 663                         ret = -EINVAL;
 664                         goto free;
 665                 }
 666                 break;
 667         default:
 668                 if (WARN_ON(ap_mode == IEEE80211_CONN_MODE_S1G)) {
 669                         ret = -EINVAL;
 670                         goto free;
 671                 }
 672         }
 673
 674         switch (ap_mode) {
 675         case IEEE80211_CONN_MODE_S1G:
 676                 WARN_ON(1);
 677                 ret = -EINVAL;
 678                 goto free;
 679         case IEEE80211_CONN_MODE_LEGACY:
 680                 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
 681                 break;
 682         case IEEE80211_CONN_MODE_HT:
 683                 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
 684                                        conn->bw_limit,
 685                                        IEEE80211_CONN_BW_LIMIT_40);
 686                 break;
 687         case IEEE80211_CONN_MODE_VHT:
 688         case IEEE80211_CONN_MODE_HE:
 689                 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
 690                                        conn->bw_limit,
 691                                        IEEE80211_CONN_BW_LIMIT_160);
 692                 break;
 693         case IEEE80211_CONN_MODE_EHT:
 694                 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
 695                                        conn->bw_limit,
 696                                        IEEE80211_CONN_BW_LIMIT_320);
 697                 break;
 698         }
 699
 700         chanreq->oper = ap_chandef;
 701
 702         /* wider-bandwidth OFDMA is only done in EHT */
 703         if (conn->mode >= IEEE80211_CONN_MODE_EHT &&
 704             !(sdata->vif.driver_flags & IEEE80211_VIF_IGNORE_OFDMA_WIDER_BW))
 705                 chanreq->ap = ap_chandef;
 706         else
 707                 chanreq->ap.chan = NULL;
 708
 709         while (!ieee80211_chandef_usable(sdata, &chanreq->oper,
 710                                          IEEE80211_CHAN_DISABLED)) {
 711                 if (WARN_ON(chanreq->oper.width == NL80211_CHAN_WIDTH_20_NOHT)) {
 712                         ret = -EINVAL;
 713                         goto free;
 714                 }
 715
 716                 ieee80211_chanreq_downgrade(chanreq, conn);
 717         }
 718
 719         if (conn->mode >= IEEE80211_CONN_MODE_HE &&
 720             !cfg80211_chandef_usable(sdata->wdev.wiphy, &chanreq->oper,
 721                                      IEEE80211_CHAN_NO_HE)) {
 722                 conn->mode = IEEE80211_CONN_MODE_VHT;
 723                 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
 724                                        conn->bw_limit,
 725                                        IEEE80211_CONN_BW_LIMIT_160);
 726         }
 727
 728         if (conn->mode >= IEEE80211_CONN_MODE_EHT &&
 729             !cfg80211_chandef_usable(sdata->wdev.wiphy, &chanreq->oper,
 730                                      IEEE80211_CHAN_NO_EHT)) {
 731                 conn->mode = IEEE80211_CONN_MODE_HE;
 732                 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
 733                                        conn->bw_limit,
 734                                        IEEE80211_CONN_BW_LIMIT_160);
 735         }
 736
 737         if (chanreq->oper.width != ap_chandef.width || ap_mode != conn->mode)
 738                 sdata_info(sdata,
 739                            "regulatory prevented using AP config, downgraded\n");
 740
 741         if (conn->mode >= IEEE80211_CONN_MODE_HE &&
 742             (!ieee80211_verify_peer_he_mcs_support(sdata, (void *)elems->he_cap,
 743                                                    elems->he_operation) ||
 744              !ieee80211_verify_sta_he_mcs_support(sdata, sband,
 745                                                   elems->he_operation))) {
 746                 conn->mode = IEEE80211_CONN_MODE_VHT;
 747                 sdata_info(sdata, "required MCSes not supported, disabling HE\n");
 748         }
 749
 750         if (conn->mode >= IEEE80211_CONN_MODE_EHT &&
 751             !ieee80211_verify_sta_eht_mcs_support(sdata, sband,
 752                                                   elems->eht_operation)) {
 753                 conn->mode = IEEE80211_CONN_MODE_HE;
 754                 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
 755                                        conn->bw_limit,
 756                                        IEEE80211_CONN_BW_LIMIT_160);
 757                 sdata_info(sdata, "required MCSes not supported, disabling EHT\n");
 758         }
 759
 760         /* the mode can only decrease, so this must terminate */
 761         if (ap_mode != conn->mode) {
 762                 kfree(elems);
 763                 goto again;
 764         }
 765
 766         mlme_link_id_dbg(sdata, link_id,
 767                          "connecting with %s mode, max bandwidth %d MHz\n",
 768                          ieee80211_conn_mode_str(conn->mode),
 769                          20 * (1 << conn->bw_limit));
 770
 771         if (WARN_ON_ONCE(!cfg80211_chandef_valid(&chanreq->oper))) {
 772                 ret = -EINVAL;
 773                 goto free;
 774         }
 775
 776         return elems;
 777 free:
 778         kfree(elems);
 779         return ERR_PTR(ret);
 780 }
 781
 782 static int ieee80211_config_bw(struct ieee80211_link_data *link,
 783                                struct ieee802_11_elems *elems,
 784                                bool update, u64 *changed)
 785 {
 786         struct ieee80211_channel *channel = link->conf->chanreq.oper.chan;
 787         struct ieee80211_sub_if_data *sdata = link->sdata;
 788         struct ieee80211_chan_req chanreq = {};
 789         enum ieee80211_conn_mode ap_mode;
 790         u32 vht_cap_info = 0;
 791         u16 ht_opmode;
 792         int ret;
 793
 794         /* don't track any bandwidth changes in legacy/S1G modes */
 795         if (link->u.mgd.conn.mode == IEEE80211_CONN_MODE_LEGACY ||
 796             link->u.mgd.conn.mode == IEEE80211_CONN_MODE_S1G)
 797                 return 0;
 798
 799         if (elems->vht_cap_elem)
 800                 vht_cap_info = le32_to_cpu(elems->vht_cap_elem->vht_cap_info);
 801
 802         ap_mode = ieee80211_determine_ap_chan(sdata, channel, vht_cap_info,
 803                                               elems, true, &link->u.mgd.conn,
 804                                               &chanreq.ap);
 805
 806         if (ap_mode != link->u.mgd.conn.mode) {
 807                 link_info(link,
 808                           "AP appears to change mode (expected %s, found %s), disconnect\n",
 809                           ieee80211_conn_mode_str(link->u.mgd.conn.mode),
 810                           ieee80211_conn_mode_str(ap_mode));
 811                 return -EINVAL;
 812         }
 813
 814         chanreq.oper = chanreq.ap;
 815         if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_EHT ||
 816             sdata->vif.driver_flags & IEEE80211_VIF_IGNORE_OFDMA_WIDER_BW)
 817                 chanreq.ap.chan = NULL;
 818
 819         /*
 820          * if HT operation mode changed store the new one -
 821          * this may be applicable even if channel is identical
 822          */
 823         if (elems->ht_operation) {
 824                 ht_opmode = le16_to_cpu(elems->ht_operation->operation_mode);
 825                 if (link->conf->ht_operation_mode != ht_opmode) {
 826                         *changed |= BSS_CHANGED_HT;
 827                         link->conf->ht_operation_mode = ht_opmode;
 828                 }
 829         }
 830
 831         /*
 832          * Downgrade the new channel if we associated with restricted
 833          * bandwidth capabilities. For example, if we associated as a
 834          * 20 MHz STA to a 40 MHz AP (due to regulatory, capabilities
 835          * or config reasons) then switching to a 40 MHz channel now
 836          * won't do us any good -- we couldn't use it with the AP.
 837          */
 838         while (link->u.mgd.conn.bw_limit <
 839                         ieee80211_min_bw_limit_from_chandef(&chanreq.oper))
 840                 ieee80211_chandef_downgrade(&chanreq.oper, NULL);
 841
 842         if (ieee80211_chanreq_identical(&chanreq, &link->conf->chanreq))
 843                 return 0;
 844
 845         link_info(link,
 846                   "AP %pM changed bandwidth, new used config is %d.%03d MHz, width %d (%d.%03d/%d MHz)\n",
 847                   link->u.mgd.bssid, chanreq.oper.chan->center_freq,
 848                   chanreq.oper.chan->freq_offset, chanreq.oper.width,
 849                   chanreq.oper.center_freq1, chanreq.oper.freq1_offset,
 850                   chanreq.oper.center_freq2);
 851
 852         if (!cfg80211_chandef_valid(&chanreq.oper)) {
 853                 sdata_info(sdata,
 854                            "AP %pM changed caps/bw in a way we can't support - disconnect\n",
 855                            link->u.mgd.bssid);
 856                 return -EINVAL;
 857         }
 858
 859         if (!update) {
 860                 link->conf->chanreq = chanreq;
 861                 return 0;
 862         }
 863
 864         /*
 865          * We're tracking the current AP here, so don't do any further checks
 866          * here. This keeps us from playing ping-pong with regulatory, without
 867          * it the following can happen (for example):
 868          *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
 869          *  - AP advertises regdom US
 870          *  - CRDA loads regdom US with 80 MHz prohibited (old database)
 871          *  - we detect an unsupported channel and disconnect
 872          *  - disconnect causes CRDA to reload world regdomain and the game
 873          *    starts anew.
 874          * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
 875          *
 876          * It seems possible that there are still scenarios with CSA or real
 877          * bandwidth changes where a this could happen, but those cases are
 878          * less common and wouldn't completely prevent using the AP.
 879          */
 880
 881         ret = ieee80211_link_change_chanreq(link, &chanreq, changed);
 882         if (ret) {
 883                 sdata_info(sdata,
 884                            "AP %pM changed bandwidth to incompatible one - disconnect\n",
 885                            link->u.mgd.bssid);
 886                 return ret;
 887         }
 888
 889         cfg80211_schedule_channels_check(&sdata->wdev);
 890         return 0;
 891 }
 892
 893 /* frame sending functions */
 894
 895 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 896                                 struct sk_buff *skb, u8 ap_ht_param,
 897                                 struct ieee80211_supported_band *sband,
 898                                 struct ieee80211_channel *channel,
 899                                 enum ieee80211_smps_mode smps,
 900                                 const struct ieee80211_conn_settings *conn)
 901 {
 902         u8 *pos;
 903         u32 flags = channel->flags;
 904         u16 cap;
 905         struct ieee80211_sta_ht_cap ht_cap;
 906
 907         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 908
 909         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
 910         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 911
 912         /* determine capability flags */
 913         cap = ht_cap.cap;
 914
 915         switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 916         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 917                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
 918                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 919                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 920                 }
 921                 break;
 922         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 923                 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
 924                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 925                         cap &= ~IEEE80211_HT_CAP_SGI_40;
 926                 }
 927                 break;
 928         }
 929
 930         /*
 931          * If 40 MHz was disabled associate as though we weren't
 932          * capable of 40 MHz -- some broken APs will never fall
 933          * back to trying to transmit in 20 MHz.
 934          */
 935         if (conn->bw_limit <= IEEE80211_CONN_BW_LIMIT_20) {
 936                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 937                 cap &= ~IEEE80211_HT_CAP_SGI_40;
 938         }
 939
 940         /* set SM PS mode properly */
 941         cap &= ~IEEE80211_HT_CAP_SM_PS;
 942         switch (smps) {
 943         case IEEE80211_SMPS_AUTOMATIC:
 944         case IEEE80211_SMPS_NUM_MODES:
 945                 WARN_ON(1);
 946                 fallthrough;
 947         case IEEE80211_SMPS_OFF:
 948                 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
 949                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 950                 break;
 951         case IEEE80211_SMPS_STATIC:
 952                 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
 953                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 954                 break;
 955         case IEEE80211_SMPS_DYNAMIC:
 956                 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
 957                         IEEE80211_HT_CAP_SM_PS_SHIFT;
 958                 break;
 959         }
 960
 961         /* reserve and fill IE */
 962         pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
 963         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 964 }
 965
 966 /* This function determines vht capability flags for the association
 967  * and builds the IE.
 968  * Note - the function returns true to own the MU-MIMO capability
 969  */
 970 static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
 971                                  struct sk_buff *skb,
 972                                  struct ieee80211_supported_band *sband,
 973                                  struct ieee80211_vht_cap *ap_vht_cap,
 974                                  const struct ieee80211_conn_settings *conn)
 975 {
 976         struct ieee80211_local *local = sdata->local;
 977         u8 *pos;
 978         u32 cap;
 979         struct ieee80211_sta_vht_cap vht_cap;
 980         u32 mask, ap_bf_sts, our_bf_sts;
 981         bool mu_mimo_owner = false;
 982
 983         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 984
 985         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
 986         ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
 987
 988         /* determine capability flags */
 989         cap = vht_cap.cap;
 990
 991         if (conn->bw_limit <= IEEE80211_CONN_BW_LIMIT_80) {
 992                 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
 993                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 994         }
 995
 996         /*
 997          * Some APs apparently get confused if our capabilities are better
 998          * than theirs, so restrict what we advertise in the assoc request.
 999          */
1000         if (!(ap_vht_cap->vht_cap_info &
1001                         cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
1002                 cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
1003                          IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1004         else if (!(ap_vht_cap->vht_cap_info &
1005                         cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
1006                 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
1007
1008         /*
1009          * If some other vif is using the MU-MIMO capability we cannot associate
1010          * using MU-MIMO - this will lead to contradictions in the group-id
1011          * mechanism.
1012          * Ownership is defined since association request, in order to avoid
1013          * simultaneous associations with MU-MIMO.
1014          */
1015         if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
1016                 bool disable_mu_mimo = false;
1017                 struct ieee80211_sub_if_data *other;
1018
1019                 list_for_each_entry_rcu(other, &local->interfaces, list) {
1020                         if (other->vif.bss_conf.mu_mimo_owner) {
1021                                 disable_mu_mimo = true;
1022                                 break;
1023                         }
1024                 }
1025                 if (disable_mu_mimo)
1026                         cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
1027                 else
1028                         mu_mimo_owner = true;
1029         }
1030
1031         mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
1032
1033         ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
1034         our_bf_sts = cap & mask;
1035
1036         if (ap_bf_sts < our_bf_sts) {
1037                 cap &= ~mask;
1038                 cap |= ap_bf_sts;
1039         }
1040
1041         /* reserve and fill IE */
1042         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
1043         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
1044
1045         return mu_mimo_owner;
1046 }
1047
1048 static void ieee80211_assoc_add_rates(struct sk_buff *skb,
1049                                       enum nl80211_chan_width width,
1050                                       struct ieee80211_supported_band *sband,
1051                                       struct ieee80211_mgd_assoc_data *assoc_data)
1052 {
1053         u32 rates;
1054
1055         if (assoc_data->supp_rates_len) {
1056                 /*
1057                  * Get all rates supported by the device and the AP as
1058                  * some APs don't like getting a superset of their rates
1059                  * in the association request (e.g. D-Link DAP 1353 in
1060                  * b-only mode)...
1061                  */
1062                 ieee80211_parse_bitrates(width, sband,
1063                                          assoc_data->supp_rates,
1064                                          assoc_data->supp_rates_len,
1065                                          &rates);
1066         } else {
1067                 /*
1068                  * In case AP not provide any supported rates information
1069                  * before association, we send information element(s) with
1070                  * all rates that we support.
1071                  */
1072                 rates = ~0;
1073         }
1074
1075         ieee80211_put_srates_elem(skb, sband, 0, 0, ~rates,
1076                                   WLAN_EID_SUPP_RATES);
1077         ieee80211_put_srates_elem(skb, sband, 0, 0, ~rates,
1078                                   WLAN_EID_EXT_SUPP_RATES);
1079 }
1080
1081 static size_t ieee80211_add_before_ht_elems(struct sk_buff *skb,
1082                                             const u8 *elems,
1083                                             size_t elems_len,
1084                                             size_t offset)
1085 {
1086         size_t noffset;
1087
1088         static const u8 before_ht[] = {
1089                 WLAN_EID_SSID,
1090                 WLAN_EID_SUPP_RATES,
1091                 WLAN_EID_EXT_SUPP_RATES,
1092                 WLAN_EID_PWR_CAPABILITY,
1093                 WLAN_EID_SUPPORTED_CHANNELS,
1094                 WLAN_EID_RSN,
1095                 WLAN_EID_QOS_CAPA,
1096                 WLAN_EID_RRM_ENABLED_CAPABILITIES,
1097                 WLAN_EID_MOBILITY_DOMAIN,
1098                 WLAN_EID_FAST_BSS_TRANSITION,   /* reassoc only */
1099                 WLAN_EID_RIC_DATA,              /* reassoc only */
1100                 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
1101         };
1102         static const u8 after_ric[] = {
1103                 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
1104                 WLAN_EID_HT_CAPABILITY,
1105                 WLAN_EID_BSS_COEX_2040,
1106                 /* luckily this is almost always there */
1107                 WLAN_EID_EXT_CAPABILITY,
1108                 WLAN_EID_QOS_TRAFFIC_CAPA,
1109                 WLAN_EID_TIM_BCAST_REQ,
1110                 WLAN_EID_INTERWORKING,
1111                 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
1112                 WLAN_EID_VHT_CAPABILITY,
1113                 WLAN_EID_OPMODE_NOTIF,
1114         };
1115
1116         if (!elems_len)
1117                 return offset;
1118
1119         noffset = ieee80211_ie_split_ric(elems, elems_len,
1120                                          before_ht,
1121                                          ARRAY_SIZE(before_ht),
1122                                          after_ric,
1123                                          ARRAY_SIZE(after_ric),
1124                                          offset);
1125         skb_put_data(skb, elems + offset, noffset - offset);
1126
1127         return noffset;
1128 }
1129
1130 static size_t ieee80211_add_before_vht_elems(struct sk_buff *skb,
1131                                              const u8 *elems,
1132                                              size_t elems_len,
1133                                              size_t offset)
1134 {
1135         static const u8 before_vht[] = {
1136                 /*
1137                  * no need to list the ones split off before HT
1138                  * or generated here
1139                  */
1140                 WLAN_EID_BSS_COEX_2040,
1141                 WLAN_EID_EXT_CAPABILITY,
1142                 WLAN_EID_QOS_TRAFFIC_CAPA,
1143                 WLAN_EID_TIM_BCAST_REQ,
1144                 WLAN_EID_INTERWORKING,
1145                 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
1146         };
1147         size_t noffset;
1148
1149         if (!elems_len)
1150                 return offset;
1151
1152         /* RIC already taken care of in ieee80211_add_before_ht_elems() */
1153         noffset = ieee80211_ie_split(elems, elems_len,
1154                                      before_vht, ARRAY_SIZE(before_vht),
1155                                      offset);
1156         skb_put_data(skb, elems + offset, noffset - offset);
1157
1158         return noffset;
1159 }
1160
1161 static size_t ieee80211_add_before_he_elems(struct sk_buff *skb,
1162                                             const u8 *elems,
1163                                             size_t elems_len,
1164                                             size_t offset)
1165 {
1166         static const u8 before_he[] = {
1167                 /*
1168                  * no need to list the ones split off before VHT
1169                  * or generated here
1170                  */
1171                 WLAN_EID_OPMODE_NOTIF,
1172                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
1173                 /* 11ai elements */
1174                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
1175                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
1176                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
1177                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
1178                 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
1179                 /* TODO: add 11ah/11aj/11ak elements */
1180         };
1181         size_t noffset;
1182
1183         if (!elems_len)
1184                 return offset;
1185
1186         /* RIC already taken care of in ieee80211_add_before_ht_elems() */
1187         noffset = ieee80211_ie_split(elems, elems_len,
1188                                      before_he, ARRAY_SIZE(before_he),
1189                                      offset);
1190         skb_put_data(skb, elems + offset, noffset - offset);
1191
1192         return noffset;
1193 }
1194
1195 #define PRESENT_ELEMS_MAX       8
1196 #define PRESENT_ELEM_EXT_OFFS   0x100
1197
1198 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1199                                         struct sk_buff *skb, u16 capab,
1200                                         const struct element *ext_capa,
1201                                         const u16 *present_elems);
1202
1203 static size_t ieee80211_assoc_link_elems(struct ieee80211_sub_if_data *sdata,
1204                                          struct sk_buff *skb, u16 *capab,
1205                                          const struct element *ext_capa,
1206                                          const u8 *extra_elems,
1207                                          size_t extra_elems_len,
1208                                          unsigned int link_id,
1209                                          struct ieee80211_link_data *link,
1210                                          u16 *present_elems)
1211 {
1212         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1213         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1214         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1215         struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1216         struct ieee80211_channel *chan = cbss->channel;
1217         const struct ieee80211_sband_iftype_data *iftd;
1218         struct ieee80211_local *local = sdata->local;
1219         struct ieee80211_supported_band *sband;
1220         enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20;
1221         struct ieee80211_chanctx_conf *chanctx_conf;
1222         enum ieee80211_smps_mode smps_mode;
1223         u16 orig_capab = *capab;
1224         size_t offset = 0;
1225         int present_elems_len = 0;
1226         u8 *pos;
1227         int i;
1228
1229 #define ADD_PRESENT_ELEM(id) do {                                       \
1230         /* need a last for termination - we use 0 == SSID */            \
1231         if (!WARN_ON(present_elems_len >= PRESENT_ELEMS_MAX - 1))       \
1232                 present_elems[present_elems_len++] = (id);              \
1233 } while (0)
1234 #define ADD_PRESENT_EXT_ELEM(id) ADD_PRESENT_ELEM(PRESENT_ELEM_EXT_OFFS | (id))
1235
1236         if (link)
1237                 smps_mode = link->smps_mode;
1238         else if (sdata->u.mgd.powersave)
1239                 smps_mode = IEEE80211_SMPS_DYNAMIC;
1240         else
1241                 smps_mode = IEEE80211_SMPS_OFF;
1242
1243         if (link) {
1244                 /*
1245                  * 5/10 MHz scenarios are only viable without MLO, in which
1246                  * case this pointer should be used ... All of this is a bit
1247                  * unclear though, not sure this even works at all.
1248                  */
1249                 rcu_read_lock();
1250                 chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
1251                 if (chanctx_conf)
1252                         width = chanctx_conf->def.width;
1253                 rcu_read_unlock();
1254         }
1255
1256         sband = local->hw.wiphy->bands[chan->band];
1257         iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1258
1259         if (sband->band == NL80211_BAND_2GHZ) {
1260                 *capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
1261                 *capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
1262         }
1263
1264         if ((cbss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
1265             ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
1266                 *capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
1267
1268         if (sband->band != NL80211_BAND_S1GHZ)
1269                 ieee80211_assoc_add_rates(skb, width, sband, assoc_data);
1270
1271         if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
1272             *capab & WLAN_CAPABILITY_RADIO_MEASURE) {
1273                 struct cfg80211_chan_def chandef = {
1274                         .width = width,
1275                         .chan = chan,
1276                 };
1277
1278                 pos = skb_put(skb, 4);
1279                 *pos++ = WLAN_EID_PWR_CAPABILITY;
1280                 *pos++ = 2;
1281                 *pos++ = 0; /* min tx power */
1282                  /* max tx power */
1283                 *pos++ = ieee80211_chandef_max_power(&chandef);
1284                 ADD_PRESENT_ELEM(WLAN_EID_PWR_CAPABILITY);
1285         }
1286
1287         /*
1288          * Per spec, we shouldn't include the list of channels if we advertise
1289          * support for extended channel switching, but we've always done that;
1290          * (for now?) apply this restriction only on the (new) 6 GHz band.
1291          */
1292         if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
1293             (sband->band != NL80211_BAND_6GHZ ||
1294              !ext_capa || ext_capa->datalen < 1 ||
1295              !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
1296                 /* TODO: get this in reg domain format */
1297                 pos = skb_put(skb, 2 * sband->n_channels + 2);
1298                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
1299                 *pos++ = 2 * sband->n_channels;
1300                 for (i = 0; i < sband->n_channels; i++) {
1301                         int cf = sband->channels[i].center_freq;
1302
1303                         *pos++ = ieee80211_frequency_to_channel(cf);
1304                         *pos++ = 1; /* one channel in the subband*/
1305                 }
1306                 ADD_PRESENT_ELEM(WLAN_EID_SUPPORTED_CHANNELS);
1307         }
1308
1309         /* if present, add any custom IEs that go before HT */
1310         offset = ieee80211_add_before_ht_elems(skb, extra_elems,
1311                                                extra_elems_len,
1312                                                offset);
1313
1314         if (sband->band != NL80211_BAND_6GHZ &&
1315             assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_HT) {
1316                 ieee80211_add_ht_ie(sdata, skb,
1317                                     assoc_data->link[link_id].ap_ht_param,
1318                                     sband, chan, smps_mode,
1319                                     &assoc_data->link[link_id].conn);
1320                 ADD_PRESENT_ELEM(WLAN_EID_HT_CAPABILITY);
1321         }
1322
1323         /* if present, add any custom IEs that go before VHT */
1324         offset = ieee80211_add_before_vht_elems(skb, extra_elems,
1325                                                 extra_elems_len,
1326                                                 offset);
1327
1328         if (sband->band != NL80211_BAND_6GHZ &&
1329             assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_VHT &&
1330             sband->vht_cap.vht_supported) {
1331                 bool mu_mimo_owner =
1332                         ieee80211_add_vht_ie(sdata, skb, sband,
1333                                              &assoc_data->link[link_id].ap_vht_cap,
1334                                              &assoc_data->link[link_id].conn);
1335
1336                 if (link)
1337                         link->conf->mu_mimo_owner = mu_mimo_owner;
1338                 ADD_PRESENT_ELEM(WLAN_EID_VHT_CAPABILITY);
1339         }
1340
1341         /* if present, add any custom IEs that go before HE */
1342         offset = ieee80211_add_before_he_elems(skb, extra_elems,
1343                                                extra_elems_len,
1344                                                offset);
1345
1346         if (assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_HE) {
1347                 ieee80211_put_he_cap(skb, sdata, sband,
1348                                      &assoc_data->link[link_id].conn);
1349                 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY);
1350                 ieee80211_put_he_6ghz_cap(skb, sdata, smps_mode);
1351         }
1352
1353         /*
1354          * careful - need to know about all the present elems before
1355          * calling ieee80211_assoc_add_ml_elem(), so add this one if
1356          * we're going to put it after the ML element
1357          */
1358         if (assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_EHT)
1359                 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_EHT_CAPABILITY);
1360
1361         if (link_id == assoc_data->assoc_link_id)
1362                 ieee80211_assoc_add_ml_elem(sdata, skb, orig_capab, ext_capa,
1363                                             present_elems);
1364
1365         /* crash if somebody gets it wrong */
1366         present_elems = NULL;
1367
1368         if (assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_EHT)
1369                 ieee80211_put_eht_cap(skb, sdata, sband,
1370                                       &assoc_data->link[link_id].conn);
1371
1372         if (sband->band == NL80211_BAND_S1GHZ) {
1373                 ieee80211_add_aid_request_ie(sdata, skb);
1374                 ieee80211_add_s1g_capab_ie(sdata, &sband->s1g_cap, skb);
1375         }
1376
1377         if (iftd && iftd->vendor_elems.data && iftd->vendor_elems.len)
1378                 skb_put_data(skb, iftd->vendor_elems.data, iftd->vendor_elems.len);
1379
1380         return offset;
1381 }
1382
1383 static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb,
1384                                                const u16 *outer,
1385                                                const u16 *inner)
1386 {
1387         unsigned int skb_len = skb->len;
1388         bool at_extension = false;
1389         bool added = false;
1390         int i, j;
1391         u8 *len, *list_len = NULL;
1392
1393         skb_put_u8(skb, WLAN_EID_EXTENSION);
1394         len = skb_put(skb, 1);
1395         skb_put_u8(skb, WLAN_EID_EXT_NON_INHERITANCE);
1396
1397         for (i = 0; i < PRESENT_ELEMS_MAX && outer[i]; i++) {
1398                 u16 elem = outer[i];
1399                 bool have_inner = false;
1400
1401                 /* should at least be sorted in the sense of normal -> ext */
1402                 WARN_ON(at_extension && elem < PRESENT_ELEM_EXT_OFFS);
1403
1404                 /* switch to extension list */
1405                 if (!at_extension && elem >= PRESENT_ELEM_EXT_OFFS) {
1406                         at_extension = true;
1407                         if (!list_len)
1408                                 skb_put_u8(skb, 0);
1409                         list_len = NULL;
1410                 }
1411
1412                 for (j = 0; j < PRESENT_ELEMS_MAX && inner[j]; j++) {
1413                         if (elem == inner[j]) {
1414                                 have_inner = true;
1415                                 break;
1416                         }
1417                 }
1418
1419                 if (have_inner)
1420                         continue;
1421
1422                 if (!list_len) {
1423                         list_len = skb_put(skb, 1);
1424                         *list_len = 0;
1425                 }
1426                 *list_len += 1;
1427                 skb_put_u8(skb, (u8)elem);
1428                 added = true;
1429         }
1430
1431         /* if we added a list but no extension list, make a zero-len one */
1432         if (added && (!at_extension || !list_len))
1433                 skb_put_u8(skb, 0);
1434
1435         /* if nothing added remove extension element completely */
1436         if (!added)
1437                 skb_trim(skb, skb_len);
1438         else
1439                 *len = skb->len - skb_len - 2;
1440 }
1441
1442 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1443                                         struct sk_buff *skb, u16 capab,
1444                                         const struct element *ext_capa,
1445                                         const u16 *outer_present_elems)
1446 {
1447         struct ieee80211_local *local = sdata->local;
1448         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1449         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1450         struct ieee80211_multi_link_elem *ml_elem;
1451         struct ieee80211_mle_basic_common_info *common;
1452         const struct wiphy_iftype_ext_capab *ift_ext_capa;
1453         __le16 eml_capa = 0, mld_capa_ops = 0;
1454         unsigned int link_id;
1455         u8 *ml_elem_len;
1456         void *capab_pos;
1457
1458         if (!ieee80211_vif_is_mld(&sdata->vif))
1459                 return;
1460
1461         ift_ext_capa = cfg80211_get_iftype_ext_capa(local->hw.wiphy,
1462                                                     ieee80211_vif_type_p2p(&sdata->vif));
1463         if (ift_ext_capa) {
1464                 eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities);
1465                 mld_capa_ops = cpu_to_le16(ift_ext_capa->mld_capa_and_ops);
1466         }
1467
1468         skb_put_u8(skb, WLAN_EID_EXTENSION);
1469         ml_elem_len = skb_put(skb, 1);
1470         skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK);
1471         ml_elem = skb_put(skb, sizeof(*ml_elem));
1472         ml_elem->control =
1473                 cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC |
1474                             IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP);
1475         common = skb_put(skb, sizeof(*common));
1476         common->len = sizeof(*common) +
1477                       2;  /* MLD capa/ops */
1478         memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN);
1479
1480         /* add EML_CAPA only if needed, see Draft P802.11be_D2.1, 35.3.17 */
1481         if (eml_capa &
1482             cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |
1483                          IEEE80211_EML_CAP_EMLMR_SUPPORT))) {
1484                 common->len += 2; /* EML capabilities */
1485                 ml_elem->control |=
1486                         cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EML_CAPA);
1487                 skb_put_data(skb, &eml_capa, sizeof(eml_capa));
1488         }
1489         skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops));
1490
1491         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1492                 u16 link_present_elems[PRESENT_ELEMS_MAX] = {};
1493                 const u8 *extra_elems;
1494                 size_t extra_elems_len;
1495                 size_t extra_used;
1496                 u8 *subelem_len = NULL;
1497                 __le16 ctrl;
1498
1499                 if (!assoc_data->link[link_id].bss ||
1500                     link_id == assoc_data->assoc_link_id)
1501                         continue;
1502
1503                 extra_elems = assoc_data->link[link_id].elems;
1504                 extra_elems_len = assoc_data->link[link_id].elems_len;
1505
1506                 skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE);
1507                 subelem_len = skb_put(skb, 1);
1508
1509                 ctrl = cpu_to_le16(link_id |
1510                                    IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE |
1511                                    IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT);
1512                 skb_put_data(skb, &ctrl, sizeof(ctrl));
1513                 skb_put_u8(skb, 1 + ETH_ALEN); /* STA Info Length */
1514                 skb_put_data(skb, assoc_data->link[link_id].addr,
1515                              ETH_ALEN);
1516                 /*
1517                  * Now add the contents of the (re)association request,
1518                  * but the "listen interval" and "current AP address"
1519                  * (if applicable) are skipped. So we only have
1520                  * the capability field (remember the position and fill
1521                  * later), followed by the elements added below by
1522                  * calling ieee80211_assoc_link_elems().
1523                  */
1524                 capab_pos = skb_put(skb, 2);
1525
1526                 extra_used = ieee80211_assoc_link_elems(sdata, skb, &capab,
1527                                                         ext_capa,
1528                                                         extra_elems,
1529                                                         extra_elems_len,
1530                                                         link_id, NULL,
1531                                                         link_present_elems);
1532                 if (extra_elems)
1533                         skb_put_data(skb, extra_elems + extra_used,
1534                                      extra_elems_len - extra_used);
1535
1536                 put_unaligned_le16(capab, capab_pos);
1537
1538                 ieee80211_add_non_inheritance_elem(skb, outer_present_elems,
1539                                                    link_present_elems);
1540
1541                 ieee80211_fragment_element(skb, subelem_len,
1542                                            IEEE80211_MLE_SUBELEM_FRAGMENT);
1543         }
1544
1545         ieee80211_fragment_element(skb, ml_elem_len, WLAN_EID_FRAGMENT);
1546 }
1547
1548 static int ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
1549 {
1550         struct ieee80211_local *local = sdata->local;
1551         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1552         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1553         struct ieee80211_link_data *link;
1554         struct sk_buff *skb;
1555         struct ieee80211_mgmt *mgmt;
1556         u8 *pos, qos_info, *ie_start;
1557         size_t offset, noffset;
1558         u16 capab = 0, link_capab;
1559         __le16 listen_int;
1560         struct element *ext_capa = NULL;
1561         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1562         struct ieee80211_prep_tx_info info = {};
1563         unsigned int link_id, n_links = 0;
1564         u16 present_elems[PRESENT_ELEMS_MAX] = {};
1565         void *capab_pos;
1566         size_t size;
1567         int ret;
1568
1569         /* we know it's writable, cast away the const */
1570         if (assoc_data->ie_len)
1571                 ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
1572                                                       assoc_data->ie,
1573                                                       assoc_data->ie_len);
1574
1575         lockdep_assert_wiphy(sdata->local->hw.wiphy);
1576
1577         size = local->hw.extra_tx_headroom +
1578                sizeof(*mgmt) + /* bit too much but doesn't matter */
1579                2 + assoc_data->ssid_len + /* SSID */
1580                assoc_data->ie_len + /* extra IEs */
1581                (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
1582                9; /* WMM */
1583
1584         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1585                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1586                 const struct ieee80211_sband_iftype_data *iftd;
1587                 struct ieee80211_supported_band *sband;
1588
1589                 if (!cbss)
1590                         continue;
1591
1592                 sband = local->hw.wiphy->bands[cbss->channel->band];
1593
1594                 n_links++;
1595                 /* add STA profile elements length */
1596                 size += assoc_data->link[link_id].elems_len;
1597                 /* and supported rates length */
1598                 size += 4 + sband->n_bitrates;
1599                 /* supported channels */
1600                 size += 2 + 2 * sband->n_channels;
1601
1602                 iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1603                 if (iftd)
1604                         size += iftd->vendor_elems.len;
1605
1606                 /* power capability */
1607                 size += 4;
1608
1609                 /* HT, VHT, HE, EHT */
1610                 size += 2 + sizeof(struct ieee80211_ht_cap);
1611                 size += 2 + sizeof(struct ieee80211_vht_cap);
1612                 size += 2 + 1 + sizeof(struct ieee80211_he_cap_elem) +
1613                         sizeof(struct ieee80211_he_mcs_nss_supp) +
1614                         IEEE80211_HE_PPE_THRES_MAX_LEN;
1615
1616                 if (sband->band == NL80211_BAND_6GHZ)
1617                         size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa);
1618
1619                 size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) +
1620                         sizeof(struct ieee80211_eht_mcs_nss_supp) +
1621                         IEEE80211_EHT_PPE_THRES_MAX_LEN;
1622
1623                 /* non-inheritance element */
1624                 size += 2 + 2 + PRESENT_ELEMS_MAX;
1625
1626                 /* should be the same across all BSSes */
1627                 if (cbss->capability & WLAN_CAPABILITY_PRIVACY)
1628                         capab |= WLAN_CAPABILITY_PRIVACY;
1629         }
1630
1631         if (ieee80211_vif_is_mld(&sdata->vif)) {
1632                 /* consider the multi-link element with STA profile */
1633                 size += sizeof(struct ieee80211_multi_link_elem);
1634                 /* max common info field in basic multi-link element */
1635                 size += sizeof(struct ieee80211_mle_basic_common_info) +
1636                         2 + /* capa & op */
1637                         2; /* EML capa */
1638
1639                 /*
1640                  * The capability elements were already considered above;
1641                  * note this over-estimates a bit because there's no
1642                  * STA profile for the assoc link.
1643                  */
1644                 size += (n_links - 1) *
1645                         (1 + 1 + /* subelement ID/length */
1646                          2 + /* STA control */
1647                          1 + ETH_ALEN + 2 /* STA Info field */);
1648         }
1649
1650         link = sdata_dereference(sdata->link[assoc_data->assoc_link_id], sdata);
1651         if (WARN_ON(!link))
1652                 return -EINVAL;
1653
1654         if (WARN_ON(!assoc_data->link[assoc_data->assoc_link_id].bss))
1655                 return -EINVAL;
1656
1657         skb = alloc_skb(size, GFP_KERNEL);
1658         if (!skb)
1659                 return -ENOMEM;
1660
1661         skb_reserve(skb, local->hw.extra_tx_headroom);
1662
1663         if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
1664                 capab |= WLAN_CAPABILITY_RADIO_MEASURE;
1665
1666         /* Set MBSSID support for HE AP if needed */
1667         if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
1668             link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HE &&
1669             ext_capa && ext_capa->datalen >= 3)
1670                 ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
1671
1672         mgmt = skb_put_zero(skb, 24);
1673         memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
1674         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1675         memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
1676
1677         listen_int = cpu_to_le16(assoc_data->s1g ?
1678                         ieee80211_encode_usf(local->hw.conf.listen_interval) :
1679                         local->hw.conf.listen_interval);
1680         if (!is_zero_ether_addr(assoc_data->prev_ap_addr)) {
1681                 skb_put(skb, 10);
1682                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1683                                                   IEEE80211_STYPE_REASSOC_REQ);
1684                 capab_pos = &mgmt->u.reassoc_req.capab_info;
1685                 mgmt->u.reassoc_req.listen_interval = listen_int;
1686                 memcpy(mgmt->u.reassoc_req.current_ap,
1687                        assoc_data->prev_ap_addr, ETH_ALEN);
1688                 info.subtype = IEEE80211_STYPE_REASSOC_REQ;
1689         } else {
1690                 skb_put(skb, 4);
1691                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1692                                                   IEEE80211_STYPE_ASSOC_REQ);
1693                 capab_pos = &mgmt->u.assoc_req.capab_info;
1694                 mgmt->u.assoc_req.listen_interval = listen_int;
1695                 info.subtype = IEEE80211_STYPE_ASSOC_REQ;
1696         }
1697
1698         /* SSID */
1699         pos = skb_put(skb, 2 + assoc_data->ssid_len);
1700         ie_start = pos;
1701         *pos++ = WLAN_EID_SSID;
1702         *pos++ = assoc_data->ssid_len;
1703         memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
1704
1705         /*
1706          * This bit is technically reserved, so it shouldn't matter for either
1707          * the AP or us, but it also means we shouldn't set it. However, we've
1708          * always set it in the past, and apparently some EHT APs check that
1709          * we don't set it. To avoid interoperability issues with old APs that
1710          * for some reason check it and want it to be set, set the bit for all
1711          * pre-EHT connections as we used to do.
1712          */
1713         if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_EHT)
1714                 capab |= WLAN_CAPABILITY_ESS;
1715
1716         /* add the elements for the assoc (main) link */
1717         link_capab = capab;
1718         offset = ieee80211_assoc_link_elems(sdata, skb, &link_capab,
1719                                             ext_capa,
1720                                             assoc_data->ie,
1721                                             assoc_data->ie_len,
1722                                             assoc_data->assoc_link_id, link,
1723                                             present_elems);
1724         put_unaligned_le16(link_capab, capab_pos);
1725
1726         /* if present, add any custom non-vendor IEs */
1727         if (assoc_data->ie_len) {
1728                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
1729                                                     assoc_data->ie_len,
1730                                                     offset);
1731                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1732                 offset = noffset;
1733         }
1734
1735         if (assoc_data->wmm) {
1736                 if (assoc_data->uapsd) {
1737                         qos_info = ifmgd->uapsd_queues;
1738                         qos_info |= (ifmgd->uapsd_max_sp_len <<
1739                                      IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
1740                 } else {
1741                         qos_info = 0;
1742                 }
1743
1744                 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
1745         }
1746
1747         /* add any remaining custom (i.e. vendor specific here) IEs */
1748         if (assoc_data->ie_len) {
1749                 noffset = assoc_data->ie_len;
1750                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1751         }
1752
1753         if (assoc_data->fils_kek_len) {
1754                 ret = fils_encrypt_assoc_req(skb, assoc_data);
1755                 if (ret < 0) {
1756                         dev_kfree_skb(skb);
1757                         return ret;
1758                 }
1759         }
1760
1761         pos = skb_tail_pointer(skb);
1762         kfree(ifmgd->assoc_req_ies);
1763         ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
1764         if (!ifmgd->assoc_req_ies) {
1765                 dev_kfree_skb(skb);
1766                 return -ENOMEM;
1767         }
1768
1769         ifmgd->assoc_req_ies_len = pos - ie_start;
1770
1771         info.link_id = assoc_data->assoc_link_id;
1772         drv_mgd_prepare_tx(local, sdata, &info);
1773
1774         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1775         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1776                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
1777                                                 IEEE80211_TX_INTFL_MLME_CONN_TX;
1778         ieee80211_tx_skb(sdata, skb);
1779
1780         return 0;
1781 }
1782
1783 void ieee80211_send_pspoll(struct ieee80211_local *local,
1784                            struct ieee80211_sub_if_data *sdata)
1785 {
1786         struct ieee80211_pspoll *pspoll;
1787         struct sk_buff *skb;
1788
1789         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
1790         if (!skb)
1791                 return;
1792
1793         pspoll = (struct ieee80211_pspoll *) skb->data;
1794         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1795
1796         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1797         ieee80211_tx_skb(sdata, skb);
1798 }
1799
1800 void ieee80211_send_nullfunc(struct ieee80211_local *local,
1801                              struct ieee80211_sub_if_data *sdata,
1802                              bool powersave)
1803 {
1804         struct sk_buff *skb;
1805         struct ieee80211_hdr_3addr *nullfunc;
1806         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1807
1808         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, -1,
1809                                      !ieee80211_hw_check(&local->hw,
1810                                                          DOESNT_SUPPORT_QOS_NDP));
1811         if (!skb)
1812                 return;
1813
1814         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1815         if (powersave)
1816                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1817
1818         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1819                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1820
1821         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1822                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1823
1824         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1825                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1826
1827         ieee80211_tx_skb(sdata, skb);
1828 }
1829
1830 void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
1831                                    struct ieee80211_sub_if_data *sdata)
1832 {
1833         struct sk_buff *skb;
1834         struct ieee80211_hdr *nullfunc;
1835         __le16 fc;
1836
1837         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1838                 return;
1839
1840         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1841         if (!skb)
1842                 return;
1843
1844         skb_reserve(skb, local->hw.extra_tx_headroom);
1845
1846         nullfunc = skb_put_zero(skb, 30);
1847         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
1848                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
1849         nullfunc->frame_control = fc;
1850         memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1851         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1852         memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1853         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
1854
1855         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1856         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1857         ieee80211_tx_skb(sdata, skb);
1858 }
1859
1860 /* spectrum management related things */
1861 static void ieee80211_chswitch_work(struct wiphy *wiphy,
1862                                     struct wiphy_work *work)
1863 {
1864         struct ieee80211_link_data *link =
1865                 container_of(work, struct ieee80211_link_data,
1866                              u.mgd.chswitch_work.work);
1867         struct ieee80211_sub_if_data *sdata = link->sdata;
1868         struct ieee80211_local *local = sdata->local;
1869         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1870         int ret;
1871
1872         if (!ieee80211_sdata_running(sdata))
1873                 return;
1874
1875         lockdep_assert_wiphy(local->hw.wiphy);
1876
1877         if (!ifmgd->associated)
1878                 return;
1879
1880         if (!link->conf->csa_active)
1881                 return;
1882
1883         /*
1884          * using reservation isn't immediate as it may be deferred until later
1885          * with multi-vif. once reservation is complete it will re-schedule the
1886          * work with no reserved_chanctx so verify chandef to check if it
1887          * completed successfully
1888          */
1889
1890         if (link->reserved_chanctx) {
1891                 /*
1892                  * with multi-vif csa driver may call ieee80211_csa_finish()
1893                  * many times while waiting for other interfaces to use their
1894                  * reservations
1895                  */
1896                 if (link->reserved_ready)
1897                         return;
1898
1899                 ret = ieee80211_link_use_reserved_context(link);
1900                 if (ret) {
1901                         sdata_info(sdata,
1902                                    "failed to use reserved channel context, disconnecting (err=%d)\n",
1903                                    ret);
1904                         wiphy_work_queue(sdata->local->hw.wiphy,
1905                                          &ifmgd->csa_connection_drop_work);
1906                 }
1907                 return;
1908         }
1909
1910         if (!ieee80211_chanreq_identical(&link->conf->chanreq,
1911                                          &link->csa_chanreq)) {
1912                 sdata_info(sdata,
1913                            "failed to finalize channel switch, disconnecting\n");
1914                 wiphy_work_queue(sdata->local->hw.wiphy,
1915                                  &ifmgd->csa_connection_drop_work);
1916                 return;
1917         }
1918
1919         link->u.mgd.csa_waiting_bcn = true;
1920
1921         ieee80211_sta_reset_beacon_monitor(sdata);
1922         ieee80211_sta_reset_conn_monitor(sdata);
1923 }
1924
1925 static void ieee80211_chswitch_post_beacon(struct ieee80211_link_data *link)
1926 {
1927         struct ieee80211_sub_if_data *sdata = link->sdata;
1928         struct ieee80211_local *local = sdata->local;
1929         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1930         int ret;
1931
1932         lockdep_assert_wiphy(sdata->local->hw.wiphy);
1933
1934         WARN_ON(!link->conf->csa_active);
1935
1936         if (sdata->csa_blocked_tx) {
1937                 ieee80211_wake_vif_queues(local, sdata,
1938                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1939                 sdata->csa_blocked_tx = false;
1940         }
1941
1942         link->conf->csa_active = false;
1943         link->u.mgd.csa_waiting_bcn = false;
1944
1945         ret = drv_post_channel_switch(link);
1946         if (ret) {
1947                 sdata_info(sdata,
1948                            "driver post channel switch failed, disconnecting\n");
1949                 wiphy_work_queue(sdata->local->hw.wiphy,
1950                                  &ifmgd->csa_connection_drop_work);
1951                 return;
1952         }
1953
1954         cfg80211_ch_switch_notify(sdata->dev, &link->reserved.oper,
1955                                   link->link_id);
1956 }
1957
1958 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success,
1959                              unsigned int link_id)
1960 {
1961         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1962
1963         trace_api_chswitch_done(sdata, success, link_id);
1964
1965         rcu_read_lock();
1966
1967         if (!success) {
1968                 sdata_info(sdata,
1969                            "driver channel switch failed, disconnecting\n");
1970                 wiphy_work_queue(sdata->local->hw.wiphy,
1971                                  &sdata->u.mgd.csa_connection_drop_work);
1972         } else {
1973                 struct ieee80211_link_data *link =
1974                         rcu_dereference(sdata->link[link_id]);
1975
1976                 if (WARN_ON(!link)) {
1977                         rcu_read_unlock();
1978                         return;
1979                 }
1980
1981                 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
1982                                          &link->u.mgd.chswitch_work, 0);
1983         }
1984
1985         rcu_read_unlock();
1986 }
1987 EXPORT_SYMBOL(ieee80211_chswitch_done);
1988
1989 static void
1990 ieee80211_sta_abort_chanswitch(struct ieee80211_link_data *link)
1991 {
1992         struct ieee80211_sub_if_data *sdata = link->sdata;
1993         struct ieee80211_local *local = sdata->local;
1994
1995         lockdep_assert_wiphy(local->hw.wiphy);
1996
1997         if (!local->ops->abort_channel_switch)
1998                 return;
1999
2000         ieee80211_link_unreserve_chanctx(link);
2001
2002         if (sdata->csa_blocked_tx) {
2003                 ieee80211_wake_vif_queues(local, sdata,
2004                                           IEEE80211_QUEUE_STOP_REASON_CSA);
2005                 sdata->csa_blocked_tx = false;
2006         }
2007
2008         link->conf->csa_active = false;
2009
2010         drv_abort_channel_switch(link);
2011 }
2012
2013 static void
2014 ieee80211_sta_process_chanswitch(struct ieee80211_link_data *link,
2015                                  u64 timestamp, u32 device_timestamp,
2016                                  struct ieee802_11_elems *elems,
2017                                  bool beacon)
2018 {
2019         struct ieee80211_sub_if_data *sdata = link->sdata;
2020         struct ieee80211_local *local = sdata->local;
2021         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2022         struct cfg80211_bss *cbss = link->conf->bss;
2023         struct ieee80211_chanctx_conf *conf;
2024         struct ieee80211_chanctx *chanctx;
2025         enum nl80211_band current_band;
2026         struct ieee80211_csa_ie csa_ie;
2027         struct ieee80211_channel_switch ch_switch = {
2028                 .link_id = link->link_id,
2029         };
2030         struct ieee80211_bss *bss;
2031         unsigned long timeout;
2032         int res;
2033
2034         lockdep_assert_wiphy(local->hw.wiphy);
2035
2036         if (!cbss)
2037                 return;
2038
2039         current_band = cbss->channel->band;
2040         bss = (void *)cbss->priv;
2041         res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
2042                                            bss->vht_cap_info,
2043                                            &link->u.mgd.conn,
2044                                            link->u.mgd.bssid, &csa_ie);
2045
2046         if (!res) {
2047                 ch_switch.timestamp = timestamp;
2048                 ch_switch.device_timestamp = device_timestamp;
2049                 ch_switch.block_tx = csa_ie.mode;
2050                 ch_switch.chandef = csa_ie.chanreq.oper;
2051                 ch_switch.count = csa_ie.count;
2052                 ch_switch.delay = csa_ie.max_switch_time;
2053         }
2054
2055         if (res < 0)
2056                 goto drop_connection;
2057
2058         if (link->conf->csa_active) {
2059                 /* already processing - disregard action frames */
2060                 if (!beacon)
2061                         return;
2062
2063                 if (link->u.mgd.csa_waiting_bcn) {
2064                         ieee80211_chswitch_post_beacon(link);
2065                         /*
2066                          * If the CSA IE is still present in the beacon after
2067                          * the switch, we need to consider it as a new CSA
2068                          * (possibly to self) - this happens by not returning
2069                          * here so we'll get to the check below.
2070                          */
2071                 } else if (res) {
2072                         ieee80211_sta_abort_chanswitch(link);
2073                         return;
2074                 } else {
2075                         drv_channel_switch_rx_beacon(sdata, &ch_switch);
2076                         return;
2077                 }
2078         }
2079
2080         /* nothing to do at all - no active CSA nor a new one */
2081         if (res)
2082                 return;
2083
2084         if (link->conf->chanreq.oper.chan->band !=
2085             csa_ie.chanreq.oper.chan->band) {
2086                 sdata_info(sdata,
2087                            "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
2088                            link->u.mgd.bssid,
2089                            csa_ie.chanreq.oper.chan->center_freq,
2090                            csa_ie.chanreq.oper.width,
2091                            csa_ie.chanreq.oper.center_freq1,
2092                            csa_ie.chanreq.oper.center_freq2);
2093                 goto drop_connection;
2094         }
2095
2096         if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chanreq.oper,
2097                                      IEEE80211_CHAN_DISABLED)) {
2098                 sdata_info(sdata,
2099                            "AP %pM switches to unsupported channel "
2100                            "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
2101                            "disconnecting\n",
2102                            link->u.mgd.bssid,
2103                            csa_ie.chanreq.oper.chan->center_freq,
2104                            csa_ie.chanreq.oper.chan->freq_offset,
2105                            csa_ie.chanreq.oper.width,
2106                            csa_ie.chanreq.oper.center_freq1,
2107                            csa_ie.chanreq.oper.freq1_offset,
2108                            csa_ie.chanreq.oper.center_freq2);
2109                 goto drop_connection;
2110         }
2111
2112         if (cfg80211_chandef_identical(&csa_ie.chanreq.oper,
2113                                        &link->conf->chanreq.oper) &&
2114             (!csa_ie.mode || !beacon)) {
2115                 if (link->u.mgd.csa_ignored_same_chan)
2116                         return;
2117                 sdata_info(sdata,
2118                            "AP %pM tries to chanswitch to same channel, ignore\n",
2119                            link->u.mgd.bssid);
2120                 link->u.mgd.csa_ignored_same_chan = true;
2121                 return;
2122         }
2123
2124         /*
2125          * Drop all TDLS peers on the affected link - either we disconnect or
2126          * move to a different channel from this point on. There's no telling
2127          * what our peer will do.
2128          * The TDLS WIDER_BW scenario is also problematic, as peers might now
2129          * have an incompatible wider chandef.
2130          */
2131         ieee80211_teardown_tdls_peers(link);
2132
2133         conf = rcu_dereference_protected(link->conf->chanctx_conf,
2134                                          lockdep_is_held(&local->hw.wiphy->mtx));
2135         if (!conf) {
2136                 sdata_info(sdata,
2137                            "no channel context assigned to vif?, disconnecting\n");
2138                 goto drop_connection;
2139         }
2140
2141         chanctx = container_of(conf, struct ieee80211_chanctx, conf);
2142
2143         if (!ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
2144                 sdata_info(sdata,
2145                            "driver doesn't support chan-switch with channel contexts\n");
2146                 goto drop_connection;
2147         }
2148
2149         if (drv_pre_channel_switch(sdata, &ch_switch)) {
2150                 sdata_info(sdata,
2151                            "preparing for channel switch failed, disconnecting\n");
2152                 goto drop_connection;
2153         }
2154
2155         res = ieee80211_link_reserve_chanctx(link, &csa_ie.chanreq,
2156                                              chanctx->mode, false);
2157         if (res) {
2158                 sdata_info(sdata,
2159                            "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
2160                            res);
2161                 goto drop_connection;
2162         }
2163
2164         link->conf->csa_active = true;
2165         link->csa_chanreq = csa_ie.chanreq;
2166         link->u.mgd.csa_ignored_same_chan = false;
2167         link->u.mgd.beacon_crc_valid = false;
2168
2169         if (csa_ie.mode &&
2170             !ieee80211_hw_check(&local->hw, HANDLES_QUIET_CSA)) {
2171                 ieee80211_stop_vif_queues(local, sdata,
2172                                           IEEE80211_QUEUE_STOP_REASON_CSA);
2173                 sdata->csa_blocked_tx = true;
2174         }
2175
2176         cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chanreq.oper,
2177                                           link->link_id, csa_ie.count,
2178                                           csa_ie.mode);
2179
2180         if (local->ops->channel_switch) {
2181                 /* use driver's channel switch callback */
2182                 drv_channel_switch(local, sdata, &ch_switch);
2183                 return;
2184         }
2185
2186         /* channel switch handled in software */
2187         timeout = TU_TO_JIFFIES((max_t(int, csa_ie.count, 1) - 1) *
2188                                 cbss->beacon_interval);
2189         wiphy_delayed_work_queue(local->hw.wiphy,
2190                                  &link->u.mgd.chswitch_work,
2191                                  timeout);
2192         return;
2193  drop_connection:
2194         /*
2195          * This is just so that the disconnect flow will know that
2196          * we were trying to switch channel and failed. In case the
2197          * mode is 1 (we are not allowed to Tx), we will know not to
2198          * send a deauthentication frame. Those two fields will be
2199          * reset when the disconnection worker runs.
2200          */
2201         link->conf->csa_active = true;
2202         sdata->csa_blocked_tx =
2203                 csa_ie.mode && !ieee80211_hw_check(&local->hw, HANDLES_QUIET_CSA);
2204
2205         wiphy_work_queue(sdata->local->hw.wiphy,
2206                          &ifmgd->csa_connection_drop_work);
2207 }
2208
2209 static bool
2210 ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
2211                                  struct ieee80211_channel *channel,
2212                                  const u8 *country_ie, u8 country_ie_len,
2213                                  const u8 *pwr_constr_elem,
2214                                  int *chan_pwr, int *pwr_reduction)
2215 {
2216         struct ieee80211_country_ie_triplet *triplet;
2217         int chan = ieee80211_frequency_to_channel(channel->center_freq);
2218         int i, chan_increment;
2219         bool have_chan_pwr = false;
2220
2221         /* Invalid IE */
2222         if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
2223                 return false;
2224
2225         triplet = (void *)(country_ie + 3);
2226         country_ie_len -= 3;
2227
2228         switch (channel->band) {
2229         default:
2230                 WARN_ON_ONCE(1);
2231                 fallthrough;
2232         case NL80211_BAND_2GHZ:
2233         case NL80211_BAND_60GHZ:
2234         case NL80211_BAND_LC:
2235                 chan_increment = 1;
2236                 break;
2237         case NL80211_BAND_5GHZ:
2238                 chan_increment = 4;
2239                 break;
2240         case NL80211_BAND_6GHZ:
2241                 /*
2242                  * In the 6 GHz band, the "maximum transmit power level"
2243                  * field in the triplets is reserved, and thus will be
2244                  * zero and we shouldn't use it to control TX power.
2245                  * The actual TX power will be given in the transmit
2246                  * power envelope element instead.
2247                  */
2248                 return false;
2249         }
2250
2251         /* find channel */
2252         while (country_ie_len >= 3) {
2253                 u8 first_channel = triplet->chans.first_channel;
2254
2255                 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
2256                         goto next;
2257
2258                 for (i = 0; i < triplet->chans.num_channels; i++) {
2259                         if (first_channel + i * chan_increment == chan) {
2260                                 have_chan_pwr = true;
2261                                 *chan_pwr = triplet->chans.max_power;
2262                                 break;
2263                         }
2264                 }
2265                 if (have_chan_pwr)
2266                         break;
2267
2268  next:
2269                 triplet++;
2270                 country_ie_len -= 3;
2271         }
2272
2273         if (have_chan_pwr && pwr_constr_elem)
2274                 *pwr_reduction = *pwr_constr_elem;
2275         else
2276                 *pwr_reduction = 0;
2277
2278         return have_chan_pwr;
2279 }
2280
2281 static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
2282                                       struct ieee80211_channel *channel,
2283                                       const u8 *cisco_dtpc_ie,
2284                                       int *pwr_level)
2285 {
2286         /* From practical testing, the first data byte of the DTPC element
2287          * seems to contain the requested dBm level, and the CLI on Cisco
2288          * APs clearly state the range is -127 to 127 dBm, which indicates
2289          * a signed byte, although it seemingly never actually goes negative.
2290          * The other byte seems to always be zero.
2291          */
2292         *pwr_level = (__s8)cisco_dtpc_ie[4];
2293 }
2294
2295 static u64 ieee80211_handle_pwr_constr(struct ieee80211_link_data *link,
2296                                        struct ieee80211_channel *channel,
2297                                        struct ieee80211_mgmt *mgmt,
2298                                        const u8 *country_ie, u8 country_ie_len,
2299                                        const u8 *pwr_constr_ie,
2300                                        const u8 *cisco_dtpc_ie)
2301 {
2302         struct ieee80211_sub_if_data *sdata = link->sdata;
2303         bool has_80211h_pwr = false, has_cisco_pwr = false;
2304         int chan_pwr = 0, pwr_reduction_80211h = 0;
2305         int pwr_level_cisco, pwr_level_80211h;
2306         int new_ap_level;
2307         __le16 capab = mgmt->u.probe_resp.capab_info;
2308
2309         if (ieee80211_is_s1g_beacon(mgmt->frame_control))
2310                 return 0;       /* TODO */
2311
2312         if (country_ie &&
2313             (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
2314              capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
2315                 has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
2316                         sdata, channel, country_ie, country_ie_len,
2317                         pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
2318                 pwr_level_80211h =
2319                         max_t(int, 0, chan_pwr - pwr_reduction_80211h);
2320         }
2321
2322         if (cisco_dtpc_ie) {
2323                 ieee80211_find_cisco_dtpc(
2324                         sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
2325                 has_cisco_pwr = true;
2326         }
2327
2328         if (!has_80211h_pwr && !has_cisco_pwr)
2329                 return 0;
2330
2331         /* If we have both 802.11h and Cisco DTPC, apply both limits
2332          * by picking the smallest of the two power levels advertised.
2333          */
2334         if (has_80211h_pwr &&
2335             (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
2336                 new_ap_level = pwr_level_80211h;
2337
2338                 if (link->ap_power_level == new_ap_level)
2339                         return 0;
2340
2341                 sdata_dbg(sdata,
2342                           "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
2343                           pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
2344                           link->u.mgd.bssid);
2345         } else {  /* has_cisco_pwr is always true here. */
2346                 new_ap_level = pwr_level_cisco;
2347
2348                 if (link->ap_power_level == new_ap_level)
2349                         return 0;
2350
2351                 sdata_dbg(sdata,
2352                           "Limiting TX power to %d dBm as advertised by %pM\n",
2353                           pwr_level_cisco, link->u.mgd.bssid);
2354         }
2355
2356         link->ap_power_level = new_ap_level;
2357         if (__ieee80211_recalc_txpower(sdata))
2358                 return BSS_CHANGED_TXPOWER;
2359         return 0;
2360 }
2361
2362 /* powersave */
2363 static void ieee80211_enable_ps(struct ieee80211_local *local,
2364                                 struct ieee80211_sub_if_data *sdata)
2365 {
2366         struct ieee80211_conf *conf = &local->hw.conf;
2367
2368         /*
2369          * If we are scanning right now then the parameters will
2370          * take effect when scan finishes.
2371          */
2372         if (local->scanning)
2373                 return;
2374
2375         if (conf->dynamic_ps_timeout > 0 &&
2376             !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2377                 mod_timer(&local->dynamic_ps_timer, jiffies +
2378                           msecs_to_jiffies(conf->dynamic_ps_timeout));
2379         } else {
2380                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
2381                         ieee80211_send_nullfunc(local, sdata, true);
2382
2383                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2384                     ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2385                         return;
2386
2387                 conf->flags |= IEEE80211_CONF_PS;
2388                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2389         }
2390 }
2391
2392 static void ieee80211_change_ps(struct ieee80211_local *local)
2393 {
2394         struct ieee80211_conf *conf = &local->hw.conf;
2395
2396         if (local->ps_sdata) {
2397                 ieee80211_enable_ps(local, local->ps_sdata);
2398         } else if (conf->flags & IEEE80211_CONF_PS) {
2399                 conf->flags &= ~IEEE80211_CONF_PS;
2400                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2401                 del_timer_sync(&local->dynamic_ps_timer);
2402                 wiphy_work_cancel(local->hw.wiphy,
2403                                   &local->dynamic_ps_enable_work);
2404         }
2405 }
2406
2407 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
2408 {
2409         struct ieee80211_local *local = sdata->local;
2410         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
2411         struct sta_info *sta = NULL;
2412         bool authorized = false;
2413
2414         if (!mgd->powersave)
2415                 return false;
2416
2417         if (mgd->broken_ap)
2418                 return false;
2419
2420         if (!mgd->associated)
2421                 return false;
2422
2423         if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
2424                 return false;
2425
2426         if (!(local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO) &&
2427             !sdata->deflink.u.mgd.have_beacon)
2428                 return false;
2429
2430         rcu_read_lock();
2431         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
2432         if (sta)
2433                 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2434         rcu_read_unlock();
2435
2436         return authorized;
2437 }
2438
2439 /* need to hold RTNL or interface lock */
2440 void ieee80211_recalc_ps(struct ieee80211_local *local)
2441 {
2442         struct ieee80211_sub_if_data *sdata, *found = NULL;
2443         int count = 0;
2444         int timeout;
2445
2446         if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS) ||
2447             ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2448                 local->ps_sdata = NULL;
2449                 return;
2450         }
2451
2452         list_for_each_entry(sdata, &local->interfaces, list) {
2453                 if (!ieee80211_sdata_running(sdata))
2454                         continue;
2455                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
2456                         /* If an AP vif is found, then disable PS
2457                          * by setting the count to zero thereby setting
2458                          * ps_sdata to NULL.
2459                          */
2460                         count = 0;
2461                         break;
2462                 }
2463                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2464                         continue;
2465                 found = sdata;
2466                 count++;
2467         }
2468
2469         if (count == 1 && ieee80211_powersave_allowed(found)) {
2470                 u8 dtimper = found->deflink.u.mgd.dtim_period;
2471
2472                 timeout = local->dynamic_ps_forced_timeout;
2473                 if (timeout < 0)
2474                         timeout = 100;
2475                 local->hw.conf.dynamic_ps_timeout = timeout;
2476
2477                 /* If the TIM IE is invalid, pretend the value is 1 */
2478                 if (!dtimper)
2479                         dtimper = 1;
2480
2481                 local->hw.conf.ps_dtim_period = dtimper;
2482                 local->ps_sdata = found;
2483         } else {
2484                 local->ps_sdata = NULL;
2485         }
2486
2487         ieee80211_change_ps(local);
2488 }
2489
2490 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
2491 {
2492         bool ps_allowed = ieee80211_powersave_allowed(sdata);
2493
2494         if (sdata->vif.cfg.ps != ps_allowed) {
2495                 sdata->vif.cfg.ps = ps_allowed;
2496                 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_PS);
2497         }
2498 }
2499
2500 void ieee80211_dynamic_ps_disable_work(struct wiphy *wiphy,
2501                                        struct wiphy_work *work)
2502 {
2503         struct ieee80211_local *local =
2504                 container_of(work, struct ieee80211_local,
2505                              dynamic_ps_disable_work);
2506
2507         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2508                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2509                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2510         }
2511
2512         ieee80211_wake_queues_by_reason(&local->hw,
2513                                         IEEE80211_MAX_QUEUE_MAP,
2514                                         IEEE80211_QUEUE_STOP_REASON_PS,
2515                                         false);
2516 }
2517
2518 void ieee80211_dynamic_ps_enable_work(struct wiphy *wiphy,
2519                                       struct wiphy_work *work)
2520 {
2521         struct ieee80211_local *local =
2522                 container_of(work, struct ieee80211_local,
2523                              dynamic_ps_enable_work);
2524         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
2525         struct ieee80211_if_managed *ifmgd;
2526         unsigned long flags;
2527         int q;
2528
2529         /* can only happen when PS was just disabled anyway */
2530         if (!sdata)
2531                 return;
2532
2533         ifmgd = &sdata->u.mgd;
2534
2535         if (local->hw.conf.flags & IEEE80211_CONF_PS)
2536                 return;
2537
2538         if (local->hw.conf.dynamic_ps_timeout > 0) {
2539                 /* don't enter PS if TX frames are pending */
2540                 if (drv_tx_frames_pending(local)) {
2541                         mod_timer(&local->dynamic_ps_timer, jiffies +
2542                                   msecs_to_jiffies(
2543                                   local->hw.conf.dynamic_ps_timeout));
2544                         return;
2545                 }
2546
2547                 /*
2548                  * transmission can be stopped by others which leads to
2549                  * dynamic_ps_timer expiry. Postpone the ps timer if it
2550                  * is not the actual idle state.
2551                  */
2552                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2553                 for (q = 0; q < local->hw.queues; q++) {
2554                         if (local->queue_stop_reasons[q]) {
2555                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
2556                                                        flags);
2557                                 mod_timer(&local->dynamic_ps_timer, jiffies +
2558                                           msecs_to_jiffies(
2559                                           local->hw.conf.dynamic_ps_timeout));
2560                                 return;
2561                         }
2562                 }
2563                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2564         }
2565
2566         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2567             !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2568                 if (drv_tx_frames_pending(local)) {
2569                         mod_timer(&local->dynamic_ps_timer, jiffies +
2570                                   msecs_to_jiffies(
2571                                   local->hw.conf.dynamic_ps_timeout));
2572                 } else {
2573                         ieee80211_send_nullfunc(local, sdata, true);
2574                         /* Flush to get the tx status of nullfunc frame */
2575                         ieee80211_flush_queues(local, sdata, false);
2576                 }
2577         }
2578
2579         if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
2580               ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
2581             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2582                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
2583                 local->hw.conf.flags |= IEEE80211_CONF_PS;
2584                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2585         }
2586 }
2587
2588 void ieee80211_dynamic_ps_timer(struct timer_list *t)
2589 {
2590         struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
2591
2592         wiphy_work_queue(local->hw.wiphy, &local->dynamic_ps_enable_work);
2593 }
2594
2595 void ieee80211_dfs_cac_timer_work(struct wiphy *wiphy, struct wiphy_work *work)
2596 {
2597         struct ieee80211_link_data *link =
2598                 container_of(work, struct ieee80211_link_data,
2599                              dfs_cac_timer_work.work);
2600         struct cfg80211_chan_def chandef = link->conf->chanreq.oper;
2601         struct ieee80211_sub_if_data *sdata = link->sdata;
2602
2603         lockdep_assert_wiphy(sdata->local->hw.wiphy);
2604
2605         if (sdata->wdev.cac_started) {
2606                 ieee80211_link_release_channel(link);
2607                 cfg80211_cac_event(sdata->dev, &chandef,
2608                                    NL80211_RADAR_CAC_FINISHED,
2609                                    GFP_KERNEL);
2610         }
2611 }
2612
2613 static bool
2614 __ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2615 {
2616         struct ieee80211_local *local = sdata->local;
2617         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2618         bool ret = false;
2619         int ac;
2620
2621         if (local->hw.queues < IEEE80211_NUM_ACS)
2622                 return false;
2623
2624         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2625                 struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
2626                 int non_acm_ac;
2627                 unsigned long now = jiffies;
2628
2629                 if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
2630                     tx_tspec->admitted_time &&
2631                     time_after(now, tx_tspec->time_slice_start + HZ)) {
2632                         tx_tspec->consumed_tx_time = 0;
2633                         tx_tspec->time_slice_start = now;
2634
2635                         if (tx_tspec->downgraded)
2636                                 tx_tspec->action =
2637                                         TX_TSPEC_ACTION_STOP_DOWNGRADE;
2638                 }
2639
2640                 switch (tx_tspec->action) {
2641                 case TX_TSPEC_ACTION_STOP_DOWNGRADE:
2642                         /* take the original parameters */
2643                         if (drv_conf_tx(local, &sdata->deflink, ac,
2644                                         &sdata->deflink.tx_conf[ac]))
2645                                 link_err(&sdata->deflink,
2646                                          "failed to set TX queue parameters for queue %d\n",
2647                                          ac);
2648                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
2649                         tx_tspec->downgraded = false;
2650                         ret = true;
2651                         break;
2652                 case TX_TSPEC_ACTION_DOWNGRADE:
2653                         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
2654                                 tx_tspec->action = TX_TSPEC_ACTION_NONE;
2655                                 ret = true;
2656                                 break;
2657                         }
2658                         /* downgrade next lower non-ACM AC */
2659                         for (non_acm_ac = ac + 1;
2660                              non_acm_ac < IEEE80211_NUM_ACS;
2661                              non_acm_ac++)
2662                                 if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
2663                                         break;
2664                         /* Usually the loop will result in using BK even if it
2665                          * requires admission control, but such a configuration
2666                          * makes no sense and we have to transmit somehow - the
2667                          * AC selection does the same thing.
2668                          * If we started out trying to downgrade from BK, then
2669                          * the extra condition here might be needed.
2670                          */
2671                         if (non_acm_ac >= IEEE80211_NUM_ACS)
2672                                 non_acm_ac = IEEE80211_AC_BK;
2673                         if (drv_conf_tx(local, &sdata->deflink, ac,
2674                                         &sdata->deflink.tx_conf[non_acm_ac]))
2675                                 link_err(&sdata->deflink,
2676                                          "failed to set TX queue parameters for queue %d\n",
2677                                          ac);
2678                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
2679                         ret = true;
2680                         wiphy_delayed_work_queue(local->hw.wiphy,
2681                                                  &ifmgd->tx_tspec_wk,
2682                                                  tx_tspec->time_slice_start +
2683                                                  HZ - now + 1);
2684                         break;
2685                 case TX_TSPEC_ACTION_NONE:
2686                         /* nothing now */
2687                         break;
2688                 }
2689         }
2690
2691         return ret;
2692 }
2693
2694 void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2695 {
2696         if (__ieee80211_sta_handle_tspec_ac_params(sdata))
2697                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
2698                                                   BSS_CHANGED_QOS);
2699 }
2700
2701 static void ieee80211_sta_handle_tspec_ac_params_wk(struct wiphy *wiphy,
2702                                                     struct wiphy_work *work)
2703 {
2704         struct ieee80211_sub_if_data *sdata;
2705
2706         sdata = container_of(work, struct ieee80211_sub_if_data,
2707                              u.mgd.tx_tspec_wk.work);
2708         ieee80211_sta_handle_tspec_ac_params(sdata);
2709 }
2710
2711 void ieee80211_mgd_set_link_qos_params(struct ieee80211_link_data *link)
2712 {
2713         struct ieee80211_sub_if_data *sdata = link->sdata;
2714         struct ieee80211_local *local = sdata->local;
2715         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2716         struct ieee80211_tx_queue_params *params = link->tx_conf;
2717         u8 ac;
2718
2719         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2720                 mlme_dbg(sdata,
2721                          "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
2722                          ac, params[ac].acm,
2723                          params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
2724                          params[ac].txop, params[ac].uapsd,
2725                          ifmgd->tx_tspec[ac].downgraded);
2726                 if (!ifmgd->tx_tspec[ac].downgraded &&
2727                     drv_conf_tx(local, link, ac, &params[ac]))
2728                         link_err(link,
2729                                  "failed to set TX queue parameters for AC %d\n",
2730                                  ac);
2731         }
2732 }
2733
2734 /* MLME */
2735 static bool
2736 ieee80211_sta_wmm_params(struct ieee80211_local *local,
2737                          struct ieee80211_link_data *link,
2738                          const u8 *wmm_param, size_t wmm_param_len,
2739                          const struct ieee80211_mu_edca_param_set *mu_edca)
2740 {
2741         struct ieee80211_sub_if_data *sdata = link->sdata;
2742         struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
2743         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2744         size_t left;
2745         int count, mu_edca_count, ac;
2746         const u8 *pos;
2747         u8 uapsd_queues = 0;
2748
2749         if (!local->ops->conf_tx)
2750                 return false;
2751
2752         if (local->hw.queues < IEEE80211_NUM_ACS)
2753                 return false;
2754
2755         if (!wmm_param)
2756                 return false;
2757
2758         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
2759                 return false;
2760
2761         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
2762                 uapsd_queues = ifmgd->uapsd_queues;
2763
2764         count = wmm_param[6] & 0x0f;
2765         /* -1 is the initial value of ifmgd->mu_edca_last_param_set.
2766          * if mu_edca was preset before and now it disappeared tell
2767          * the driver about it.
2768          */
2769         mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
2770         if (count == link->u.mgd.wmm_last_param_set &&
2771             mu_edca_count == link->u.mgd.mu_edca_last_param_set)
2772                 return false;
2773         link->u.mgd.wmm_last_param_set = count;
2774         link->u.mgd.mu_edca_last_param_set = mu_edca_count;
2775
2776         pos = wmm_param + 8;
2777         left = wmm_param_len - 8;
2778
2779         memset(&params, 0, sizeof(params));
2780
2781         sdata->wmm_acm = 0;
2782         for (; left >= 4; left -= 4, pos += 4) {
2783                 int aci = (pos[0] >> 5) & 0x03;
2784                 int acm = (pos[0] >> 4) & 0x01;
2785                 bool uapsd = false;
2786
2787                 switch (aci) {
2788                 case 1: /* AC_BK */
2789                         ac = IEEE80211_AC_BK;
2790                         if (acm)
2791                                 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
2792                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
2793                                 uapsd = true;
2794                         params[ac].mu_edca = !!mu_edca;
2795                         if (mu_edca)
2796                                 params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2797                         break;
2798                 case 2: /* AC_VI */
2799                         ac = IEEE80211_AC_VI;
2800                         if (acm)
2801                                 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
2802                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
2803                                 uapsd = true;
2804                         params[ac].mu_edca = !!mu_edca;
2805                         if (mu_edca)
2806                                 params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2807                         break;
2808                 case 3: /* AC_VO */
2809                         ac = IEEE80211_AC_VO;
2810                         if (acm)
2811                                 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
2812                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
2813                                 uapsd = true;
2814                         params[ac].mu_edca = !!mu_edca;
2815                         if (mu_edca)
2816                                 params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2817                         break;
2818                 case 0: /* AC_BE */
2819                 default:
2820                         ac = IEEE80211_AC_BE;
2821                         if (acm)
2822                                 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
2823                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
2824                                 uapsd = true;
2825                         params[ac].mu_edca = !!mu_edca;
2826                         if (mu_edca)
2827                                 params[ac].mu_edca_param_rec = mu_edca->ac_be;
2828                         break;
2829                 }
2830
2831                 params[ac].aifs = pos[0] & 0x0f;
2832
2833                 if (params[ac].aifs < 2) {
2834                         link_info(link,
2835                                   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2836                                   params[ac].aifs, aci);
2837                         params[ac].aifs = 2;
2838                 }
2839                 params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
2840                 params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
2841                 params[ac].txop = get_unaligned_le16(pos + 2);
2842                 params[ac].acm = acm;
2843                 params[ac].uapsd = uapsd;
2844
2845                 if (params[ac].cw_min == 0 ||
2846                     params[ac].cw_min > params[ac].cw_max) {
2847                         link_info(link,
2848                                   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
2849                                   params[ac].cw_min, params[ac].cw_max, aci);
2850                         return false;
2851                 }
2852                 ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2853         }
2854
2855         /* WMM specification requires all 4 ACIs. */
2856         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2857                 if (params[ac].cw_min == 0) {
2858                         link_info(link,
2859                                   "AP has invalid WMM params (missing AC %d), using defaults\n",
2860                                   ac);
2861                         return false;
2862                 }
2863         }
2864
2865         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2866                 link->tx_conf[ac] = params[ac];
2867
2868         ieee80211_mgd_set_link_qos_params(link);
2869
2870         /* enable WMM or activate new settings */
2871         link->conf->qos = true;
2872         return true;
2873 }
2874
2875 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2876 {
2877         lockdep_assert_wiphy(sdata->local->hw.wiphy);
2878
2879         sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2880         ieee80211_run_deferred_scan(sdata->local);
2881 }
2882
2883 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2884 {
2885         lockdep_assert_wiphy(sdata->local->hw.wiphy);
2886
2887         __ieee80211_stop_poll(sdata);
2888 }
2889
2890 static u64 ieee80211_handle_bss_capability(struct ieee80211_link_data *link,
2891                                            u16 capab, bool erp_valid, u8 erp)
2892 {
2893         struct ieee80211_bss_conf *bss_conf = link->conf;
2894         struct ieee80211_supported_band *sband;
2895         u64 changed = 0;
2896         bool use_protection;
2897         bool use_short_preamble;
2898         bool use_short_slot;
2899
2900         sband = ieee80211_get_link_sband(link);
2901         if (!sband)
2902                 return changed;
2903
2904         if (erp_valid) {
2905                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
2906                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
2907         } else {
2908                 use_protection = false;
2909                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
2910         }
2911
2912         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2913         if (sband->band == NL80211_BAND_5GHZ ||
2914             sband->band == NL80211_BAND_6GHZ)
2915                 use_short_slot = true;
2916
2917         if (use_protection != bss_conf->use_cts_prot) {
2918                 bss_conf->use_cts_prot = use_protection;
2919                 changed |= BSS_CHANGED_ERP_CTS_PROT;
2920         }
2921
2922         if (use_short_preamble != bss_conf->use_short_preamble) {
2923                 bss_conf->use_short_preamble = use_short_preamble;
2924                 changed |= BSS_CHANGED_ERP_PREAMBLE;
2925         }
2926
2927         if (use_short_slot != bss_conf->use_short_slot) {
2928                 bss_conf->use_short_slot = use_short_slot;
2929                 changed |= BSS_CHANGED_ERP_SLOT;
2930         }
2931
2932         return changed;
2933 }
2934
2935 static u64 ieee80211_link_set_associated(struct ieee80211_link_data *link,
2936                                          struct cfg80211_bss *cbss)
2937 {
2938         struct ieee80211_sub_if_data *sdata = link->sdata;
2939         struct ieee80211_bss_conf *bss_conf = link->conf;
2940         struct ieee80211_bss *bss = (void *)cbss->priv;
2941         u64 changed = BSS_CHANGED_QOS;
2942
2943         /* not really used in MLO */
2944         sdata->u.mgd.beacon_timeout =
2945                 usecs_to_jiffies(ieee80211_tu_to_usec(beacon_loss_count *
2946                                                       bss_conf->beacon_int));
2947
2948         changed |= ieee80211_handle_bss_capability(link,
2949                                                    bss_conf->assoc_capability,
2950                                                    bss->has_erp_value,
2951                                                    bss->erp_value);
2952
2953         ieee80211_check_rate_mask(link);
2954
2955         link->conf->bss = cbss;
2956         memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2957
2958         if (sdata->vif.p2p ||
2959             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2960                 const struct cfg80211_bss_ies *ies;
2961
2962                 rcu_read_lock();
2963                 ies = rcu_dereference(cbss->ies);
2964                 if (ies) {
2965                         int ret;
2966
2967                         ret = cfg80211_get_p2p_attr(
2968                                         ies->data, ies->len,
2969                                         IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
2970                                         (u8 *) &bss_conf->p2p_noa_attr,
2971                                         sizeof(bss_conf->p2p_noa_attr));
2972                         if (ret >= 2) {
2973                                 link->u.mgd.p2p_noa_index =
2974                                         bss_conf->p2p_noa_attr.index;
2975                                 changed |= BSS_CHANGED_P2P_PS;
2976                         }
2977                 }
2978                 rcu_read_unlock();
2979         }
2980
2981         if (link->u.mgd.have_beacon) {
2982                 bss_conf->beacon_rate = bss->beacon_rate;
2983                 changed |= BSS_CHANGED_BEACON_INFO;
2984         } else {
2985                 bss_conf->beacon_rate = NULL;
2986         }
2987
2988         /* Tell the driver to monitor connection quality (if supported) */
2989         if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2990             bss_conf->cqm_rssi_thold)
2991                 changed |= BSS_CHANGED_CQM;
2992
2993         return changed;
2994 }
2995
2996 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2997                                      struct ieee80211_mgd_assoc_data *assoc_data,
2998                                      u64 changed[IEEE80211_MLD_MAX_NUM_LINKS])
2999 {
3000         struct ieee80211_local *local = sdata->local;
3001         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
3002         u64 vif_changed = BSS_CHANGED_ASSOC;
3003         unsigned int link_id;
3004
3005         lockdep_assert_wiphy(local->hw.wiphy);
3006
3007         sdata->u.mgd.associated = true;
3008
3009         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
3010                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
3011                 struct ieee80211_link_data *link;
3012
3013                 if (!cbss ||
3014                     assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
3015                         continue;
3016
3017                 if (ieee80211_vif_is_mld(&sdata->vif) &&
3018                     !(ieee80211_vif_usable_links(&sdata->vif) & BIT(link_id)))
3019                         continue;
3020
3021                 link = sdata_dereference(sdata->link[link_id], sdata);
3022                 if (WARN_ON(!link))
3023                         return;
3024
3025                 changed[link_id] |= ieee80211_link_set_associated(link, cbss);
3026         }
3027
3028         /* just to be sure */
3029         ieee80211_stop_poll(sdata);
3030
3031         ieee80211_led_assoc(local, 1);
3032
3033         vif_cfg->assoc = 1;
3034
3035         /* Enable ARP filtering */
3036         if (vif_cfg->arp_addr_cnt)
3037                 vif_changed |= BSS_CHANGED_ARP_FILTER;
3038
3039         if (ieee80211_vif_is_mld(&sdata->vif)) {
3040                 for (link_id = 0;
3041                      link_id < IEEE80211_MLD_MAX_NUM_LINKS;
3042                      link_id++) {
3043                         struct ieee80211_link_data *link;
3044                         struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
3045
3046                         if (!cbss ||
3047                             !(BIT(link_id) &
3048                               ieee80211_vif_usable_links(&sdata->vif)) ||
3049                             assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
3050                                 continue;
3051
3052                         link = sdata_dereference(sdata->link[link_id], sdata);
3053                         if (WARN_ON(!link))
3054                                 return;
3055
3056                         ieee80211_link_info_change_notify(sdata, link,
3057                                                           changed[link_id]);
3058
3059                         ieee80211_recalc_smps(sdata, link);
3060                 }
3061
3062                 ieee80211_vif_cfg_change_notify(sdata, vif_changed);
3063         } else {
3064                 ieee80211_bss_info_change_notify(sdata,
3065                                                  vif_changed | changed[0]);
3066         }
3067
3068         ieee80211_recalc_ps(local);
3069
3070         /* leave this here to not change ordering in non-MLO cases */
3071         if (!ieee80211_vif_is_mld(&sdata->vif))
3072                 ieee80211_recalc_smps(sdata, &sdata->deflink);
3073         ieee80211_recalc_ps_vif(sdata);
3074
3075         netif_carrier_on(sdata->dev);
3076 }
3077
3078 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
3079                                    u16 stype, u16 reason, bool tx,
3080                                    u8 *frame_buf)
3081 {
3082         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3083         struct ieee80211_local *local = sdata->local;
3084         unsigned int link_id;
3085         u64 changed = 0;
3086         struct ieee80211_prep_tx_info info = {
3087                 .subtype = stype,
3088         };
3089
3090         lockdep_assert_wiphy(local->hw.wiphy);
3091
3092         if (WARN_ON_ONCE(tx && !frame_buf))
3093                 return;
3094
3095         if (WARN_ON(!ifmgd->associated))
3096                 return;
3097
3098         ieee80211_stop_poll(sdata);
3099
3100         ifmgd->associated = false;
3101
3102         /* other links will be destroyed */
3103         sdata->deflink.conf->bss = NULL;
3104         sdata->deflink.smps_mode = IEEE80211_SMPS_OFF;
3105
3106         netif_carrier_off(sdata->dev);
3107
3108         /*
3109          * if we want to get out of ps before disassoc (why?) we have
3110          * to do it before sending disassoc, as otherwise the null-packet
3111          * won't be valid.
3112          */
3113         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
3114                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
3115                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
3116         }
3117         local->ps_sdata = NULL;
3118
3119         /* disable per-vif ps */
3120         ieee80211_recalc_ps_vif(sdata);
3121
3122         /* make sure ongoing transmission finishes */
3123         synchronize_net();
3124
3125         /*
3126          * drop any frame before deauth/disassoc, this can be data or
3127          * management frame. Since we are disconnecting, we should not
3128          * insist sending these frames which can take time and delay
3129          * the disconnection and possible the roaming.
3130          */
3131         if (tx)
3132                 ieee80211_flush_queues(local, sdata, true);
3133
3134         /* deauthenticate/disassociate now */
3135         if (tx || frame_buf) {
3136                 /*
3137                  * In multi channel scenarios guarantee that the virtual
3138                  * interface is granted immediate airtime to transmit the
3139                  * deauthentication frame by calling mgd_prepare_tx, if the
3140                  * driver requested so.
3141                  */
3142                 if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP)) {
3143                         for (link_id = 0; link_id < ARRAY_SIZE(sdata->link);
3144                              link_id++) {
3145                                 struct ieee80211_link_data *link;
3146
3147                                 link = sdata_dereference(sdata->link[link_id],
3148                                                          sdata);
3149                                 if (!link)
3150                                         continue;
3151                                 if (link->u.mgd.have_beacon)
3152                                         break;
3153                         }
3154                         if (link_id == IEEE80211_MLD_MAX_NUM_LINKS) {
3155                                 info.link_id = ffs(sdata->vif.active_links) - 1;
3156                                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
3157                         }
3158                 }
3159
3160                 ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr,
3161                                                sdata->vif.cfg.ap_addr, stype,
3162                                                reason, tx, frame_buf);
3163         }
3164
3165         /* flush out frame - make sure the deauth was actually sent */
3166         if (tx)
3167                 ieee80211_flush_queues(local, sdata, false);
3168
3169         drv_mgd_complete_tx(sdata->local, sdata, &info);
3170
3171         /* clear AP addr only after building the needed mgmt frames */
3172         eth_zero_addr(sdata->deflink.u.mgd.bssid);
3173         eth_zero_addr(sdata->vif.cfg.ap_addr);
3174
3175         sdata->vif.cfg.ssid_len = 0;
3176
3177         /* remove AP and TDLS peers */
3178         sta_info_flush(sdata, -1);
3179
3180         /* finally reset all BSS / config parameters */
3181         if (!ieee80211_vif_is_mld(&sdata->vif))
3182                 changed |= ieee80211_reset_erp_info(sdata);
3183
3184         ieee80211_led_assoc(local, 0);
3185         changed |= BSS_CHANGED_ASSOC;
3186         sdata->vif.cfg.assoc = false;
3187
3188         sdata->deflink.u.mgd.p2p_noa_index = -1;
3189         memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
3190                sizeof(sdata->vif.bss_conf.p2p_noa_attr));
3191
3192         /* on the next assoc, re-program HT/VHT parameters */
3193         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
3194         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
3195         memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
3196         memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
3197
3198         /*
3199          * reset MU-MIMO ownership and group data in default link,
3200          * if used, other links are destroyed
3201          */
3202         memset(sdata->vif.bss_conf.mu_group.membership, 0,
3203                sizeof(sdata->vif.bss_conf.mu_group.membership));
3204         memset(sdata->vif.bss_conf.mu_group.position, 0,
3205                sizeof(sdata->vif.bss_conf.mu_group.position));
3206         if (!ieee80211_vif_is_mld(&sdata->vif))
3207                 changed |= BSS_CHANGED_MU_GROUPS;
3208         sdata->vif.bss_conf.mu_mimo_owner = false;
3209
3210         sdata->deflink.ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
3211
3212         del_timer_sync(&local->dynamic_ps_timer);
3213         wiphy_work_cancel(local->hw.wiphy, &local->dynamic_ps_enable_work);
3214
3215         /* Disable ARP filtering */
3216         if (sdata->vif.cfg.arp_addr_cnt)
3217                 changed |= BSS_CHANGED_ARP_FILTER;
3218
3219         sdata->vif.bss_conf.qos = false;
3220         if (!ieee80211_vif_is_mld(&sdata->vif)) {
3221                 changed |= BSS_CHANGED_QOS;
3222                 /* The BSSID (not really interesting) and HT changed */
3223                 changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
3224                 ieee80211_bss_info_change_notify(sdata, changed);
3225         } else {
3226                 ieee80211_vif_cfg_change_notify(sdata, changed);
3227         }
3228
3229         /* disassociated - set to defaults now */
3230         ieee80211_set_wmm_default(&sdata->deflink, false, false);
3231
3232         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
3233         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
3234         del_timer_sync(&sdata->u.mgd.timer);
3235
3236         sdata->vif.bss_conf.dtim_period = 0;
3237         sdata->vif.bss_conf.beacon_rate = NULL;
3238
3239         sdata->deflink.u.mgd.have_beacon = false;
3240         sdata->deflink.u.mgd.tracking_signal_avg = false;
3241         sdata->deflink.u.mgd.disable_wmm_tracking = false;
3242
3243         ifmgd->flags = 0;
3244
3245         for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
3246                 struct ieee80211_link_data *link;
3247
3248                 link = sdata_dereference(sdata->link[link_id], sdata);
3249                 if (!link)
3250                         continue;
3251                 ieee80211_link_release_channel(link);
3252         }
3253
3254         sdata->vif.bss_conf.csa_active = false;
3255         sdata->deflink.u.mgd.csa_waiting_bcn = false;
3256         sdata->deflink.u.mgd.csa_ignored_same_chan = false;
3257         if (sdata->csa_blocked_tx) {
3258                 ieee80211_wake_vif_queues(local, sdata,
3259                                           IEEE80211_QUEUE_STOP_REASON_CSA);
3260                 sdata->csa_blocked_tx = false;
3261         }
3262
3263         /* existing TX TSPEC sessions no longer exist */
3264         memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
3265         wiphy_delayed_work_cancel(local->hw.wiphy, &ifmgd->tx_tspec_wk);
3266
3267         sdata->vif.bss_conf.power_type = IEEE80211_REG_UNSET_AP;
3268         sdata->vif.bss_conf.pwr_reduction = 0;
3269         sdata->vif.bss_conf.tx_pwr_env_num = 0;
3270         memset(sdata->vif.bss_conf.tx_pwr_env, 0,
3271                sizeof(sdata->vif.bss_conf.tx_pwr_env));
3272
3273         sdata->vif.cfg.eml_cap = 0;
3274         sdata->vif.cfg.eml_med_sync_delay = 0;
3275         sdata->vif.cfg.mld_capa_op = 0;
3276
3277         memset(&sdata->u.mgd.ttlm_info, 0,
3278                sizeof(sdata->u.mgd.ttlm_info));
3279         wiphy_delayed_work_cancel(sdata->local->hw.wiphy, &ifmgd->ttlm_work);
3280
3281         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
3282                                   &ifmgd->neg_ttlm_timeout_work);
3283         ieee80211_vif_set_links(sdata, 0, 0);
3284
3285         ifmgd->mcast_seq_last = IEEE80211_SN_MODULO;
3286 }
3287
3288 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
3289 {
3290         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3291         struct ieee80211_local *local = sdata->local;
3292
3293         lockdep_assert_wiphy(local->hw.wiphy);
3294
3295         if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
3296                 return;
3297
3298         __ieee80211_stop_poll(sdata);
3299
3300         ieee80211_recalc_ps(local);
3301
3302         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
3303                 return;
3304
3305         /*
3306          * We've received a probe response, but are not sure whether
3307          * we have or will be receiving any beacons or data, so let's
3308          * schedule the timers again, just in case.
3309          */
3310         ieee80211_sta_reset_beacon_monitor(sdata);
3311
3312         mod_timer(&ifmgd->conn_mon_timer,
3313                   round_jiffies_up(jiffies +
3314                                    IEEE80211_CONNECTION_IDLE_TIME));
3315 }
3316
3317 static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
3318                                            struct ieee80211_hdr *hdr,
3319                                            u16 tx_time)
3320 {
3321         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3322         u16 tid;
3323         int ac;
3324         struct ieee80211_sta_tx_tspec *tx_tspec;
3325         unsigned long now = jiffies;
3326
3327         if (!ieee80211_is_data_qos(hdr->frame_control))
3328                 return;
3329
3330         tid = ieee80211_get_tid(hdr);
3331         ac = ieee80211_ac_from_tid(tid);
3332         tx_tspec = &ifmgd->tx_tspec[ac];
3333
3334         if (likely(!tx_tspec->admitted_time))
3335                 return;
3336
3337         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
3338                 tx_tspec->consumed_tx_time = 0;
3339                 tx_tspec->time_slice_start = now;
3340
3341                 if (tx_tspec->downgraded) {
3342                         tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
3343                         wiphy_delayed_work_queue(sdata->local->hw.wiphy,
3344                                                  &ifmgd->tx_tspec_wk, 0);
3345                 }
3346         }
3347
3348         if (tx_tspec->downgraded)
3349                 return;
3350
3351         tx_tspec->consumed_tx_time += tx_time;
3352
3353         if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
3354                 tx_tspec->downgraded = true;
3355                 tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
3356                 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
3357                                          &ifmgd->tx_tspec_wk, 0);
3358         }
3359 }
3360
3361 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
3362                              struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
3363 {
3364         ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
3365
3366         if (!ieee80211_is_any_nullfunc(hdr->frame_control) ||
3367             !sdata->u.mgd.probe_send_count)
3368                 return;
3369
3370         if (ack)
3371                 sdata->u.mgd.probe_send_count = 0;
3372         else
3373                 sdata->u.mgd.nullfunc_failed = true;
3374         wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
3375 }
3376
3377 static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
3378                                           const u8 *src, const u8 *dst,
3379                                           const u8 *ssid, size_t ssid_len,
3380                                           struct ieee80211_channel *channel)
3381 {
3382         struct sk_buff *skb;
3383
3384         skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
3385                                         ssid, ssid_len, NULL, 0,
3386                                         IEEE80211_PROBE_FLAG_DIRECTED);
3387         if (skb)
3388                 ieee80211_tx_skb(sdata, skb);
3389 }
3390
3391 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
3392 {
3393         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3394         u8 *dst = sdata->vif.cfg.ap_addr;
3395         u8 unicast_limit = max(1, max_probe_tries - 3);
3396         struct sta_info *sta;
3397
3398         lockdep_assert_wiphy(sdata->local->hw.wiphy);
3399
3400         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
3401                 return;
3402
3403         /*
3404          * Try sending broadcast probe requests for the last three
3405          * probe requests after the first ones failed since some
3406          * buggy APs only support broadcast probe requests.
3407          */
3408         if (ifmgd->probe_send_count >= unicast_limit)
3409                 dst = NULL;
3410
3411         /*
3412          * When the hardware reports an accurate Tx ACK status, it's
3413          * better to send a nullfunc frame instead of a probe request,
3414          * as it will kick us off the AP quickly if we aren't associated
3415          * anymore. The timeout will be reset if the frame is ACKed by
3416          * the AP.
3417          */
3418         ifmgd->probe_send_count++;
3419
3420         if (dst) {
3421                 sta = sta_info_get(sdata, dst);
3422                 if (!WARN_ON(!sta))
3423                         ieee80211_check_fast_rx(sta);
3424         }
3425
3426         if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
3427                 ifmgd->nullfunc_failed = false;
3428                 ieee80211_send_nullfunc(sdata->local, sdata, false);
3429         } else {
3430                 ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
3431                                               sdata->vif.cfg.ssid,
3432                                               sdata->vif.cfg.ssid_len,
3433                                               sdata->deflink.conf->bss->channel);
3434         }
3435
3436         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
3437         run_again(sdata, ifmgd->probe_timeout);
3438 }
3439
3440 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
3441                                    bool beacon)
3442 {
3443         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3444         bool already = false;
3445
3446         lockdep_assert_wiphy(sdata->local->hw.wiphy);
3447
3448         if (WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif)))
3449                 return;
3450
3451         if (!ieee80211_sdata_running(sdata))
3452                 return;
3453
3454         if (!ifmgd->associated)
3455                 return;
3456
3457         if (sdata->local->tmp_channel || sdata->local->scanning)
3458                 return;
3459
3460         if (sdata->local->suspending) {
3461                 /* reschedule after resume */
3462                 ieee80211_reset_ap_probe(sdata);
3463                 return;
3464         }
3465
3466         if (beacon) {
3467                 mlme_dbg_ratelimited(sdata,
3468                                      "detected beacon loss from AP (missed %d beacons) - probing\n",
3469                                      beacon_loss_count);
3470
3471                 ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
3472         }
3473
3474         /*
3475          * The driver/our work has already reported this event or the
3476          * connection monitoring has kicked in and we have already sent
3477          * a probe request. Or maybe the AP died and the driver keeps
3478          * reporting until we disassociate...
3479          *
3480          * In either case we have to ignore the current call to this
3481          * function (except for setting the correct probe reason bit)
3482          * because otherwise we would reset the timer every time and
3483          * never check whether we received a probe response!
3484          */
3485         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
3486                 already = true;
3487
3488         ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
3489
3490         if (already)
3491                 return;
3492
3493         ieee80211_recalc_ps(sdata->local);
3494
3495         ifmgd->probe_send_count = 0;
3496         ieee80211_mgd_probe_ap_send(sdata);
3497 }
3498
3499 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
3500                                           struct ieee80211_vif *vif)
3501 {
3502         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3503         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3504         struct cfg80211_bss *cbss;
3505         struct sk_buff *skb;
3506         const struct element *ssid;
3507         int ssid_len;
3508
3509         lockdep_assert_wiphy(sdata->local->hw.wiphy);
3510
3511         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
3512                     ieee80211_vif_is_mld(&sdata->vif)))
3513                 return NULL;
3514
3515         if (ifmgd->associated)
3516                 cbss = sdata->deflink.conf->bss;
3517         else if (ifmgd->auth_data)
3518                 cbss = ifmgd->auth_data->bss;
3519         else if (ifmgd->assoc_data && ifmgd->assoc_data->link[0].bss)
3520                 cbss = ifmgd->assoc_data->link[0].bss;
3521         else
3522                 return NULL;
3523
3524         rcu_read_lock();
3525         ssid = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
3526         if (WARN_ONCE(!ssid || ssid->datalen > IEEE80211_MAX_SSID_LEN,
3527                       "invalid SSID element (len=%d)",
3528                       ssid ? ssid->datalen : -1))
3529                 ssid_len = 0;
3530         else
3531                 ssid_len = ssid->datalen;
3532
3533         skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
3534                                         (u32) -1, cbss->channel,
3535                                         ssid->data, ssid_len,
3536                                         NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
3537         rcu_read_unlock();
3538
3539         return skb;
3540 }
3541 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
3542
3543 static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
3544                                         const u8 *buf, size_t len, bool tx,
3545                                         u16 reason, bool reconnect)
3546 {
3547         struct ieee80211_event event = {
3548                 .type = MLME_EVENT,
3549                 .u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
3550                 .u.mlme.reason = reason,
3551         };
3552
3553         if (tx)
3554                 cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
3555         else
3556                 cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
3557
3558         drv_event_callback(sdata->local, sdata, &event);
3559 }
3560
3561 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
3562 {
3563         struct ieee80211_local *local = sdata->local;
3564         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3565         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3566         bool tx;
3567
3568         lockdep_assert_wiphy(local->hw.wiphy);
3569
3570         if (!ifmgd->associated)
3571                 return;
3572
3573         /*
3574          * MLO drivers should have HANDLES_QUIET_CSA, so that csa_blocked_tx
3575          * is always false; if they don't then this may try to transmit the
3576          * frame but queues will be stopped.
3577          */
3578         tx = !sdata->csa_blocked_tx;
3579
3580         if (!ifmgd->driver_disconnect) {
3581                 unsigned int link_id;
3582
3583                 /*
3584                  * AP is probably out of range (or not reachable for another
3585                  * reason) so remove the bss structs for that AP. In the case
3586                  * of multi-link, it's not clear that all of them really are
3587                  * out of range, but if they weren't the driver likely would
3588                  * have switched to just have a single link active?
3589                  */
3590                 for (link_id = 0;
3591                      link_id < ARRAY_SIZE(sdata->link);
3592                      link_id++) {
3593                         struct ieee80211_link_data *link;
3594
3595                         link = sdata_dereference(sdata->link[link_id], sdata);
3596                         if (!link)
3597                                 continue;
3598                         cfg80211_unlink_bss(local->hw.wiphy, link->conf->bss);
3599                         link->conf->bss = NULL;
3600                 }
3601         }
3602
3603         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3604                                ifmgd->driver_disconnect ?
3605                                         WLAN_REASON_DEAUTH_LEAVING :
3606                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3607                                tx, frame_buf);
3608         /* the other links will be destroyed */
3609         sdata->vif.bss_conf.csa_active = false;
3610         sdata->deflink.u.mgd.csa_waiting_bcn = false;
3611         if (sdata->csa_blocked_tx) {
3612                 ieee80211_wake_vif_queues(local, sdata,
3613                                           IEEE80211_QUEUE_STOP_REASON_CSA);
3614                 sdata->csa_blocked_tx = false;
3615         }
3616
3617         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
3618                                     WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3619                                     ifmgd->reconnect);
3620         ifmgd->reconnect = false;
3621 }
3622
3623 static void ieee80211_beacon_connection_loss_work(struct wiphy *wiphy,
3624                                                   struct wiphy_work *work)
3625 {
3626         struct ieee80211_sub_if_data *sdata =
3627                 container_of(work, struct ieee80211_sub_if_data,
3628                              u.mgd.beacon_connection_loss_work);
3629         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3630
3631         if (ifmgd->connection_loss) {
3632                 sdata_info(sdata, "Connection to AP %pM lost\n",
3633                            sdata->vif.cfg.ap_addr);
3634                 __ieee80211_disconnect(sdata);
3635                 ifmgd->connection_loss = false;
3636         } else if (ifmgd->driver_disconnect) {
3637                 sdata_info(sdata,
3638                            "Driver requested disconnection from AP %pM\n",
3639                            sdata->vif.cfg.ap_addr);
3640                 __ieee80211_disconnect(sdata);
3641                 ifmgd->driver_disconnect = false;
3642         } else {
3643                 if (ifmgd->associated)
3644                         sdata->deflink.u.mgd.beacon_loss_count++;
3645                 ieee80211_mgd_probe_ap(sdata, true);
3646         }
3647 }
3648
3649 static void ieee80211_csa_connection_drop_work(struct wiphy *wiphy,
3650                                                struct wiphy_work *work)
3651 {
3652         struct ieee80211_sub_if_data *sdata =
3653                 container_of(work, struct ieee80211_sub_if_data,
3654                              u.mgd.csa_connection_drop_work);
3655
3656         __ieee80211_disconnect(sdata);
3657 }
3658
3659 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
3660 {
3661         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3662         struct ieee80211_hw *hw = &sdata->local->hw;
3663
3664         trace_api_beacon_loss(sdata);
3665
3666         sdata->u.mgd.connection_loss = false;
3667         wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3668 }
3669 EXPORT_SYMBOL(ieee80211_beacon_loss);
3670
3671 void ieee80211_connection_loss(struct ieee80211_vif *vif)
3672 {
3673         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3674         struct ieee80211_hw *hw = &sdata->local->hw;
3675
3676         trace_api_connection_loss(sdata);
3677
3678         sdata->u.mgd.connection_loss = true;
3679         wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3680 }
3681 EXPORT_SYMBOL(ieee80211_connection_loss);
3682
3683 void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
3684 {
3685         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3686         struct ieee80211_hw *hw = &sdata->local->hw;
3687
3688         trace_api_disconnect(sdata, reconnect);
3689
3690         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
3691                 return;
3692
3693         sdata->u.mgd.driver_disconnect = true;
3694         sdata->u.mgd.reconnect = reconnect;
3695         wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3696 }
3697 EXPORT_SYMBOL(ieee80211_disconnect);
3698
3699 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
3700                                         bool assoc)
3701 {
3702         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3703
3704         lockdep_assert_wiphy(sdata->local->hw.wiphy);
3705
3706         if (!assoc) {
3707                 /*
3708                  * we are not authenticated yet, the only timer that could be
3709                  * running is the timeout for the authentication response which
3710                  * which is not relevant anymore.
3711                  */
3712                 del_timer_sync(&sdata->u.mgd.timer);
3713                 sta_info_destroy_addr(sdata, auth_data->ap_addr);
3714
3715                 /* other links are destroyed */
3716                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
3717                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3718                                                   BSS_CHANGED_BSSID);
3719                 sdata->u.mgd.flags = 0;
3720
3721                 ieee80211_link_release_channel(&sdata->deflink);
3722                 ieee80211_vif_set_links(sdata, 0, 0);
3723         }
3724
3725         cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
3726         kfree(auth_data);
3727         sdata->u.mgd.auth_data = NULL;
3728 }
3729
3730 enum assoc_status {
3731         ASSOC_SUCCESS,
3732         ASSOC_REJECTED,
3733         ASSOC_TIMEOUT,
3734         ASSOC_ABANDON,
3735 };
3736
3737 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
3738                                          enum assoc_status status)
3739 {
3740         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3741
3742         lockdep_assert_wiphy(sdata->local->hw.wiphy);
3743
3744         if (status != ASSOC_SUCCESS) {
3745                 /*
3746                  * we are not associated yet, the only timer that could be
3747                  * running is the timeout for the association response which
3748                  * which is not relevant anymore.
3749                  */
3750                 del_timer_sync(&sdata->u.mgd.timer);
3751                 sta_info_destroy_addr(sdata, assoc_data->ap_addr);
3752
3753                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
3754                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3755                                                   BSS_CHANGED_BSSID);
3756                 sdata->u.mgd.flags = 0;
3757                 sdata->vif.bss_conf.mu_mimo_owner = false;
3758
3759                 if (status != ASSOC_REJECTED) {
3760                         struct cfg80211_assoc_failure data = {
3761                                 .timeout = status == ASSOC_TIMEOUT,
3762                         };
3763                         int i;
3764
3765                         BUILD_BUG_ON(ARRAY_SIZE(data.bss) !=
3766                                      ARRAY_SIZE(assoc_data->link));
3767
3768                         for (i = 0; i < ARRAY_SIZE(data.bss); i++)
3769                                 data.bss[i] = assoc_data->link[i].bss;
3770
3771                         if (ieee80211_vif_is_mld(&sdata->vif))
3772                                 data.ap_mld_addr = assoc_data->ap_addr;
3773
3774                         cfg80211_assoc_failure(sdata->dev, &data);
3775                 }
3776
3777                 ieee80211_link_release_channel(&sdata->deflink);
3778                 ieee80211_vif_set_links(sdata, 0, 0);
3779         }
3780
3781         kfree(assoc_data);
3782         sdata->u.mgd.assoc_data = NULL;
3783 }
3784
3785 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
3786                                      struct ieee80211_mgmt *mgmt, size_t len)
3787 {
3788         struct ieee80211_local *local = sdata->local;
3789         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3790         const struct element *challenge;
3791         u8 *pos;
3792         u32 tx_flags = 0;
3793         struct ieee80211_prep_tx_info info = {
3794                 .subtype = IEEE80211_STYPE_AUTH,
3795                 .link_id = auth_data->link_id,
3796         };
3797
3798         pos = mgmt->u.auth.variable;
3799         challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
3800                                        len - (pos - (u8 *)mgmt));
3801         if (!challenge)
3802                 return;
3803         auth_data->expected_transaction = 4;
3804         drv_mgd_prepare_tx(sdata->local, sdata, &info);
3805         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3806                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3807                            IEEE80211_TX_INTFL_MLME_CONN_TX;
3808         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
3809                             (void *)challenge,
3810                             challenge->datalen + sizeof(*challenge),
3811                             auth_data->ap_addr, auth_data->ap_addr,
3812                             auth_data->key, auth_data->key_len,
3813                             auth_data->key_idx, tx_flags);
3814 }
3815
3816 static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata)
3817 {
3818         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3819         const u8 *ap_addr = ifmgd->auth_data->ap_addr;
3820         struct sta_info *sta;
3821
3822         lockdep_assert_wiphy(sdata->local->hw.wiphy);
3823
3824         sdata_info(sdata, "authenticated\n");
3825         ifmgd->auth_data->done = true;
3826         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
3827         ifmgd->auth_data->timeout_started = true;
3828         run_again(sdata, ifmgd->auth_data->timeout);
3829
3830         /* move station state to auth */
3831         sta = sta_info_get(sdata, ap_addr);
3832         if (!sta) {
3833                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, ap_addr);
3834                 return false;
3835         }
3836         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
3837                 sdata_info(sdata, "failed moving %pM to auth\n", ap_addr);
3838                 return false;
3839         }
3840
3841         return true;
3842 }
3843
3844 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
3845                                    struct ieee80211_mgmt *mgmt, size_t len)
3846 {
3847         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3848         u16 auth_alg, auth_transaction, status_code;
3849         struct ieee80211_event event = {
3850                 .type = MLME_EVENT,
3851                 .u.mlme.data = AUTH_EVENT,
3852         };
3853         struct ieee80211_prep_tx_info info = {
3854                 .subtype = IEEE80211_STYPE_AUTH,
3855         };
3856
3857         lockdep_assert_wiphy(sdata->local->hw.wiphy);
3858
3859         if (len < 24 + 6)
3860                 return;
3861
3862         if (!ifmgd->auth_data || ifmgd->auth_data->done)
3863                 return;
3864
3865         if (!ether_addr_equal(ifmgd->auth_data->ap_addr, mgmt->bssid))
3866                 return;
3867
3868         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
3869         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
3870         status_code = le16_to_cpu(mgmt->u.auth.status_code);
3871
3872         if (auth_alg != ifmgd->auth_data->algorithm ||
3873             (auth_alg != WLAN_AUTH_SAE &&
3874              auth_transaction != ifmgd->auth_data->expected_transaction) ||
3875             (auth_alg == WLAN_AUTH_SAE &&
3876              (auth_transaction < ifmgd->auth_data->expected_transaction ||
3877               auth_transaction > 2))) {
3878                 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
3879                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
3880                            auth_transaction,
3881                            ifmgd->auth_data->expected_transaction);
3882                 goto notify_driver;
3883         }
3884
3885         if (status_code != WLAN_STATUS_SUCCESS) {
3886                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3887
3888                 if (auth_alg == WLAN_AUTH_SAE &&
3889                     (status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED ||
3890                      (auth_transaction == 1 &&
3891                       (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
3892                        status_code == WLAN_STATUS_SAE_PK)))) {
3893                         /* waiting for userspace now */
3894                         ifmgd->auth_data->waiting = true;
3895                         ifmgd->auth_data->timeout =
3896                                 jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY;
3897                         ifmgd->auth_data->timeout_started = true;
3898                         run_again(sdata, ifmgd->auth_data->timeout);
3899                         goto notify_driver;
3900                 }
3901
3902                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
3903                            mgmt->sa, status_code);
3904                 ieee80211_destroy_auth_data(sdata, false);
3905                 event.u.mlme.status = MLME_DENIED;
3906                 event.u.mlme.reason = status_code;
3907                 drv_event_callback(sdata->local, sdata, &event);
3908                 goto notify_driver;
3909         }
3910
3911         switch (ifmgd->auth_data->algorithm) {
3912         case WLAN_AUTH_OPEN:
3913         case WLAN_AUTH_LEAP:
3914         case WLAN_AUTH_FT:
3915         case WLAN_AUTH_SAE:
3916         case WLAN_AUTH_FILS_SK:
3917         case WLAN_AUTH_FILS_SK_PFS:
3918         case WLAN_AUTH_FILS_PK:
3919                 break;
3920         case WLAN_AUTH_SHARED_KEY:
3921                 if (ifmgd->auth_data->expected_transaction != 4) {
3922                         ieee80211_auth_challenge(sdata, mgmt, len);
3923                         /* need another frame */
3924                         return;
3925                 }
3926                 break;
3927         default:
3928                 WARN_ONCE(1, "invalid auth alg %d",
3929                           ifmgd->auth_data->algorithm);
3930                 goto notify_driver;
3931         }
3932
3933         event.u.mlme.status = MLME_SUCCESS;
3934         info.success = 1;
3935         drv_event_callback(sdata->local, sdata, &event);
3936         if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
3937             (auth_transaction == 2 &&
3938              ifmgd->auth_data->expected_transaction == 2)) {
3939                 if (!ieee80211_mark_sta_auth(sdata))
3940                         return; /* ignore frame -- wait for timeout */
3941         } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
3942                    auth_transaction == 2) {
3943                 sdata_info(sdata, "SAE peer confirmed\n");
3944                 ifmgd->auth_data->peer_confirmed = true;
3945         }
3946
3947         cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3948 notify_driver:
3949         drv_mgd_complete_tx(sdata->local, sdata, &info);
3950 }
3951
3952 #define case_WLAN(type) \
3953         case WLAN_REASON_##type: return #type
3954
3955 const char *ieee80211_get_reason_code_string(u16 reason_code)
3956 {
3957         switch (reason_code) {
3958         case_WLAN(UNSPECIFIED);
3959         case_WLAN(PREV_AUTH_NOT_VALID);
3960         case_WLAN(DEAUTH_LEAVING);
3961         case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
3962         case_WLAN(DISASSOC_AP_BUSY);
3963         case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
3964         case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
3965         case_WLAN(DISASSOC_STA_HAS_LEFT);
3966         case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
3967         case_WLAN(DISASSOC_BAD_POWER);
3968         case_WLAN(DISASSOC_BAD_SUPP_CHAN);
3969         case_WLAN(INVALID_IE);
3970         case_WLAN(MIC_FAILURE);
3971         case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
3972         case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
3973         case_WLAN(IE_DIFFERENT);
3974         case_WLAN(INVALID_GROUP_CIPHER);
3975         case_WLAN(INVALID_PAIRWISE_CIPHER);
3976         case_WLAN(INVALID_AKMP);
3977         case_WLAN(UNSUPP_RSN_VERSION);
3978         case_WLAN(INVALID_RSN_IE_CAP);
3979         case_WLAN(IEEE8021X_FAILED);
3980         case_WLAN(CIPHER_SUITE_REJECTED);
3981         case_WLAN(DISASSOC_UNSPECIFIED_QOS);
3982         case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
3983         case_WLAN(DISASSOC_LOW_ACK);
3984         case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
3985         case_WLAN(QSTA_LEAVE_QBSS);
3986         case_WLAN(QSTA_NOT_USE);
3987         case_WLAN(QSTA_REQUIRE_SETUP);
3988         case_WLAN(QSTA_TIMEOUT);
3989         case_WLAN(QSTA_CIPHER_NOT_SUPP);
3990         case_WLAN(MESH_PEER_CANCELED);
3991         case_WLAN(MESH_MAX_PEERS);
3992         case_WLAN(MESH_CONFIG);
3993         case_WLAN(MESH_CLOSE);
3994         case_WLAN(MESH_MAX_RETRIES);
3995         case_WLAN(MESH_CONFIRM_TIMEOUT);
3996         case_WLAN(MESH_INVALID_GTK);
3997         case_WLAN(MESH_INCONSISTENT_PARAM);
3998         case_WLAN(MESH_INVALID_SECURITY);
3999         case_WLAN(MESH_PATH_ERROR);
4000         case_WLAN(MESH_PATH_NOFORWARD);
4001         case_WLAN(MESH_PATH_DEST_UNREACHABLE);
4002         case_WLAN(MAC_EXISTS_IN_MBSS);
4003         case_WLAN(MESH_CHAN_REGULATORY);
4004         case_WLAN(MESH_CHAN);
4005         default: return "<unknown>";
4006         }
4007 }
4008
4009 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
4010                                      struct ieee80211_mgmt *mgmt, size_t len)
4011 {
4012         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4013         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
4014
4015         lockdep_assert_wiphy(sdata->local->hw.wiphy);
4016
4017         if (len < 24 + 2)
4018                 return;
4019
4020         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
4021                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
4022                 return;
4023         }
4024
4025         if (ifmgd->associated &&
4026             ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {
4027                 sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
4028                            sdata->vif.cfg.ap_addr, reason_code,
4029                            ieee80211_get_reason_code_string(reason_code));
4030
4031                 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
4032
4033                 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
4034                                             reason_code, false);
4035                 return;
4036         }
4037
4038         if (ifmgd->assoc_data &&
4039             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->ap_addr)) {
4040                 sdata_info(sdata,
4041                            "deauthenticated from %pM while associating (Reason: %u=%s)\n",
4042                            ifmgd->assoc_data->ap_addr, reason_code,
4043                            ieee80211_get_reason_code_string(reason_code));
4044
4045                 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
4046
4047                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
4048                 return;
4049         }
4050 }
4051
4052
4053 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
4054                                        struct ieee80211_mgmt *mgmt, size_t len)
4055 {
4056         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4057         u16 reason_code;
4058
4059         lockdep_assert_wiphy(sdata->local->hw.wiphy);
4060
4061         if (len < 24 + 2)
4062                 return;
4063
4064         if (!ifmgd->associated ||
4065             !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
4066                 return;
4067
4068         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
4069
4070         if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
4071                 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
4072                 return;
4073         }
4074
4075         sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
4076                    sdata->vif.cfg.ap_addr, reason_code,
4077                    ieee80211_get_reason_code_string(reason_code));
4078
4079         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
4080
4081         ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
4082                                     false);
4083 }
4084
4085 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
4086                                 u8 *supp_rates, unsigned int supp_rates_len,
4087                                 u32 *rates, u32 *basic_rates,
4088                                 bool *have_higher_than_11mbit,
4089                                 int *min_rate, int *min_rate_index)
4090 {
4091         int i, j;
4092
4093         for (i = 0; i < supp_rates_len; i++) {
4094                 int rate = supp_rates[i] & 0x7f;
4095                 bool is_basic = !!(supp_rates[i] & 0x80);
4096
4097                 if ((rate * 5) > 110)
4098                         *have_higher_than_11mbit = true;
4099
4100                 /*
4101                  * Skip HT, VHT, HE, EHT and SAE H2E only BSS membership
4102                  * selectors since they're not rates.
4103                  *
4104                  * Note: Even though the membership selector and the basic
4105                  *       rate flag share the same bit, they are not exactly
4106                  *       the same.
4107                  */
4108                 if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
4109                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
4110                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY) ||
4111                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_EHT_PHY) ||
4112                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E))
4113                         continue;
4114
4115                 for (j = 0; j < sband->n_bitrates; j++) {
4116                         struct ieee80211_rate *br;
4117                         int brate;
4118
4119                         br = &sband->bitrates[j];
4120
4121                         brate = DIV_ROUND_UP(br->bitrate, 5);
4122                         if (brate == rate) {
4123                                 *rates |= BIT(j);
4124                                 if (is_basic)
4125                                         *basic_rates |= BIT(j);
4126                                 if ((rate * 5) < *min_rate) {
4127                                         *min_rate = rate * 5;
4128                                         *min_rate_index = j;
4129                                 }
4130                                 break;
4131                         }
4132                 }
4133         }
4134 }
4135
4136 static bool ieee80211_twt_req_supported(struct ieee80211_sub_if_data *sdata,
4137                                         struct ieee80211_supported_band *sband,
4138                                         const struct link_sta_info *link_sta,
4139                                         const struct ieee802_11_elems *elems)
4140 {
4141         const struct ieee80211_sta_he_cap *own_he_cap =
4142                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
4143
4144         if (elems->ext_capab_len < 10)
4145                 return false;
4146
4147         if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
4148                 return false;
4149
4150         return link_sta->pub->he_cap.he_cap_elem.mac_cap_info[0] &
4151                 IEEE80211_HE_MAC_CAP0_TWT_RES &&
4152                 own_he_cap &&
4153                 (own_he_cap->he_cap_elem.mac_cap_info[0] &
4154                         IEEE80211_HE_MAC_CAP0_TWT_REQ);
4155 }
4156
4157 static u64 ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
4158                                     struct ieee80211_supported_band *sband,
4159                                     struct ieee80211_link_data *link,
4160                                     struct link_sta_info *link_sta,
4161                                     struct ieee802_11_elems *elems)
4162 {
4163         bool twt = ieee80211_twt_req_supported(sdata, sband, link_sta, elems);
4164
4165         if (link->conf->twt_requester != twt) {
4166                 link->conf->twt_requester = twt;
4167                 return BSS_CHANGED_TWT;
4168         }
4169         return 0;
4170 }
4171
4172 static bool ieee80211_twt_bcast_support(struct ieee80211_sub_if_data *sdata,
4173                                         struct ieee80211_bss_conf *bss_conf,
4174                                         struct ieee80211_supported_band *sband,
4175                                         struct link_sta_info *link_sta)
4176 {
4177         const struct ieee80211_sta_he_cap *own_he_cap =
4178                 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
4179
4180         return bss_conf->he_support &&
4181                 (link_sta->pub->he_cap.he_cap_elem.mac_cap_info[2] &
4182                         IEEE80211_HE_MAC_CAP2_BCAST_TWT) &&
4183                 own_he_cap &&
4184                 (own_he_cap->he_cap_elem.mac_cap_info[2] &
4185                         IEEE80211_HE_MAC_CAP2_BCAST_TWT);
4186 }
4187
4188 static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
4189                                         struct link_sta_info *link_sta,
4190                                         struct cfg80211_bss *cbss,
4191                                         struct ieee80211_mgmt *mgmt,
4192                                         const u8 *elem_start,
4193                                         unsigned int elem_len,
4194                                         u64 *changed)
4195 {
4196         struct ieee80211_sub_if_data *sdata = link->sdata;
4197         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
4198         struct ieee80211_bss_conf *bss_conf = link->conf;
4199         struct ieee80211_local *local = sdata->local;
4200         unsigned int link_id = link->link_id;
4201         struct ieee80211_elems_parse_params parse_params = {
4202                 .mode = link->u.mgd.conn.mode,
4203                 .start = elem_start,
4204                 .len = elem_len,
4205                 .link_id = link_id == assoc_data->assoc_link_id ? -1 : link_id,
4206                 .from_ap = true,
4207         };
4208         bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
4209         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4210         bool is_s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
4211         const struct cfg80211_bss_ies *bss_ies = NULL;
4212         struct ieee80211_supported_band *sband;
4213         struct ieee802_11_elems *elems;
4214         const __le16 prof_bss_param_ch_present =
4215                 cpu_to_le16(IEEE80211_MLE_STA_CONTROL_BSS_PARAM_CHANGE_CNT_PRESENT);
4216         u16 capab_info;
4217         bool ret;
4218
4219         elems = ieee802_11_parse_elems_full(&parse_params);
4220         if (!elems)
4221                 return false;
4222
4223         if (link_id == assoc_data->assoc_link_id) {
4224                 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
4225
4226                 /*
4227                  * we should not get to this flow unless the association was
4228                  * successful, so set the status directly to success
4229                  */
4230                 assoc_data->link[link_id].status = WLAN_STATUS_SUCCESS;
4231                 if (elems->ml_basic) {
4232                         int bss_param_ch_cnt =
4233                                 ieee80211_mle_get_bss_param_ch_cnt((const void *)elems->ml_basic);
4234
4235                         if (bss_param_ch_cnt < 0) {
4236                                 ret = false;
4237                                 goto out;
4238                         }
4239                         link->u.mgd.bss_param_ch_cnt = bss_param_ch_cnt;
4240                 }
4241         } else if (elems->parse_error & IEEE80211_PARSE_ERR_DUP_NEST_ML_BASIC ||
4242                    !elems->prof ||
4243                    !(elems->prof->control & prof_bss_param_ch_present)) {
4244                 ret = false;
4245                 goto out;
4246         } else {
4247                 const u8 *ptr = elems->prof->variable +
4248                                 elems->prof->sta_info_len - 1;
4249
4250                 /*
4251                  * During parsing, we validated that these fields exist,
4252                  * otherwise elems->prof would have been set to NULL.
4253                  */
4254                 capab_info = get_unaligned_le16(ptr);
4255                 assoc_data->link[link_id].status = get_unaligned_le16(ptr + 2);
4256                 link->u.mgd.bss_param_ch_cnt =
4257                         ieee80211_mle_basic_sta_prof_bss_param_ch_cnt(elems->prof);
4258
4259                 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
4260                         link_info(link, "association response status code=%u\n",
4261                                   assoc_data->link[link_id].status);
4262                         ret = true;
4263                         goto out;
4264                 }
4265         }
4266
4267         if (!is_s1g && !elems->supp_rates) {
4268                 sdata_info(sdata, "no SuppRates element in AssocResp\n");
4269                 ret = false;
4270                 goto out;
4271         }
4272
4273         link->u.mgd.tdls_chan_switch_prohibited =
4274                 elems->ext_capab && elems->ext_capab_len >= 5 &&
4275                 (elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
4276
4277         /*
4278          * Some APs are erroneously not including some information in their
4279          * (re)association response frames. Try to recover by using the data
4280          * from the beacon or probe response. This seems to afflict mobile
4281          * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
4282          * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
4283          */
4284         if (!is_6ghz &&
4285             ((assoc_data->wmm && !elems->wmm_param) ||
4286              (link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT &&
4287               (!elems->ht_cap_elem || !elems->ht_operation)) ||
4288              (link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT &&
4289               (!elems->vht_cap_elem || !elems->vht_operation)))) {
4290                 const struct cfg80211_bss_ies *ies;
4291                 struct ieee802_11_elems *bss_elems;
4292
4293                 rcu_read_lock();
4294                 ies = rcu_dereference(cbss->ies);
4295                 if (ies)
4296                         bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
4297                                           GFP_ATOMIC);
4298                 rcu_read_unlock();
4299                 if (!bss_ies) {
4300                         ret = false;
4301                         goto out;
4302                 }
4303
4304                 parse_params.start = bss_ies->data;
4305                 parse_params.len = bss_ies->len;
4306                 parse_params.bss = cbss;
4307                 bss_elems = ieee802_11_parse_elems_full(&parse_params);
4308                 if (!bss_elems) {
4309                         ret = false;
4310                         goto out;
4311                 }
4312
4313                 if (assoc_data->wmm &&
4314                     !elems->wmm_param && bss_elems->wmm_param) {
4315                         elems->wmm_param = bss_elems->wmm_param;
4316                         sdata_info(sdata,
4317                                    "AP bug: WMM param missing from AssocResp\n");
4318                 }
4319
4320                 /*
4321                  * Also check if we requested HT/VHT, otherwise the AP doesn't
4322                  * have to include the IEs in the (re)association response.
4323                  */
4324                 if (!elems->ht_cap_elem && bss_elems->ht_cap_elem &&
4325                     link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT) {
4326                         elems->ht_cap_elem = bss_elems->ht_cap_elem;
4327                         sdata_info(sdata,
4328                                    "AP bug: HT capability missing from AssocResp\n");
4329                 }
4330                 if (!elems->ht_operation && bss_elems->ht_operation &&
4331                     link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT) {
4332                         elems->ht_operation = bss_elems->ht_operation;
4333                         sdata_info(sdata,
4334                                    "AP bug: HT operation missing from AssocResp\n");
4335                 }
4336                 if (!elems->vht_cap_elem && bss_elems->vht_cap_elem &&
4337                     link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT) {
4338                         elems->vht_cap_elem = bss_elems->vht_cap_elem;
4339                         sdata_info(sdata,
4340                                    "AP bug: VHT capa missing from AssocResp\n");
4341                 }
4342                 if (!elems->vht_operation && bss_elems->vht_operation &&
4343                     link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT) {
4344                         elems->vht_operation = bss_elems->vht_operation;
4345                         sdata_info(sdata,
4346                                    "AP bug: VHT operation missing from AssocResp\n");
4347                 }
4348
4349                 kfree(bss_elems);
4350         }
4351
4352         /*
4353          * We previously checked these in the beacon/probe response, so
4354          * they should be present here. This is just a safety net.
4355          * Note that the ieee80211_config_bw() below would also check
4356          * for this (and more), but this has better error reporting.
4357          */
4358         if (!is_6ghz && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT &&
4359             (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
4360                 sdata_info(sdata,
4361                            "HT AP is missing WMM params or HT capability/operation\n");
4362                 ret = false;
4363                 goto out;
4364         }
4365
4366         if (is_5ghz && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT &&
4367             (!elems->vht_cap_elem || !elems->vht_operation)) {
4368                 sdata_info(sdata,
4369                            "VHT AP is missing VHT capability/operation\n");
4370                 ret = false;
4371                 goto out;
4372         }
4373
4374         /* check/update if AP changed anything in assoc response vs. scan */
4375         if (ieee80211_config_bw(link, elems,
4376                                 link_id == assoc_data->assoc_link_id,
4377                                 changed)) {
4378                 ret = false;
4379                 goto out;
4380         }
4381
4382         if (WARN_ON(!link->conf->chanreq.oper.chan)) {
4383                 ret = false;
4384                 goto out;
4385         }
4386         sband = local->hw.wiphy->bands[link->conf->chanreq.oper.chan->band];
4387
4388         /* Set up internal HT/VHT capabilities */
4389         if (elems->ht_cap_elem && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT)
4390                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
4391                                                   elems->ht_cap_elem,
4392                                                   link_sta);
4393
4394         if (elems->vht_cap_elem &&
4395             link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT) {
4396                 const struct ieee80211_vht_cap *bss_vht_cap = NULL;
4397                 const struct cfg80211_bss_ies *ies;
4398
4399                 /*
4400                  * Cisco AP module 9115 with FW 17.3 has a bug and sends a
4401                  * too large maximum MPDU length in the association response
4402                  * (indicating 12k) that it cannot actually process ...
4403                  * Work around that.
4404                  */
4405                 rcu_read_lock();
4406                 ies = rcu_dereference(cbss->ies);
4407                 if (ies) {
4408                         const struct element *elem;
4409
4410                         elem = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY,
4411                                                   ies->data, ies->len);
4412                         if (elem && elem->datalen >= sizeof(*bss_vht_cap))
4413                                 bss_vht_cap = (const void *)elem->data;
4414                 }
4415
4416                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
4417                                                     elems->vht_cap_elem,
4418                                                     bss_vht_cap, link_sta);
4419                 rcu_read_unlock();
4420         }
4421
4422         if (elems->he_operation &&
4423             link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HE &&
4424             elems->he_cap) {
4425                 const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
4426
4427                 ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
4428                                                   elems->he_cap,
4429                                                   elems->he_cap_len,
4430                                                   elems->he_6ghz_capa,
4431                                                   link_sta);
4432
4433                 he_6ghz_oper = ieee80211_he_6ghz_oper(elems->he_operation);
4434
4435                 if (is_6ghz && he_6ghz_oper) {
4436                         switch (u8_get_bits(he_6ghz_oper->control,
4437                                             IEEE80211_HE_6GHZ_OPER_CTRL_REG_INFO)) {
4438                         case IEEE80211_6GHZ_CTRL_REG_LPI_AP:
4439                                 bss_conf->power_type = IEEE80211_REG_LPI_AP;
4440                                 break;
4441                         case IEEE80211_6GHZ_CTRL_REG_SP_AP:
4442                                 bss_conf->power_type = IEEE80211_REG_SP_AP;
4443                                 break;
4444                         case IEEE80211_6GHZ_CTRL_REG_VLP_AP:
4445                                 bss_conf->power_type = IEEE80211_REG_VLP_AP;
4446                                 break;
4447                         default:
4448                                 bss_conf->power_type = IEEE80211_REG_UNSET_AP;
4449                                 break;
4450                         }
4451                 } else if (is_6ghz) {
4452                         link_info(link,
4453                                   "HE 6 GHz operation missing (on %d MHz), expect issues\n",
4454                                   bss_conf->chanreq.oper.chan->center_freq);
4455                 }
4456
4457                 bss_conf->he_support = link_sta->pub->he_cap.has_he;
4458                 if (elems->rsnx && elems->rsnx_len &&
4459                     (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
4460                     wiphy_ext_feature_isset(local->hw.wiphy,
4461                                             NL80211_EXT_FEATURE_PROTECTED_TWT))
4462                         bss_conf->twt_protected = true;
4463                 else
4464                         bss_conf->twt_protected = false;
4465
4466                 *changed |= ieee80211_recalc_twt_req(sdata, sband, link,
4467                                                      link_sta, elems);
4468
4469                 if (elems->eht_operation && elems->eht_cap &&
4470                     link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_EHT) {
4471                         ieee80211_eht_cap_ie_to_sta_eht_cap(sdata, sband,
4472                                                             elems->he_cap,
4473                                                             elems->he_cap_len,
4474                                                             elems->eht_cap,
4475                                                             elems->eht_cap_len,
4476                                                             link_sta);
4477
4478                         bss_conf->eht_support = link_sta->pub->eht_cap.has_eht;
4479                 } else {
4480                         bss_conf->eht_support = false;
4481                 }
4482         } else {
4483                 bss_conf->he_support = false;
4484                 bss_conf->twt_requester = false;
4485                 bss_conf->twt_protected = false;
4486                 bss_conf->eht_support = false;
4487         }
4488
4489         bss_conf->twt_broadcast =
4490                 ieee80211_twt_bcast_support(sdata, bss_conf, sband, link_sta);
4491
4492         if (bss_conf->he_support) {
4493                 bss_conf->he_bss_color.color =
4494                         le32_get_bits(elems->he_operation->he_oper_params,
4495                                       IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
4496                 bss_conf->he_bss_color.partial =
4497                         le32_get_bits(elems->he_operation->he_oper_params,
4498                                       IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
4499                 bss_conf->he_bss_color.enabled =
4500                         !le32_get_bits(elems->he_operation->he_oper_params,
4501                                        IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
4502
4503                 if (bss_conf->he_bss_color.enabled)
4504                         *changed |= BSS_CHANGED_HE_BSS_COLOR;
4505
4506                 bss_conf->htc_trig_based_pkt_ext =
4507                         le32_get_bits(elems->he_operation->he_oper_params,
4508                                       IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
4509                 bss_conf->frame_time_rts_th =
4510                         le32_get_bits(elems->he_operation->he_oper_params,
4511                                       IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
4512
4513                 bss_conf->uora_exists = !!elems->uora_element;
4514                 if (elems->uora_element)
4515                         bss_conf->uora_ocw_range = elems->uora_element[0];
4516
4517                 ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
4518                 ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
4519                 /* TODO: OPEN: what happens if BSS color disable is set? */
4520         }
4521
4522         if (cbss->transmitted_bss) {
4523                 bss_conf->nontransmitted = true;
4524                 ether_addr_copy(bss_conf->transmitter_bssid,
4525                                 cbss->transmitted_bss->bssid);
4526                 bss_conf->bssid_indicator = cbss->max_bssid_indicator;
4527                 bss_conf->bssid_index = cbss->bssid_index;
4528         }
4529
4530         /*
4531          * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
4532          * in their association response, so ignore that data for our own
4533          * configuration. If it changed since the last beacon, we'll get the
4534          * next beacon and update then.
4535          */
4536
4537         /*
4538          * If an operating mode notification IE is present, override the
4539          * NSS calculation (that would be done in rate_control_rate_init())
4540          * and use the # of streams from that element.
4541          */
4542         if (elems->opmode_notif &&
4543             !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
4544                 u8 nss;
4545
4546                 nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
4547                 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
4548                 nss += 1;
4549                 link_sta->pub->rx_nss = nss;
4550         }
4551
4552         /*
4553          * Always handle WMM once after association regardless
4554          * of the first value the AP uses. Setting -1 here has
4555          * that effect because the AP values is an unsigned
4556          * 4-bit value.
4557          */
4558         link->u.mgd.wmm_last_param_set = -1;
4559         link->u.mgd.mu_edca_last_param_set = -1;
4560
4561         if (link->u.mgd.disable_wmm_tracking) {
4562                 ieee80211_set_wmm_default(link, false, false);
4563         } else if (!ieee80211_sta_wmm_params(local, link, elems->wmm_param,
4564                                              elems->wmm_param_len,
4565                                              elems->mu_edca_param_set)) {
4566                 /* still enable QoS since we might have HT/VHT */
4567                 ieee80211_set_wmm_default(link, false, true);
4568                 /* disable WMM tracking in this case to disable
4569                  * tracking WMM parameter changes in the beacon if
4570                  * the parameters weren't actually valid. Doing so
4571                  * avoids changing parameters very strangely when
4572                  * the AP is going back and forth between valid and
4573                  * invalid parameters.
4574                  */
4575                 link->u.mgd.disable_wmm_tracking = true;
4576         }
4577
4578         if (elems->max_idle_period_ie) {
4579                 bss_conf->max_idle_period =
4580                         le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
4581                 bss_conf->protected_keep_alive =
4582                         !!(elems->max_idle_period_ie->idle_options &
4583                            WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
4584                 *changed |= BSS_CHANGED_KEEP_ALIVE;
4585         } else {
4586                 bss_conf->max_idle_period = 0;
4587                 bss_conf->protected_keep_alive = false;
4588         }
4589
4590         /* set assoc capability (AID was already set earlier),
4591          * ieee80211_set_associated() will tell the driver */
4592         bss_conf->assoc_capability = capab_info;
4593
4594         ret = true;
4595 out:
4596         kfree(elems);
4597         kfree(bss_ies);
4598         return ret;
4599 }
4600
4601 static int ieee80211_mgd_setup_link_sta(struct ieee80211_link_data *link,
4602                                         struct sta_info *sta,
4603                                         struct link_sta_info *link_sta,
4604                                         struct cfg80211_bss *cbss)
4605 {
4606         struct ieee80211_sub_if_data *sdata = link->sdata;
4607         struct ieee80211_local *local = sdata->local;
4608         struct ieee80211_bss *bss = (void *)cbss->priv;
4609         u32 rates = 0, basic_rates = 0;
4610         bool have_higher_than_11mbit = false;
4611         int min_rate = INT_MAX, min_rate_index = -1;
4612         struct ieee80211_supported_band *sband;
4613
4614         memcpy(link_sta->addr, cbss->bssid, ETH_ALEN);
4615         memcpy(link_sta->pub->addr, cbss->bssid, ETH_ALEN);
4616
4617         /* TODO: S1G Basic Rate Set is expressed elsewhere */
4618         if (cbss->channel->band == NL80211_BAND_S1GHZ) {
4619                 ieee80211_s1g_sta_rate_init(sta);
4620                 return 0;
4621         }
4622
4623         sband = local->hw.wiphy->bands[cbss->channel->band];
4624
4625         ieee80211_get_rates(sband, bss->supp_rates, bss->supp_rates_len,
4626                             &rates, &basic_rates, &have_higher_than_11mbit,
4627                             &min_rate, &min_rate_index);
4628
4629         /*
4630          * This used to be a workaround for basic rates missing
4631          * in the association response frame. Now that we no
4632          * longer use the basic rates from there, it probably
4633          * doesn't happen any more, but keep the workaround so
4634          * in case some *other* APs are buggy in different ways
4635          * we can connect -- with a warning.
4636          * Allow this workaround only in case the AP provided at least
4637          * one rate.
4638          */
4639         if (min_rate_index < 0) {
4640                 link_info(link, "No legacy rates in association response\n");
4641                 return -EINVAL;
4642         } else if (!basic_rates) {
4643                 link_info(link, "No basic rates, using min rate instead\n");
4644                 basic_rates = BIT(min_rate_index);
4645         }
4646
4647         if (rates)
4648                 link_sta->pub->supp_rates[cbss->channel->band] = rates;
4649         else
4650                 link_info(link, "No rates found, keeping mandatory only\n");
4651
4652         link->conf->basic_rates = basic_rates;
4653
4654         /* cf. IEEE 802.11 9.2.12 */
4655         link->operating_11g_mode = sband->band == NL80211_BAND_2GHZ &&
4656                                    have_higher_than_11mbit;
4657
4658         return 0;
4659 }
4660
4661 static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
4662                                   struct cfg80211_bss *cbss)
4663 {
4664         struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
4665         const struct element *ht_cap_elem, *vht_cap_elem;
4666         const struct cfg80211_bss_ies *ies;
4667         const struct ieee80211_ht_cap *ht_cap;
4668         const struct ieee80211_vht_cap *vht_cap;
4669         const struct ieee80211_he_cap_elem *he_cap;
4670         const struct element *he_cap_elem;
4671         u16 mcs_80_map, mcs_160_map;
4672         int i, mcs_nss_size;
4673         bool support_160;
4674         u8 chains = 1;
4675
4676         if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_HT)
4677                 return chains;
4678
4679         ht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_CAPABILITY);
4680         if (ht_cap_elem && ht_cap_elem->datalen >= sizeof(*ht_cap)) {
4681                 ht_cap = (void *)ht_cap_elem->data;
4682                 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
4683                 /*
4684                  * TODO: use "Tx Maximum Number Spatial Streams Supported" and
4685                  *       "Tx Unequal Modulation Supported" fields.
4686                  */
4687         }
4688
4689         if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_VHT)
4690                 return chains;
4691
4692         vht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
4693         if (vht_cap_elem && vht_cap_elem->datalen >= sizeof(*vht_cap)) {
4694                 u8 nss;
4695                 u16 tx_mcs_map;
4696
4697                 vht_cap = (void *)vht_cap_elem->data;
4698                 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
4699                 for (nss = 8; nss > 0; nss--) {
4700                         if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
4701                                         IEEE80211_VHT_MCS_NOT_SUPPORTED)
4702                                 break;
4703                 }
4704                 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
4705                 chains = max(chains, nss);
4706         }
4707
4708         if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_HE)
4709                 return chains;
4710
4711         ies = rcu_dereference(cbss->ies);
4712         he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
4713                                              ies->data, ies->len);
4714
4715         if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
4716                 return chains;
4717
4718         /* skip one byte ext_tag_id */
4719         he_cap = (void *)(he_cap_elem->data + 1);
4720         mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
4721
4722         /* invalid HE IE */
4723         if (he_cap_elem->datalen < 1 + mcs_nss_size + sizeof(*he_cap))
4724                 return chains;
4725
4726         /* mcs_nss is right after he_cap info */
4727         he_mcs_nss_supp = (void *)(he_cap + 1);
4728
4729         mcs_80_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
4730
4731         for (i = 7; i >= 0; i--) {
4732                 u8 mcs_80 = mcs_80_map >> (2 * i) & 3;
4733
4734                 if (mcs_80 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4735                         chains = max_t(u8, chains, i + 1);
4736                         break;
4737                 }
4738         }
4739
4740         support_160 = he_cap->phy_cap_info[0] &
4741                       IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
4742
4743         if (!support_160)
4744                 return chains;
4745
4746         mcs_160_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_160);
4747         for (i = 7; i >= 0; i--) {
4748                 u8 mcs_160 = mcs_160_map >> (2 * i) & 3;
4749
4750                 if (mcs_160 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4751                         chains = max_t(u8, chains, i + 1);
4752                         break;
4753                 }
4754         }
4755
4756         return chains;
4757 }
4758
4759 static void
4760 ieee80211_determine_our_sta_mode(struct ieee80211_sub_if_data *sdata,
4761                                  struct ieee80211_supported_band *sband,
4762                                  struct cfg80211_assoc_request *req,
4763                                  bool wmm_used, int link_id,
4764                                  struct ieee80211_conn_settings *conn)
4765 {
4766         struct ieee80211_sta_ht_cap sta_ht_cap = sband->ht_cap;
4767         bool is_5ghz = sband->band == NL80211_BAND_5GHZ;
4768         bool is_6ghz = sband->band == NL80211_BAND_6GHZ;
4769         const struct ieee80211_sta_he_cap *he_cap;
4770         const struct ieee80211_sta_eht_cap *eht_cap;
4771         struct ieee80211_sta_vht_cap vht_cap;
4772
4773         if (sband->band == NL80211_BAND_S1GHZ) {
4774                 conn->mode = IEEE80211_CONN_MODE_S1G;
4775                 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
4776                 mlme_dbg(sdata, "operating as S1G STA\n");
4777                 return;
4778         }
4779
4780         conn->mode = IEEE80211_CONN_MODE_LEGACY;
4781         conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
4782
4783         ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
4784
4785         if (req && req->flags & ASSOC_REQ_DISABLE_HT) {
4786                 mlme_link_id_dbg(sdata, link_id,
4787                                  "HT disabled by flag, limiting to legacy\n");
4788                 goto out;
4789         }
4790
4791         if (!wmm_used) {
4792                 mlme_link_id_dbg(sdata, link_id,
4793                                  "WMM/QoS not supported, limiting to legacy\n");
4794                 goto out;
4795         }
4796
4797         if (req) {
4798                 unsigned int i;
4799
4800                 for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4801                         if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
4802                             req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4803                             req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4804                                 netdev_info(sdata->dev,
4805                                             "WEP/TKIP use, limiting to legacy\n");
4806                                 goto out;
4807                         }
4808                 }
4809         }
4810
4811         if (!sta_ht_cap.ht_supported && !is_6ghz) {
4812                 mlme_link_id_dbg(sdata, link_id,
4813                                  "HT not supported (and not on 6 GHz), limiting to legacy\n");
4814                 goto out;
4815         }
4816
4817         /* HT is fine */
4818         conn->mode = IEEE80211_CONN_MODE_HT;
4819         conn->bw_limit = sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
4820                 IEEE80211_CONN_BW_LIMIT_40 :
4821                 IEEE80211_CONN_BW_LIMIT_20;
4822
4823         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
4824         ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
4825
4826         if (req && req->flags & ASSOC_REQ_DISABLE_VHT) {
4827                 mlme_link_id_dbg(sdata, link_id,
4828                                  "VHT disabled by flag, limiting to HT\n");
4829                 goto out;
4830         }
4831
4832         if (vht_cap.vht_supported && is_5ghz) {
4833                 bool have_80mhz = false;
4834                 unsigned int i;
4835
4836                 if (conn->bw_limit == IEEE80211_CONN_BW_LIMIT_20) {
4837                         mlme_link_id_dbg(sdata, link_id,
4838                                          "no 40 MHz support on 5 GHz, limiting to HT\n");
4839                         goto out;
4840                 }
4841
4842                 /* Allow VHT if at least one channel on the sband supports 80 MHz */
4843                 for (i = 0; i < sband->n_channels; i++) {
4844                         if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
4845                                                         IEEE80211_CHAN_NO_80MHZ))
4846                                 continue;
4847
4848                         have_80mhz = true;
4849                         break;
4850                 }
4851
4852                 if (!have_80mhz) {
4853                         mlme_link_id_dbg(sdata, link_id,
4854                                          "no 80 MHz channel support on 5 GHz, limiting to HT\n");
4855                         goto out;
4856                 }
4857         } else if (is_5ghz) { /* !vht_supported but on 5 GHz */
4858                 mlme_link_id_dbg(sdata, link_id,
4859                                  "no VHT support on 5 GHz, limiting to HT\n");
4860                 goto out;
4861         }
4862
4863         /* VHT - if we have - is fine, including 80 MHz, check 160 below again */
4864         if (sband->band != NL80211_BAND_2GHZ) {
4865                 conn->mode = IEEE80211_CONN_MODE_VHT;
4866                 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_160;
4867         }
4868
4869         if (is_5ghz &&
4870             !(vht_cap.cap & (IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
4871                              IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))) {
4872                 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_80;
4873                 mlme_link_id_dbg(sdata, link_id,
4874                                  "no VHT 160 MHz capability on 5 GHz, limiting to 80 MHz");
4875         }
4876
4877         if (req && req->flags & ASSOC_REQ_DISABLE_HE) {
4878                 mlme_link_id_dbg(sdata, link_id,
4879                                  "HE disabled by flag, limiting to HT/VHT\n");
4880                 goto out;
4881         }
4882
4883         he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
4884         if (!he_cap) {
4885                 WARN_ON(is_6ghz);
4886                 mlme_link_id_dbg(sdata, link_id,
4887                                  "no HE support, limiting to HT/VHT\n");
4888                 goto out;
4889         }
4890
4891         /* so we have HE */
4892         conn->mode = IEEE80211_CONN_MODE_HE;
4893
4894         /* check bandwidth */
4895         switch (sband->band) {
4896         default:
4897         case NL80211_BAND_2GHZ:
4898                 if (he_cap->he_cap_elem.phy_cap_info[0] &
4899                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G)
4900                         break;
4901                 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
4902                 mlme_link_id_dbg(sdata, link_id,
4903                                  "no 40 MHz HE cap in 2.4 GHz, limiting to 20 MHz\n");
4904                 break;
4905         case NL80211_BAND_5GHZ:
4906                 if (!(he_cap->he_cap_elem.phy_cap_info[0] &
4907                       IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G)) {
4908                         conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
4909                         mlme_link_id_dbg(sdata, link_id,
4910                                          "no 40/80 MHz HE cap in 5 GHz, limiting to 20 MHz\n");
4911                         break;
4912                 }
4913                 if (!(he_cap->he_cap_elem.phy_cap_info[0] &
4914                       IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G)) {
4915                         conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
4916                                                conn->bw_limit,
4917                                                IEEE80211_CONN_BW_LIMIT_80);
4918                         mlme_link_id_dbg(sdata, link_id,
4919                                          "no 160 MHz HE cap in 5 GHz, limiting to 80 MHz\n");
4920                 }
4921                 break;
4922         case NL80211_BAND_6GHZ:
4923                 if (he_cap->he_cap_elem.phy_cap_info[0] &
4924                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G)
4925                         break;
4926                 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
4927                                        conn->bw_limit,
4928                                        IEEE80211_CONN_BW_LIMIT_80);
4929                 mlme_link_id_dbg(sdata, link_id,
4930                                  "no 160 MHz HE cap in 6 GHz, limiting to 80 MHz\n");
4931                 break;
4932         }
4933
4934         if (req && req->flags & ASSOC_REQ_DISABLE_EHT) {
4935                 mlme_link_id_dbg(sdata, link_id,
4936                                  "EHT disabled by flag, limiting to HE\n");
4937                 goto out;
4938         }
4939
4940         eht_cap = ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
4941         if (!eht_cap) {
4942                 mlme_link_id_dbg(sdata, link_id,
4943                                  "no EHT support, limiting to HE\n");
4944                 goto out;
4945         }
4946
4947         /* we have EHT */
4948
4949         conn->mode = IEEE80211_CONN_MODE_EHT;
4950
4951         /* check bandwidth */
4952         if (is_6ghz &&
4953             eht_cap->eht_cap_elem.phy_cap_info[0] & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ)
4954                 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_320;
4955         else if (is_6ghz)
4956                 mlme_link_id_dbg(sdata, link_id,
4957                                  "no EHT 320 MHz cap in 6 GHz, limiting to 160 MHz\n");
4958
4959 out:
4960         mlme_link_id_dbg(sdata, link_id,
4961                          "determined local STA to be %s, BW limited to %d MHz\n",
4962                          ieee80211_conn_mode_str(conn->mode),
4963                          20 * (1 << conn->bw_limit));
4964 }
4965
4966 static void
4967 ieee80211_determine_our_sta_mode_auth(struct ieee80211_sub_if_data *sdata,
4968                                       struct ieee80211_supported_band *sband,
4969                                       struct cfg80211_auth_request *req,
4970                                       bool wmm_used,
4971                                       struct ieee80211_conn_settings *conn)
4972 {
4973         ieee80211_determine_our_sta_mode(sdata, sband, NULL, wmm_used,
4974                                          req->link_id > 0 ? req->link_id : 0,
4975                                          conn);
4976 }
4977
4978 static void
4979 ieee80211_determine_our_sta_mode_assoc(struct ieee80211_sub_if_data *sdata,
4980                                        struct ieee80211_supported_band *sband,
4981                                        struct cfg80211_assoc_request *req,
4982                                        bool wmm_used, int link_id,
4983                                        struct ieee80211_conn_settings *conn)
4984 {
4985         struct ieee80211_conn_settings tmp;
4986
4987         WARN_ON(!req);
4988
4989         ieee80211_determine_our_sta_mode(sdata, sband, req, wmm_used, link_id,
4990                                          &tmp);
4991
4992         conn->mode = min_t(enum ieee80211_conn_mode,
4993                            conn->mode, tmp.mode);
4994         conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
4995                                conn->bw_limit, tmp.bw_limit);
4996 }
4997
4998 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
4999                                   struct ieee80211_link_data *link,
5000                                   int link_id,
5001                                   struct cfg80211_bss *cbss, bool mlo,
5002                                   struct ieee80211_conn_settings *conn)
5003 {
5004         struct ieee80211_local *local = sdata->local;
5005         bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
5006         struct ieee80211_chan_req chanreq = {};
5007         struct ieee802_11_elems *elems;
5008         int ret;
5009         u32 i;
5010
5011         lockdep_assert_wiphy(local->hw.wiphy);
5012
5013         rcu_read_lock();
5014         elems = ieee80211_determine_chan_mode(sdata, conn, cbss, link_id,
5015                                               &chanreq);
5016
5017         if (IS_ERR(elems)) {
5018                 rcu_read_unlock();
5019                 return PTR_ERR(elems);
5020         }
5021
5022         if (mlo && !elems->ml_basic) {
5023                 sdata_info(sdata, "Rejecting MLO as it is not supported by AP\n");
5024                 rcu_read_unlock();
5025                 kfree(elems);
5026                 return -EINVAL;
5027         }
5028
5029         if (link && is_6ghz && conn->mode >= IEEE80211_CONN_MODE_HE) {
5030                 struct ieee80211_bss_conf *bss_conf;
5031                 u8 j = 0;
5032
5033                 bss_conf = link->conf;
5034
5035                 if (elems->pwr_constr_elem)
5036                         bss_conf->pwr_reduction = *elems->pwr_constr_elem;
5037
5038                 BUILD_BUG_ON(ARRAY_SIZE(bss_conf->tx_pwr_env) !=
5039                              ARRAY_SIZE(elems->tx_pwr_env));
5040
5041                 for (i = 0; i < elems->tx_pwr_env_num; i++) {
5042                         if (elems->tx_pwr_env_len[i] > sizeof(bss_conf->tx_pwr_env[j]))
5043                                 continue;
5044
5045                         bss_conf->tx_pwr_env_num++;
5046                         memcpy(&bss_conf->tx_pwr_env[j], elems->tx_pwr_env[i],
5047                                elems->tx_pwr_env_len[i]);
5048                         j++;
5049                 }
5050         }
5051         rcu_read_unlock();
5052         /* the element data was RCU protected so no longer valid anyway */
5053         kfree(elems);
5054         elems = NULL;
5055
5056         if (!link)
5057                 return 0;
5058
5059         rcu_read_lock();
5060         link->needed_rx_chains = min(ieee80211_max_rx_chains(link, cbss),
5061                                      local->rx_chains);
5062         rcu_read_unlock();
5063
5064         /*
5065          * If this fails (possibly due to channel context sharing
5066          * on incompatible channels, e.g. 80+80 and 160 sharing the
5067          * same control channel) try to use a smaller bandwidth.
5068          */
5069         ret = ieee80211_link_use_channel(link, &chanreq,
5070                                          IEEE80211_CHANCTX_SHARED);
5071
5072         /* don't downgrade for 5 and 10 MHz channels, though. */
5073         if (chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
5074             chanreq.oper.width == NL80211_CHAN_WIDTH_10)
5075                 return ret;
5076
5077         while (ret && chanreq.oper.width != NL80211_CHAN_WIDTH_20_NOHT) {
5078                 ieee80211_chanreq_downgrade(&chanreq, conn);
5079
5080                 ret = ieee80211_link_use_channel(link, &chanreq,
5081                                                  IEEE80211_CHANCTX_SHARED);
5082         }
5083
5084         return ret;
5085 }
5086
5087 static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
5088                                u8 *dtim_count, u8 *dtim_period)
5089 {
5090         const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
5091         const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
5092                                          ies->len);
5093         const struct ieee80211_tim_ie *tim = NULL;
5094         const struct ieee80211_bssid_index *idx;
5095         bool valid = tim_ie && tim_ie[1] >= 2;
5096
5097         if (valid)
5098                 tim = (void *)(tim_ie + 2);
5099
5100         if (dtim_count)
5101                 *dtim_count = valid ? tim->dtim_count : 0;
5102
5103         if (dtim_period)
5104                 *dtim_period = valid ? tim->dtim_period : 0;
5105
5106         /* Check if value is overridden by non-transmitted profile */
5107         if (!idx_ie || idx_ie[1] < 3)
5108                 return valid;
5109
5110         idx = (void *)(idx_ie + 2);
5111
5112         if (dtim_count)
5113                 *dtim_count = idx->dtim_count;
5114
5115         if (dtim_period)
5116                 *dtim_period = idx->dtim_period;
5117
5118         return true;
5119 }
5120
5121 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
5122                                     struct ieee80211_mgmt *mgmt,
5123                                     struct ieee802_11_elems *elems,
5124                                     const u8 *elem_start, unsigned int elem_len)
5125 {
5126         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5127         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
5128         struct ieee80211_local *local = sdata->local;
5129         unsigned int link_id;
5130         struct sta_info *sta;
5131         u64 changed[IEEE80211_MLD_MAX_NUM_LINKS] = {};
5132         u16 valid_links = 0, dormant_links = 0;
5133         int err;
5134
5135         lockdep_assert_wiphy(sdata->local->hw.wiphy);
5136         /*
5137          * station info was already allocated and inserted before
5138          * the association and should be available to us
5139          */
5140         sta = sta_info_get(sdata, assoc_data->ap_addr);
5141         if (WARN_ON(!sta))
5142                 goto out_err;
5143
5144         sta->sta.spp_amsdu = assoc_data->spp_amsdu;
5145
5146         if (ieee80211_vif_is_mld(&sdata->vif)) {
5147                 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5148                         if (!assoc_data->link[link_id].bss)
5149                                 continue;
5150
5151                         valid_links |= BIT(link_id);
5152                         if (assoc_data->link[link_id].disabled)
5153                                 dormant_links |= BIT(link_id);
5154
5155                         if (link_id != assoc_data->assoc_link_id) {
5156                                 err = ieee80211_sta_allocate_link(sta, link_id);
5157                                 if (err)
5158                                         goto out_err;
5159                         }
5160                 }
5161
5162                 ieee80211_vif_set_links(sdata, valid_links, dormant_links);
5163         }
5164
5165         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5166                 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
5167                 struct ieee80211_link_data *link;
5168                 struct link_sta_info *link_sta;
5169
5170                 if (!cbss)
5171                         continue;
5172
5173                 link = sdata_dereference(sdata->link[link_id], sdata);
5174                 if (WARN_ON(!link))
5175                         goto out_err;
5176
5177                 if (ieee80211_vif_is_mld(&sdata->vif))
5178                         link_info(link,
5179                                   "local address %pM, AP link address %pM%s\n",
5180                                   link->conf->addr,
5181                                   assoc_data->link[link_id].bss->bssid,
5182                                   link_id == assoc_data->assoc_link_id ?
5183                                         " (assoc)" : "");
5184
5185                 link_sta = rcu_dereference_protected(sta->link[link_id],
5186                                                      lockdep_is_held(&local->hw.wiphy->mtx));
5187                 if (WARN_ON(!link_sta))
5188                         goto out_err;
5189
5190                 if (!link->u.mgd.have_beacon) {
5191                         const struct cfg80211_bss_ies *ies;
5192
5193                         rcu_read_lock();
5194                         ies = rcu_dereference(cbss->beacon_ies);
5195                         if (ies)
5196                                 link->u.mgd.have_beacon = true;
5197                         else
5198                                 ies = rcu_dereference(cbss->ies);
5199                         ieee80211_get_dtim(ies,
5200                                            &link->conf->sync_dtim_count,
5201                                            &link->u.mgd.dtim_period);
5202                         link->conf->beacon_int = cbss->beacon_interval;
5203                         rcu_read_unlock();
5204                 }
5205
5206                 link->conf->dtim_period = link->u.mgd.dtim_period ?: 1;
5207
5208                 if (link_id != assoc_data->assoc_link_id) {
5209                         link->u.mgd.conn = assoc_data->link[link_id].conn;
5210
5211                         err = ieee80211_prep_channel(sdata, link, link_id, cbss,
5212                                                      true, &link->u.mgd.conn);
5213                         if (err) {
5214                                 link_info(link, "prep_channel failed\n");
5215                                 goto out_err;
5216                         }
5217                 }
5218
5219                 err = ieee80211_mgd_setup_link_sta(link, sta, link_sta,
5220                                                    assoc_data->link[link_id].bss);
5221                 if (err)
5222                         goto out_err;
5223
5224                 if (!ieee80211_assoc_config_link(link, link_sta,
5225                                                  assoc_data->link[link_id].bss,
5226                                                  mgmt, elem_start, elem_len,
5227                                                  &changed[link_id]))
5228                         goto out_err;
5229
5230                 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
5231                         valid_links &= ~BIT(link_id);
5232                         ieee80211_sta_remove_link(sta, link_id);
5233                         continue;
5234                 }
5235
5236                 if (link_id != assoc_data->assoc_link_id) {
5237                         err = ieee80211_sta_activate_link(sta, link_id);
5238                         if (err)
5239                                 goto out_err;
5240                 }
5241         }
5242
5243         /* links might have changed due to rejected ones, set them again */
5244         ieee80211_vif_set_links(sdata, valid_links, dormant_links);
5245
5246         rate_control_rate_init(sta);
5247
5248         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
5249                 set_sta_flag(sta, WLAN_STA_MFP);
5250                 sta->sta.mfp = true;
5251         } else {
5252                 sta->sta.mfp = false;
5253         }
5254
5255         ieee80211_sta_set_max_amsdu_subframes(sta, elems->ext_capab,
5256                                               elems->ext_capab_len);
5257
5258         sta->sta.wme = (elems->wmm_param || elems->s1g_capab) &&
5259                        local->hw.queues >= IEEE80211_NUM_ACS;
5260
5261         err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
5262         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
5263                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
5264         if (err) {
5265                 sdata_info(sdata,
5266                            "failed to move station %pM to desired state\n",
5267                            sta->sta.addr);
5268                 WARN_ON(__sta_info_destroy(sta));
5269                 goto out_err;
5270         }
5271
5272         if (sdata->wdev.use_4addr)
5273                 drv_sta_set_4addr(local, sdata, &sta->sta, true);
5274
5275         ieee80211_set_associated(sdata, assoc_data, changed);
5276
5277         /*
5278          * If we're using 4-addr mode, let the AP know that we're
5279          * doing so, so that it can create the STA VLAN on its side
5280          */
5281         if (ifmgd->use_4addr)
5282                 ieee80211_send_4addr_nullfunc(local, sdata);
5283
5284         /*
5285          * Start timer to probe the connection to the AP now.
5286          * Also start the timer that will detect beacon loss.
5287          */
5288         ieee80211_sta_reset_beacon_monitor(sdata);
5289         ieee80211_sta_reset_conn_monitor(sdata);
5290
5291         return true;
5292 out_err:
5293         eth_zero_addr(sdata->vif.cfg.ap_addr);
5294         return false;
5295 }
5296
5297 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
5298                                          struct ieee80211_mgmt *mgmt,
5299                                          size_t len)
5300 {
5301         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5302         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
5303         u16 capab_info, status_code, aid;
5304         struct ieee80211_elems_parse_params parse_params = {
5305                 .bss = NULL,
5306                 .link_id = -1,
5307                 .from_ap = true,
5308         };
5309         struct ieee802_11_elems *elems;
5310         int ac;
5311         const u8 *elem_start;
5312         unsigned int elem_len;
5313         bool reassoc;
5314         struct ieee80211_event event = {
5315                 .type = MLME_EVENT,
5316                 .u.mlme.data = ASSOC_EVENT,
5317         };
5318         struct ieee80211_prep_tx_info info = {};
5319         struct cfg80211_rx_assoc_resp_data resp = {
5320                 .uapsd_queues = -1,
5321         };
5322         u8 ap_mld_addr[ETH_ALEN] __aligned(2);
5323         unsigned int link_id;
5324
5325         lockdep_assert_wiphy(sdata->local->hw.wiphy);
5326
5327         if (!assoc_data)
5328                 return;
5329
5330         parse_params.mode =
5331                 assoc_data->link[assoc_data->assoc_link_id].conn.mode;
5332
5333         if (!ether_addr_equal(assoc_data->ap_addr, mgmt->bssid) ||
5334             !ether_addr_equal(assoc_data->ap_addr, mgmt->sa))
5335                 return;
5336
5337         /*
5338          * AssocResp and ReassocResp have identical structure, so process both
5339          * of them in this function.
5340          */
5341
5342         if (len < 24 + 6)
5343                 return;
5344
5345         reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
5346         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
5347         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
5348         if (assoc_data->s1g)
5349                 elem_start = mgmt->u.s1g_assoc_resp.variable;
5350         else
5351                 elem_start = mgmt->u.assoc_resp.variable;
5352
5353         /*
5354          * Note: this may not be perfect, AP might misbehave - if
5355          * anyone needs to rely on perfect complete notification
5356          * with the exact right subtype, then we need to track what
5357          * we actually transmitted.
5358          */
5359         info.subtype = reassoc ? IEEE80211_STYPE_REASSOC_REQ :
5360                                  IEEE80211_STYPE_ASSOC_REQ;
5361
5362         if (assoc_data->fils_kek_len &&
5363             fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
5364                 return;
5365
5366         elem_len = len - (elem_start - (u8 *)mgmt);
5367         parse_params.start = elem_start;
5368         parse_params.len = elem_len;
5369         elems = ieee802_11_parse_elems_full(&parse_params);
5370         if (!elems)
5371                 goto notify_driver;
5372
5373         if (elems->aid_resp)
5374                 aid = le16_to_cpu(elems->aid_resp->aid);
5375         else if (assoc_data->s1g)
5376                 aid = 0; /* TODO */
5377         else
5378                 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
5379
5380         /*
5381          * The 5 MSB of the AID field are reserved
5382          * (802.11-2016 9.4.1.8 AID field)
5383          */
5384         aid &= 0x7ff;
5385
5386         sdata_info(sdata,
5387                    "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
5388                    reassoc ? "Rea" : "A", assoc_data->ap_addr,
5389                    capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
5390
5391         ifmgd->broken_ap = false;
5392
5393         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
5394             elems->timeout_int &&
5395             elems->timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
5396                 u32 tu, ms;
5397
5398                 cfg80211_assoc_comeback(sdata->dev, assoc_data->ap_addr,
5399                                         le32_to_cpu(elems->timeout_int->value));
5400
5401                 tu = le32_to_cpu(elems->timeout_int->value);
5402                 ms = tu * 1024 / 1000;
5403                 sdata_info(sdata,
5404                            "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
5405                            assoc_data->ap_addr, tu, ms);
5406                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
5407                 assoc_data->timeout_started = true;
5408                 assoc_data->comeback = true;
5409                 if (ms > IEEE80211_ASSOC_TIMEOUT)
5410                         run_again(sdata, assoc_data->timeout);
5411                 goto notify_driver;
5412         }
5413
5414         if (status_code != WLAN_STATUS_SUCCESS) {
5415                 sdata_info(sdata, "%pM denied association (code=%d)\n",
5416                            assoc_data->ap_addr, status_code);
5417                 event.u.mlme.status = MLME_DENIED;
5418                 event.u.mlme.reason = status_code;
5419                 drv_event_callback(sdata->local, sdata, &event);
5420         } else {
5421                 if (aid == 0 || aid > IEEE80211_MAX_AID) {
5422                         sdata_info(sdata,
5423                                    "invalid AID value %d (out of range), turn off PS\n",
5424                                    aid);
5425                         aid = 0;
5426                         ifmgd->broken_ap = true;
5427                 }
5428
5429                 if (ieee80211_vif_is_mld(&sdata->vif)) {
5430                         struct ieee80211_mle_basic_common_info *common;
5431
5432                         if (!elems->ml_basic) {
5433                                 sdata_info(sdata,
5434                                            "MLO association with %pM but no (basic) multi-link element in response!\n",
5435                                            assoc_data->ap_addr);
5436                                 goto abandon_assoc;
5437                         }
5438
5439                         common = (void *)elems->ml_basic->variable;
5440
5441                         if (memcmp(assoc_data->ap_addr,
5442                                    common->mld_mac_addr, ETH_ALEN)) {
5443                                 sdata_info(sdata,
5444                                            "AP MLD MAC address mismatch: got %pM expected %pM\n",
5445                                            common->mld_mac_addr,
5446                                            assoc_data->ap_addr);
5447                                 goto abandon_assoc;
5448                         }
5449
5450                         sdata->vif.cfg.eml_cap =
5451                                 ieee80211_mle_get_eml_cap((const void *)elems->ml_basic);
5452                         sdata->vif.cfg.eml_med_sync_delay =
5453                                 ieee80211_mle_get_eml_med_sync_delay((const void *)elems->ml_basic);
5454                         sdata->vif.cfg.mld_capa_op =
5455                                 ieee80211_mle_get_mld_capa_op((const void *)elems->ml_basic);
5456                 }
5457
5458                 sdata->vif.cfg.aid = aid;
5459
5460                 if (!ieee80211_assoc_success(sdata, mgmt, elems,
5461                                              elem_start, elem_len)) {
5462                         /* oops -- internal error -- send timeout for now */
5463                         ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
5464                         goto notify_driver;
5465                 }
5466                 event.u.mlme.status = MLME_SUCCESS;
5467                 drv_event_callback(sdata->local, sdata, &event);
5468                 sdata_info(sdata, "associated\n");
5469
5470                 info.success = 1;
5471         }
5472
5473         for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5474                 struct ieee80211_link_data *link;
5475
5476                 if (!assoc_data->link[link_id].bss)
5477                         continue;
5478
5479                 resp.links[link_id].bss = assoc_data->link[link_id].bss;
5480                 ether_addr_copy(resp.links[link_id].addr,
5481                                 assoc_data->link[link_id].addr);
5482                 resp.links[link_id].status = assoc_data->link[link_id].status;
5483
5484                 link = sdata_dereference(sdata->link[link_id], sdata);
5485                 if (!link)
5486                         continue;
5487
5488                 /* get uapsd queues configuration - same for all links */
5489                 resp.uapsd_queues = 0;
5490                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5491                         if (link->tx_conf[ac].uapsd)
5492                                 resp.uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
5493         }
5494
5495         if (ieee80211_vif_is_mld(&sdata->vif)) {
5496                 ether_addr_copy(ap_mld_addr, sdata->vif.cfg.ap_addr);
5497                 resp.ap_mld_addr = ap_mld_addr;
5498         }
5499
5500         ieee80211_destroy_assoc_data(sdata,
5501                                      status_code == WLAN_STATUS_SUCCESS ?
5502                                         ASSOC_SUCCESS :
5503                                         ASSOC_REJECTED);
5504
5505         resp.buf = (u8 *)mgmt;
5506         resp.len = len;
5507         resp.req_ies = ifmgd->assoc_req_ies;
5508         resp.req_ies_len = ifmgd->assoc_req_ies_len;
5509         cfg80211_rx_assoc_resp(sdata->dev, &resp);
5510 notify_driver:
5511         drv_mgd_complete_tx(sdata->local, sdata, &info);
5512         kfree(elems);
5513         return;
5514 abandon_assoc:
5515         ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
5516         goto notify_driver;
5517 }
5518
5519 static void ieee80211_rx_bss_info(struct ieee80211_link_data *link,
5520                                   struct ieee80211_mgmt *mgmt, size_t len,
5521                                   struct ieee80211_rx_status *rx_status)
5522 {
5523         struct ieee80211_sub_if_data *sdata = link->sdata;
5524         struct ieee80211_local *local = sdata->local;
5525         struct ieee80211_bss *bss;
5526         struct ieee80211_channel *channel;
5527
5528         lockdep_assert_wiphy(sdata->local->hw.wiphy);
5529
5530         channel = ieee80211_get_channel_khz(local->hw.wiphy,
5531                                         ieee80211_rx_status_to_khz(rx_status));
5532         if (!channel)
5533                 return;
5534
5535         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
5536         if (bss) {
5537                 link->conf->beacon_rate = bss->beacon_rate;
5538                 ieee80211_rx_bss_put(local, bss);
5539         }
5540 }
5541
5542
5543 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_link_data *link,
5544                                          struct sk_buff *skb)
5545 {
5546         struct ieee80211_sub_if_data *sdata = link->sdata;
5547         struct ieee80211_mgmt *mgmt = (void *)skb->data;
5548         struct ieee80211_if_managed *ifmgd;
5549         struct ieee80211_rx_status *rx_status = (void *) skb->cb;
5550         struct ieee80211_channel *channel;
5551         size_t baselen, len = skb->len;
5552
5553         ifmgd = &sdata->u.mgd;
5554
5555         lockdep_assert_wiphy(sdata->local->hw.wiphy);
5556
5557         /*
5558          * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
5559          * "If a 6 GHz AP receives a Probe Request frame  and responds with
5560          * a Probe Response frame [..], the Address 1 field of the Probe
5561          * Response frame shall be set to the broadcast address [..]"
5562          * So, on 6GHz band we should also accept broadcast responses.
5563          */
5564         channel = ieee80211_get_channel(sdata->local->hw.wiphy,
5565                                         rx_status->freq);
5566         if (!channel)
5567                 return;
5568
5569         if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
5570             (channel->band != NL80211_BAND_6GHZ ||
5571              !is_broadcast_ether_addr(mgmt->da)))
5572                 return; /* ignore ProbeResp to foreign address */
5573
5574         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
5575         if (baselen > len)
5576                 return;
5577
5578         ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5579
5580         if (ifmgd->associated &&
5581             ether_addr_equal(mgmt->bssid, link->u.mgd.bssid))
5582                 ieee80211_reset_ap_probe(sdata);
5583 }
5584
5585 /*
5586  * This is the canonical list of information elements we care about,
5587  * the filter code also gives us all changes to the Microsoft OUI
5588  * (00:50:F2) vendor IE which is used for WMM which we need to track,
5589  * as well as the DTPC IE (part of the Cisco OUI) used for signaling
5590  * changes to requested client power.
5591  *
5592  * We implement beacon filtering in software since that means we can
5593  * avoid processing the frame here and in cfg80211, and userspace
5594  * will not be able to tell whether the hardware supports it or not.
5595  *
5596  * XXX: This list needs to be dynamic -- userspace needs to be able to
5597  *      add items it requires. It also needs to be able to tell us to
5598  *      look out for other vendor IEs.
5599  */
5600 static const u64 care_about_ies =
5601         (1ULL << WLAN_EID_COUNTRY) |
5602         (1ULL << WLAN_EID_ERP_INFO) |
5603         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
5604         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
5605         (1ULL << WLAN_EID_HT_CAPABILITY) |
5606         (1ULL << WLAN_EID_HT_OPERATION) |
5607         (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
5608
5609 static void ieee80211_handle_beacon_sig(struct ieee80211_link_data *link,
5610                                         struct ieee80211_if_managed *ifmgd,
5611                                         struct ieee80211_bss_conf *bss_conf,
5612                                         struct ieee80211_local *local,
5613                                         struct ieee80211_rx_status *rx_status)
5614 {
5615         struct ieee80211_sub_if_data *sdata = link->sdata;
5616
5617         /* Track average RSSI from the Beacon frames of the current AP */
5618
5619         if (!link->u.mgd.tracking_signal_avg) {
5620                 link->u.mgd.tracking_signal_avg = true;
5621                 ewma_beacon_signal_init(&link->u.mgd.ave_beacon_signal);
5622                 link->u.mgd.last_cqm_event_signal = 0;
5623                 link->u.mgd.count_beacon_signal = 1;
5624                 link->u.mgd.last_ave_beacon_signal = 0;
5625         } else {
5626                 link->u.mgd.count_beacon_signal++;
5627         }
5628
5629         ewma_beacon_signal_add(&link->u.mgd.ave_beacon_signal,
5630                                -rx_status->signal);
5631
5632         if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
5633             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5634                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5635                 int last_sig = link->u.mgd.last_ave_beacon_signal;
5636                 struct ieee80211_event event = {
5637                         .type = RSSI_EVENT,
5638                 };
5639
5640                 /*
5641                  * if signal crosses either of the boundaries, invoke callback
5642                  * with appropriate parameters
5643                  */
5644                 if (sig > ifmgd->rssi_max_thold &&
5645                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
5646                         link->u.mgd.last_ave_beacon_signal = sig;
5647                         event.u.rssi.data = RSSI_EVENT_HIGH;
5648                         drv_event_callback(local, sdata, &event);
5649                 } else if (sig < ifmgd->rssi_min_thold &&
5650                            (last_sig >= ifmgd->rssi_max_thold ||
5651                            last_sig == 0)) {
5652                         link->u.mgd.last_ave_beacon_signal = sig;
5653                         event.u.rssi.data = RSSI_EVENT_LOW;
5654                         drv_event_callback(local, sdata, &event);
5655                 }
5656         }
5657
5658         if (bss_conf->cqm_rssi_thold &&
5659             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
5660             !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
5661                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5662                 int last_event = link->u.mgd.last_cqm_event_signal;
5663                 int thold = bss_conf->cqm_rssi_thold;
5664                 int hyst = bss_conf->cqm_rssi_hyst;
5665
5666                 if (sig < thold &&
5667                     (last_event == 0 || sig < last_event - hyst)) {
5668                         link->u.mgd.last_cqm_event_signal = sig;
5669                         ieee80211_cqm_rssi_notify(
5670                                 &sdata->vif,
5671                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5672                                 sig, GFP_KERNEL);
5673                 } else if (sig > thold &&
5674                            (last_event == 0 || sig > last_event + hyst)) {
5675                         link->u.mgd.last_cqm_event_signal = sig;
5676                         ieee80211_cqm_rssi_notify(
5677                                 &sdata->vif,
5678                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5679                                 sig, GFP_KERNEL);
5680                 }
5681         }
5682
5683         if (bss_conf->cqm_rssi_low &&
5684             link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5685                 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5686                 int last_event = link->u.mgd.last_cqm_event_signal;
5687                 int low = bss_conf->cqm_rssi_low;
5688                 int high = bss_conf->cqm_rssi_high;
5689
5690                 if (sig < low &&
5691                     (last_event == 0 || last_event >= low)) {
5692                         link->u.mgd.last_cqm_event_signal = sig;
5693                         ieee80211_cqm_rssi_notify(
5694                                 &sdata->vif,
5695                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5696                                 sig, GFP_KERNEL);
5697                 } else if (sig > high &&
5698                            (last_event == 0 || last_event <= high)) {
5699                         link->u.mgd.last_cqm_event_signal = sig;
5700                         ieee80211_cqm_rssi_notify(
5701                                 &sdata->vif,
5702                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5703                                 sig, GFP_KERNEL);
5704                 }
5705         }
5706 }
5707
5708 static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
5709                                     struct cfg80211_bss *bss)
5710 {
5711         if (ether_addr_equal(tx_bssid, bss->bssid))
5712                 return true;
5713         if (!bss->transmitted_bss)
5714                 return false;
5715         return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
5716 }
5717
5718 static void ieee80211_ml_reconf_work(struct wiphy *wiphy,
5719                                      struct wiphy_work *work)
5720 {
5721         struct ieee80211_sub_if_data *sdata =
5722                 container_of(work, struct ieee80211_sub_if_data,
5723                              u.mgd.ml_reconf_work.work);
5724         u16 new_valid_links, new_active_links, new_dormant_links;
5725         int ret;
5726
5727         if (!sdata->u.mgd.removed_links)
5728                 return;
5729
5730         sdata_info(sdata,
5731                    "MLO Reconfiguration: work: valid=0x%x, removed=0x%x\n",
5732                    sdata->vif.valid_links, sdata->u.mgd.removed_links);
5733
5734         new_valid_links = sdata->vif.valid_links & ~sdata->u.mgd.removed_links;
5735         if (new_valid_links == sdata->vif.valid_links)
5736                 return;
5737
5738         if (!new_valid_links ||
5739             !(new_valid_links & ~sdata->vif.dormant_links)) {
5740                 sdata_info(sdata, "No valid links after reconfiguration\n");
5741                 ret = -EINVAL;
5742                 goto out;
5743         }
5744
5745         new_active_links = sdata->vif.active_links & ~sdata->u.mgd.removed_links;
5746         if (new_active_links != sdata->vif.active_links) {
5747                 if (!new_active_links)
5748                         new_active_links =
5749                                 BIT(ffs(new_valid_links &
5750                                         ~sdata->vif.dormant_links) - 1);
5751
5752                 ret = ieee80211_set_active_links(&sdata->vif, new_active_links);
5753                 if (ret) {
5754                         sdata_info(sdata,
5755                                    "Failed setting active links\n");
5756                         goto out;
5757                 }
5758         }
5759
5760         new_dormant_links = sdata->vif.dormant_links & ~sdata->u.mgd.removed_links;
5761
5762         ret = ieee80211_vif_set_links(sdata, new_valid_links,
5763                                       new_dormant_links);
5764         if (ret)
5765                 sdata_info(sdata, "Failed setting valid links\n");
5766
5767         ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_MLD_VALID_LINKS);
5768
5769 out:
5770         if (!ret)
5771                 cfg80211_links_removed(sdata->dev, sdata->u.mgd.removed_links);
5772         else
5773                 __ieee80211_disconnect(sdata);
5774
5775         sdata->u.mgd.removed_links = 0;
5776 }
5777
5778 static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,
5779                                          struct ieee802_11_elems *elems)
5780 {
5781         const struct element *sub;
5782         unsigned long removed_links = 0;
5783         u16 link_removal_timeout[IEEE80211_MLD_MAX_NUM_LINKS] = {};
5784         u8 link_id;
5785         u32 delay;
5786
5787         if (!ieee80211_vif_is_mld(&sdata->vif) || !elems->ml_reconf)
5788                 return;
5789
5790         /* Directly parse the sub elements as the common information doesn't
5791          * hold any useful information.
5792          */
5793         for_each_mle_subelement(sub, (const u8 *)elems->ml_reconf,
5794                                 elems->ml_reconf_len) {
5795                 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
5796                 u8 *pos = prof->variable;
5797                 u16 control;
5798
5799                 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
5800                         continue;
5801
5802                 if (!ieee80211_mle_reconf_sta_prof_size_ok(sub->data,
5803                                                            sub->datalen))
5804                         return;
5805
5806                 control = le16_to_cpu(prof->control);
5807                 link_id = control & IEEE80211_MLE_STA_RECONF_CONTROL_LINK_ID;
5808
5809                 removed_links |= BIT(link_id);
5810
5811                 /* the MAC address should not be included, but handle it */
5812                 if (control &
5813                     IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT)
5814                         pos += 6;
5815
5816                 /* According to Draft P802.11be_D3.0, the control should
5817                  * include the AP Removal Timer present. If the AP Removal Timer
5818                  * is not present assume immediate removal.
5819                  */
5820                 if (control &
5821                     IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT)
5822                         link_removal_timeout[link_id] = get_unaligned_le16(pos);
5823         }
5824
5825         removed_links &= sdata->vif.valid_links;
5826         if (!removed_links) {
5827                 /* In case the removal was cancelled, abort it */
5828                 if (sdata->u.mgd.removed_links) {
5829                         sdata->u.mgd.removed_links = 0;
5830                         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
5831                                                   &sdata->u.mgd.ml_reconf_work);
5832                 }
5833                 return;
5834         }
5835
5836         delay = 0;
5837         for_each_set_bit(link_id, &removed_links, IEEE80211_MLD_MAX_NUM_LINKS) {
5838                 struct ieee80211_bss_conf *link_conf =
5839                         sdata_dereference(sdata->vif.link_conf[link_id], sdata);
5840                 u32 link_delay;
5841
5842                 if (!link_conf) {
5843                         removed_links &= ~BIT(link_id);
5844                         continue;
5845                 }
5846
5847                 if (link_removal_timeout[link_id] < 1)
5848                         link_delay = 0;
5849                 else
5850                         link_delay = link_conf->beacon_int *
5851                                 (link_removal_timeout[link_id] - 1);
5852
5853                 if (!delay)
5854                         delay = link_delay;
5855                 else
5856                         delay = min(delay, link_delay);
5857         }
5858
5859         sdata->u.mgd.removed_links = removed_links;
5860         wiphy_delayed_work_queue(sdata->local->hw.wiphy,
5861                                  &sdata->u.mgd.ml_reconf_work,
5862                                  TU_TO_JIFFIES(delay));
5863 }
5864
5865 static int ieee80211_ttlm_set_links(struct ieee80211_sub_if_data *sdata,
5866                                     u16 active_links, u16 dormant_links,
5867                                     u16 suspended_links)
5868 {
5869         u64 changed = 0;
5870         int ret;
5871
5872         if (!active_links) {
5873                 ret = -EINVAL;
5874                 goto out;
5875         }
5876
5877         /* If there is an active negotiated TTLM, it should be discarded by
5878          * the new negotiated/advertised TTLM.
5879          */
5880         if (sdata->vif.neg_ttlm.valid) {
5881                 memset(&sdata->vif.neg_ttlm, 0, sizeof(sdata->vif.neg_ttlm));
5882                 sdata->vif.suspended_links = 0;
5883                 changed = BSS_CHANGED_MLD_TTLM;
5884         }
5885
5886         if (sdata->vif.active_links != active_links) {
5887                 /* usable links are affected when active_links are changed,
5888                  * so notify the driver about the status change
5889                  */
5890                 changed |= BSS_CHANGED_MLD_VALID_LINKS;
5891                 active_links &= sdata->vif.active_links;
5892                 if (!active_links)
5893                         active_links =
5894                                 BIT(__ffs(sdata->vif.valid_links &
5895                                     ~dormant_links));
5896                 ret = ieee80211_set_active_links(&sdata->vif, active_links);
5897                 if (ret) {
5898                         sdata_info(sdata, "Failed to set TTLM active links\n");
5899                         goto out;
5900                 }
5901         }
5902
5903         ret = ieee80211_vif_set_links(sdata, sdata->vif.valid_links,
5904                                       dormant_links);
5905         if (ret) {
5906                 sdata_info(sdata, "Failed to set TTLM dormant links\n");
5907                 goto out;
5908         }
5909
5910         sdata->vif.suspended_links = suspended_links;
5911         if (sdata->vif.suspended_links)
5912                 changed |= BSS_CHANGED_MLD_TTLM;
5913
5914         ieee80211_vif_cfg_change_notify(sdata, changed);
5915
5916 out:
5917         if (ret)
5918                 ieee80211_disconnect(&sdata->vif, false);
5919
5920         return ret;
5921 }
5922
5923 static void ieee80211_tid_to_link_map_work(struct wiphy *wiphy,
5924                                            struct wiphy_work *work)
5925 {
5926         u16 new_active_links, new_dormant_links;
5927         struct ieee80211_sub_if_data *sdata =
5928                 container_of(work, struct ieee80211_sub_if_data,
5929                              u.mgd.ttlm_work.work);
5930
5931         new_active_links = sdata->u.mgd.ttlm_info.map &
5932                            sdata->vif.valid_links;
5933         new_dormant_links = ~sdata->u.mgd.ttlm_info.map &
5934                             sdata->vif.valid_links;
5935
5936         ieee80211_vif_set_links(sdata, sdata->vif.valid_links, 0);
5937         if (ieee80211_ttlm_set_links(sdata, new_active_links, new_dormant_links,
5938                                      0))
5939                 return;
5940
5941         sdata->u.mgd.ttlm_info.active = true;
5942         sdata->u.mgd.ttlm_info.switch_time = 0;
5943 }
5944
5945 static u16 ieee80211_get_ttlm(u8 bm_size, u8 *data)
5946 {
5947         if (bm_size == 1)
5948                 return *data;
5949         else
5950                 return get_unaligned_le16(data);
5951 }
5952
5953 static int
5954 ieee80211_parse_adv_t2l(struct ieee80211_sub_if_data *sdata,
5955                         const struct ieee80211_ttlm_elem *ttlm,
5956                         struct ieee80211_adv_ttlm_info *ttlm_info)
5957 {
5958         /* The element size was already validated in
5959          * ieee80211_tid_to_link_map_size_ok()
5960          */
5961         u8 control, link_map_presence, map_size, tid;
5962         u8 *pos;
5963
5964         memset(ttlm_info, 0, sizeof(*ttlm_info));
5965         pos = (void *)ttlm->optional;
5966         control = ttlm->control;
5967
5968         if ((control & IEEE80211_TTLM_CONTROL_DEF_LINK_MAP) ||
5969             !(control & IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT))
5970                 return 0;
5971
5972         if ((control & IEEE80211_TTLM_CONTROL_DIRECTION) !=
5973             IEEE80211_TTLM_DIRECTION_BOTH) {
5974                 sdata_info(sdata, "Invalid advertised T2L map direction\n");
5975                 return -EINVAL;
5976         }
5977
5978         link_map_presence = *pos;
5979         pos++;
5980
5981         ttlm_info->switch_time = get_unaligned_le16(pos);
5982
5983         /* Since ttlm_info->switch_time == 0 means no switch time, bump it
5984          * by 1.
5985          */
5986         if (!ttlm_info->switch_time)
5987                 ttlm_info->switch_time = 1;
5988
5989         pos += 2;
5990
5991         if (control & IEEE80211_TTLM_CONTROL_EXPECTED_DUR_PRESENT) {
5992                 ttlm_info->duration = pos[0] | pos[1] << 8 | pos[2] << 16;
5993                 pos += 3;
5994         }
5995
5996         if (control & IEEE80211_TTLM_CONTROL_LINK_MAP_SIZE)
5997                 map_size = 1;
5998         else
5999                 map_size = 2;
6000
6001         /* According to Draft P802.11be_D3.0 clause 35.3.7.1.7, an AP MLD shall
6002          * not advertise a TID-to-link mapping that does not map all TIDs to the
6003          * same link set, reject frame if not all links have mapping
6004          */
6005         if (link_map_presence != 0xff) {
6006                 sdata_info(sdata,
6007                            "Invalid advertised T2L mapping presence indicator\n");
6008                 return -EINVAL;
6009         }
6010
6011         ttlm_info->map = ieee80211_get_ttlm(map_size, pos);
6012         if (!ttlm_info->map) {
6013                 sdata_info(sdata,
6014                            "Invalid advertised T2L map for TID 0\n");
6015                 return -EINVAL;
6016         }
6017
6018         pos += map_size;
6019
6020         for (tid = 1; tid < 8; tid++) {
6021                 u16 map = ieee80211_get_ttlm(map_size, pos);
6022
6023                 if (map != ttlm_info->map) {
6024                         sdata_info(sdata, "Invalid advertised T2L map for tid %d\n",
6025                                    tid);
6026                         return -EINVAL;
6027                 }
6028
6029                 pos += map_size;
6030         }
6031         return 0;
6032 }
6033
6034 static void ieee80211_process_adv_ttlm(struct ieee80211_sub_if_data *sdata,
6035                                           struct ieee802_11_elems *elems,
6036                                           u64 beacon_ts)
6037 {
6038         u8 i;
6039         int ret;
6040
6041         if (!ieee80211_vif_is_mld(&sdata->vif))
6042                 return;
6043
6044         if (!elems->ttlm_num) {
6045                 if (sdata->u.mgd.ttlm_info.switch_time) {
6046                         /* if a planned TID-to-link mapping was cancelled -
6047                          * abort it
6048                          */
6049                         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
6050                                                   &sdata->u.mgd.ttlm_work);
6051                 } else if (sdata->u.mgd.ttlm_info.active) {
6052                         /* if no TID-to-link element, set to default mapping in
6053                          * which all TIDs are mapped to all setup links
6054                          */
6055                         ret = ieee80211_vif_set_links(sdata,
6056                                                       sdata->vif.valid_links,
6057                                                       0);
6058                         if (ret) {
6059                                 sdata_info(sdata, "Failed setting valid/dormant links\n");
6060                                 return;
6061                         }
6062                         ieee80211_vif_cfg_change_notify(sdata,
6063                                                         BSS_CHANGED_MLD_VALID_LINKS);
6064                 }
6065                 memset(&sdata->u.mgd.ttlm_info, 0,
6066                        sizeof(sdata->u.mgd.ttlm_info));
6067                 return;
6068         }
6069
6070         for (i = 0; i < elems->ttlm_num; i++) {
6071                 struct ieee80211_adv_ttlm_info ttlm_info;
6072                 u32 res;
6073
6074                 res = ieee80211_parse_adv_t2l(sdata, elems->ttlm[i],
6075                                               &ttlm_info);
6076
6077                 if (res) {
6078                         __ieee80211_disconnect(sdata);
6079                         return;
6080                 }
6081
6082                 if (ttlm_info.switch_time) {
6083                         u16 beacon_ts_tu, st_tu, delay;
6084                         u32 delay_jiffies;
6085                         u64 mask;
6086
6087                         /* The t2l map switch time is indicated with a partial
6088                          * TSF value (bits 10 to 25), get the partial beacon TS
6089                          * as well, and calc the delay to the start time.
6090                          */
6091                         mask = GENMASK_ULL(25, 10);
6092                         beacon_ts_tu = (beacon_ts & mask) >> 10;
6093                         st_tu = ttlm_info.switch_time;
6094                         delay = st_tu - beacon_ts_tu;
6095
6096                         /*
6097                          * If the switch time is far in the future, then it
6098                          * could also be the previous switch still being
6099                          * announced.
6100                          * We can simply ignore it for now, if it is a future
6101                          * switch the AP will continue to announce it anyway.
6102                          */
6103                         if (delay > IEEE80211_ADV_TTLM_ST_UNDERFLOW)
6104                                 return;
6105
6106                         delay_jiffies = TU_TO_JIFFIES(delay);
6107
6108                         /* Link switching can take time, so schedule it
6109                          * 100ms before to be ready on time
6110                          */
6111                         if (delay_jiffies > IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS)
6112                                 delay_jiffies -=
6113                                         IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS;
6114                         else
6115                                 delay_jiffies = 0;
6116
6117                         sdata->u.mgd.ttlm_info = ttlm_info;
6118                         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
6119                                                   &sdata->u.mgd.ttlm_work);
6120                         wiphy_delayed_work_queue(sdata->local->hw.wiphy,
6121                                                  &sdata->u.mgd.ttlm_work,
6122                                                  delay_jiffies);
6123                         return;
6124                 }
6125         }
6126 }
6127
6128 static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
6129                                      struct ieee80211_hdr *hdr, size_t len,
6130                                      struct ieee80211_rx_status *rx_status)
6131 {
6132         struct ieee80211_sub_if_data *sdata = link->sdata;
6133         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6134         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
6135         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
6136         struct ieee80211_mgmt *mgmt = (void *) hdr;
6137         size_t baselen;
6138         struct ieee802_11_elems *elems;
6139         struct ieee80211_local *local = sdata->local;
6140         struct ieee80211_chanctx_conf *chanctx_conf;
6141         struct ieee80211_supported_band *sband;
6142         struct ieee80211_channel *chan;
6143         struct link_sta_info *link_sta;
6144         struct sta_info *sta;
6145         u64 changed = 0;
6146         bool erp_valid;
6147         u8 erp_value = 0;
6148         u32 ncrc = 0;
6149         u8 *bssid, *variable = mgmt->u.beacon.variable;
6150         u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
6151         struct ieee80211_elems_parse_params parse_params = {
6152                 .mode = link->u.mgd.conn.mode,
6153                 .link_id = -1,
6154                 .from_ap = true,
6155         };
6156
6157         lockdep_assert_wiphy(local->hw.wiphy);
6158
6159         /* Process beacon from the current BSS */
6160         bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
6161         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
6162                 struct ieee80211_ext *ext = (void *) mgmt;
6163
6164                 if (ieee80211_is_s1g_short_beacon(ext->frame_control))
6165                         variable = ext->u.s1g_short_beacon.variable;
6166                 else
6167                         variable = ext->u.s1g_beacon.variable;
6168         }
6169
6170         baselen = (u8 *) variable - (u8 *) mgmt;
6171         if (baselen > len)
6172                 return;
6173
6174         parse_params.start = variable;
6175         parse_params.len = len - baselen;
6176
6177         rcu_read_lock();
6178         chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
6179         if (!chanctx_conf) {
6180                 rcu_read_unlock();
6181                 return;
6182         }
6183
6184         if (ieee80211_rx_status_to_khz(rx_status) !=
6185             ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
6186                 rcu_read_unlock();
6187                 return;
6188         }
6189         chan = chanctx_conf->def.chan;
6190         rcu_read_unlock();
6191
6192         if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
6193             !WARN_ON(ieee80211_vif_is_mld(&sdata->vif)) &&
6194             ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) {
6195                 parse_params.bss = ifmgd->assoc_data->link[0].bss;
6196                 elems = ieee802_11_parse_elems_full(&parse_params);
6197                 if (!elems)
6198                         return;
6199
6200                 ieee80211_rx_bss_info(link, mgmt, len, rx_status);
6201
6202                 if (elems->dtim_period)
6203                         link->u.mgd.dtim_period = elems->dtim_period;
6204                 link->u.mgd.have_beacon = true;
6205                 ifmgd->assoc_data->need_beacon = false;
6206                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
6207                     !ieee80211_is_s1g_beacon(hdr->frame_control)) {
6208                         link->conf->sync_tsf =
6209                                 le64_to_cpu(mgmt->u.beacon.timestamp);
6210                         link->conf->sync_device_ts =
6211                                 rx_status->device_timestamp;
6212                         link->conf->sync_dtim_count = elems->dtim_count;
6213                 }
6214
6215                 if (elems->mbssid_config_ie)
6216                         bss_conf->profile_periodicity =
6217                                 elems->mbssid_config_ie->profile_periodicity;
6218                 else
6219                         bss_conf->profile_periodicity = 0;
6220
6221                 if (elems->ext_capab_len >= 11 &&
6222                     (elems->ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
6223                         bss_conf->ema_ap = true;
6224                 else
6225                         bss_conf->ema_ap = false;
6226
6227                 /* continue assoc process */
6228                 ifmgd->assoc_data->timeout = jiffies;
6229                 ifmgd->assoc_data->timeout_started = true;
6230                 run_again(sdata, ifmgd->assoc_data->timeout);
6231                 kfree(elems);
6232                 return;
6233         }
6234
6235         if (!ifmgd->associated ||
6236             !ieee80211_rx_our_beacon(bssid, link->conf->bss))
6237                 return;
6238         bssid = link->u.mgd.bssid;
6239
6240         if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
6241                 ieee80211_handle_beacon_sig(link, ifmgd, bss_conf,
6242                                             local, rx_status);
6243
6244         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
6245                 mlme_dbg_ratelimited(sdata,
6246                                      "cancelling AP probe due to a received beacon\n");
6247                 ieee80211_reset_ap_probe(sdata);
6248         }
6249
6250         /*
6251          * Push the beacon loss detection into the future since
6252          * we are processing a beacon from the AP just now.
6253          */
6254         ieee80211_sta_reset_beacon_monitor(sdata);
6255
6256         /* TODO: CRC urrently not calculated on S1G Beacon Compatibility
6257          * element (which carries the beacon interval). Don't forget to add a
6258          * bit to care_about_ies[] above if mac80211 is interested in a
6259          * changing S1G element.
6260          */
6261         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
6262                 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
6263         parse_params.bss = link->conf->bss;
6264         parse_params.filter = care_about_ies;
6265         parse_params.crc = ncrc;
6266         elems = ieee802_11_parse_elems_full(&parse_params);
6267         if (!elems)
6268                 return;
6269         ncrc = elems->crc;
6270
6271         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
6272             ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid)) {
6273                 if (local->hw.conf.dynamic_ps_timeout > 0) {
6274                         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
6275                                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
6276                                 ieee80211_hw_config(local,
6277                                                     IEEE80211_CONF_CHANGE_PS);
6278                         }
6279                         ieee80211_send_nullfunc(local, sdata, false);
6280                 } else if (!local->pspolling && sdata->u.mgd.powersave) {
6281                         local->pspolling = true;
6282
6283                         /*
6284                          * Here is assumed that the driver will be
6285                          * able to send ps-poll frame and receive a
6286                          * response even though power save mode is
6287                          * enabled, but some drivers might require
6288                          * to disable power save here. This needs
6289                          * to be investigated.
6290                          */
6291                         ieee80211_send_pspoll(local, sdata);
6292                 }
6293         }
6294
6295         if (sdata->vif.p2p ||
6296             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
6297                 struct ieee80211_p2p_noa_attr noa = {};
6298                 int ret;
6299
6300                 ret = cfg80211_get_p2p_attr(variable,
6301                                             len - baselen,
6302                                             IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
6303                                             (u8 *) &noa, sizeof(noa));
6304                 if (ret >= 2) {
6305                         if (link->u.mgd.p2p_noa_index != noa.index) {
6306                                 /* valid noa_attr and index changed */
6307                                 link->u.mgd.p2p_noa_index = noa.index;
6308                                 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
6309                                 changed |= BSS_CHANGED_P2P_PS;
6310                                 /*
6311                                  * make sure we update all information, the CRC
6312                                  * mechanism doesn't look at P2P attributes.
6313                                  */
6314                                 link->u.mgd.beacon_crc_valid = false;
6315                         }
6316                 } else if (link->u.mgd.p2p_noa_index != -1) {
6317                         /* noa_attr not found and we had valid noa_attr before */
6318                         link->u.mgd.p2p_noa_index = -1;
6319                         memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
6320                         changed |= BSS_CHANGED_P2P_PS;
6321                         link->u.mgd.beacon_crc_valid = false;
6322                 }
6323         }
6324
6325         /*
6326          * Update beacon timing and dtim count on every beacon appearance. This
6327          * will allow the driver to use the most updated values. Do it before
6328          * comparing this one with last received beacon.
6329          * IMPORTANT: These parameters would possibly be out of sync by the time
6330          * the driver will use them. The synchronized view is currently
6331          * guaranteed only in certain callbacks.
6332          */
6333         if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
6334             !ieee80211_is_s1g_beacon(hdr->frame_control)) {
6335                 link->conf->sync_tsf =
6336                         le64_to_cpu(mgmt->u.beacon.timestamp);
6337                 link->conf->sync_device_ts =
6338                         rx_status->device_timestamp;
6339                 link->conf->sync_dtim_count = elems->dtim_count;
6340         }
6341
6342         if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) ||
6343             ieee80211_is_s1g_short_beacon(mgmt->frame_control))
6344                 goto free;
6345         link->u.mgd.beacon_crc = ncrc;
6346         link->u.mgd.beacon_crc_valid = true;
6347
6348         ieee80211_rx_bss_info(link, mgmt, len, rx_status);
6349
6350         ieee80211_sta_process_chanswitch(link, rx_status->mactime,
6351                                          rx_status->device_timestamp,
6352                                          elems, true);
6353
6354         if (!link->u.mgd.disable_wmm_tracking &&
6355             ieee80211_sta_wmm_params(local, link, elems->wmm_param,
6356                                      elems->wmm_param_len,
6357                                      elems->mu_edca_param_set))
6358                 changed |= BSS_CHANGED_QOS;
6359
6360         /*
6361          * If we haven't had a beacon before, tell the driver about the
6362          * DTIM period (and beacon timing if desired) now.
6363          */
6364         if (!link->u.mgd.have_beacon) {
6365                 /* a few bogus AP send dtim_period = 0 or no TIM IE */
6366                 bss_conf->dtim_period = elems->dtim_period ?: 1;
6367
6368                 changed |= BSS_CHANGED_BEACON_INFO;
6369                 link->u.mgd.have_beacon = true;
6370
6371                 ieee80211_recalc_ps(local);
6372
6373                 ieee80211_recalc_ps_vif(sdata);
6374         }
6375
6376         if (elems->erp_info) {
6377                 erp_valid = true;
6378                 erp_value = elems->erp_info[0];
6379         } else {
6380                 erp_valid = false;
6381         }
6382
6383         if (!ieee80211_is_s1g_beacon(hdr->frame_control))
6384                 changed |= ieee80211_handle_bss_capability(link,
6385                                 le16_to_cpu(mgmt->u.beacon.capab_info),
6386                                 erp_valid, erp_value);
6387
6388         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
6389         if (WARN_ON(!sta)) {
6390                 goto free;
6391         }
6392         link_sta = rcu_dereference_protected(sta->link[link->link_id],
6393                                              lockdep_is_held(&local->hw.wiphy->mtx));
6394         if (WARN_ON(!link_sta)) {
6395                 goto free;
6396         }
6397
6398         if (WARN_ON(!link->conf->chanreq.oper.chan))
6399                 goto free;
6400
6401         sband = local->hw.wiphy->bands[link->conf->chanreq.oper.chan->band];
6402
6403         changed |= ieee80211_recalc_twt_req(sdata, sband, link, link_sta, elems);
6404
6405         if (ieee80211_config_bw(link, elems, true, &changed)) {
6406                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
6407                                        WLAN_REASON_DEAUTH_LEAVING,
6408                                        true, deauth_buf);
6409                 ieee80211_report_disconnect(sdata, deauth_buf,
6410                                             sizeof(deauth_buf), true,
6411                                             WLAN_REASON_DEAUTH_LEAVING,
6412                                             false);
6413                 goto free;
6414         }
6415
6416         if (elems->opmode_notif)
6417                 ieee80211_vht_handle_opmode(sdata, link_sta,
6418                                             *elems->opmode_notif,
6419                                             rx_status->band);
6420
6421         changed |= ieee80211_handle_pwr_constr(link, chan, mgmt,
6422                                                elems->country_elem,
6423                                                elems->country_elem_len,
6424                                                elems->pwr_constr_elem,
6425                                                elems->cisco_dtpc_elem);
6426
6427         ieee80211_ml_reconfiguration(sdata, elems);
6428         ieee80211_process_adv_ttlm(sdata, elems,
6429                                       le64_to_cpu(mgmt->u.beacon.timestamp));
6430
6431         ieee80211_link_info_change_notify(sdata, link, changed);
6432 free:
6433         kfree(elems);
6434 }
6435
6436 static void ieee80211_apply_neg_ttlm(struct ieee80211_sub_if_data *sdata,
6437                                      struct ieee80211_neg_ttlm neg_ttlm)
6438 {
6439         u16 new_active_links, new_dormant_links, new_suspended_links, map = 0;
6440         u8 i;
6441
6442         for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++)
6443                 map |= neg_ttlm.downlink[i] | neg_ttlm.uplink[i];
6444
6445         /* If there is an active TTLM, unset previously suspended links */
6446         if (sdata->vif.neg_ttlm.valid)
6447                 sdata->vif.dormant_links &= ~sdata->vif.suspended_links;
6448
6449         /* exclude links that are already disabled by advertised TTLM */
6450         new_active_links =
6451                 map & sdata->vif.valid_links & ~sdata->vif.dormant_links;
6452         new_suspended_links =
6453                 (~map & sdata->vif.valid_links) & ~sdata->vif.dormant_links;
6454         new_dormant_links = sdata->vif.dormant_links | new_suspended_links;
6455         if (ieee80211_ttlm_set_links(sdata, new_active_links,
6456                                      new_dormant_links, new_suspended_links))
6457                 return;
6458
6459         sdata->vif.neg_ttlm = neg_ttlm;
6460         sdata->vif.neg_ttlm.valid = true;
6461 }
6462
6463 static void ieee80211_neg_ttlm_timeout_work(struct wiphy *wiphy,
6464                                             struct wiphy_work *work)
6465 {
6466         struct ieee80211_sub_if_data *sdata =
6467                 container_of(work, struct ieee80211_sub_if_data,
6468                              u.mgd.neg_ttlm_timeout_work.work);
6469
6470         sdata_info(sdata,
6471                    "No negotiated TTLM response from AP, disconnecting.\n");
6472
6473         __ieee80211_disconnect(sdata);
6474 }
6475
6476 static void
6477 ieee80211_neg_ttlm_add_suggested_map(struct sk_buff *skb,
6478                                      struct ieee80211_neg_ttlm *neg_ttlm)
6479 {
6480         u8 i, direction[IEEE80211_TTLM_MAX_CNT];
6481
6482         if (memcmp(neg_ttlm->downlink, neg_ttlm->uplink,
6483                    sizeof(neg_ttlm->downlink))) {
6484                 direction[0] = IEEE80211_TTLM_DIRECTION_DOWN;
6485                 direction[1] = IEEE80211_TTLM_DIRECTION_UP;
6486         } else {
6487                 direction[0] = IEEE80211_TTLM_DIRECTION_BOTH;
6488         }
6489
6490         for (i = 0; i < ARRAY_SIZE(direction); i++) {
6491                 u8 tid, len, map_ind = 0, *len_pos, *map_ind_pos, *pos;
6492                 __le16 map;
6493
6494                 len = sizeof(struct ieee80211_ttlm_elem) + 1 + 1;
6495
6496                 pos = skb_put(skb, len + 2);
6497                 *pos++ = WLAN_EID_EXTENSION;
6498                 len_pos = pos++;
6499                 *pos++ = WLAN_EID_EXT_TID_TO_LINK_MAPPING;
6500                 *pos++ = direction[i];
6501                 map_ind_pos = pos++;
6502                 for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) {
6503                         map = direction[i] == IEEE80211_TTLM_DIRECTION_UP ?
6504                                 cpu_to_le16(neg_ttlm->uplink[tid]) :
6505                                 cpu_to_le16(neg_ttlm->downlink[tid]);
6506                         if (!map)
6507                                 continue;
6508
6509                         len += 2;
6510                         map_ind |= BIT(tid);
6511                         skb_put_data(skb, &map, sizeof(map));
6512                 }
6513
6514                 *map_ind_pos = map_ind;
6515                 *len_pos = len;
6516
6517                 if (direction[i] == IEEE80211_TTLM_DIRECTION_BOTH)
6518                         break;
6519         }
6520 }
6521
6522 static void
6523 ieee80211_send_neg_ttlm_req(struct ieee80211_sub_if_data *sdata,
6524                             struct ieee80211_neg_ttlm *neg_ttlm,
6525                             u8 dialog_token)
6526 {
6527         struct ieee80211_local *local = sdata->local;
6528         struct ieee80211_mgmt *mgmt;
6529         struct sk_buff *skb;
6530         int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.ttlm_req);
6531         int ttlm_max_len = 2 + 1 + sizeof(struct ieee80211_ttlm_elem) + 1 +
6532                 2 * 2 * IEEE80211_TTLM_NUM_TIDS;
6533
6534         skb = dev_alloc_skb(local->tx_headroom + hdr_len + ttlm_max_len);
6535         if (!skb)
6536                 return;
6537
6538         skb_reserve(skb, local->tx_headroom);
6539         mgmt = skb_put_zero(skb, hdr_len);
6540         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
6541                                           IEEE80211_STYPE_ACTION);
6542         memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
6543         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
6544         memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
6545
6546         mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
6547         mgmt->u.action.u.ttlm_req.action_code =
6548                 WLAN_PROTECTED_EHT_ACTION_TTLM_REQ;
6549         mgmt->u.action.u.ttlm_req.dialog_token = dialog_token;
6550         ieee80211_neg_ttlm_add_suggested_map(skb, neg_ttlm);
6551         ieee80211_tx_skb(sdata, skb);
6552 }
6553
6554 int ieee80211_req_neg_ttlm(struct ieee80211_sub_if_data *sdata,
6555                            struct cfg80211_ttlm_params *params)
6556 {
6557         struct ieee80211_neg_ttlm neg_ttlm = {};
6558         u8 i;
6559
6560         if (!ieee80211_vif_is_mld(&sdata->vif) ||
6561             !(sdata->vif.cfg.mld_capa_op &
6562               IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP))
6563                 return -EINVAL;
6564
6565         for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) {
6566                 if ((params->dlink[i] & ~sdata->vif.valid_links) ||
6567                     (params->ulink[i] & ~sdata->vif.valid_links))
6568                         return -EINVAL;
6569
6570                 neg_ttlm.downlink[i] = params->dlink[i];
6571                 neg_ttlm.uplink[i] = params->ulink[i];
6572         }
6573
6574         if (drv_can_neg_ttlm(sdata->local, sdata, &neg_ttlm) !=
6575             NEG_TTLM_RES_ACCEPT)
6576                 return -EINVAL;
6577
6578         ieee80211_apply_neg_ttlm(sdata, neg_ttlm);
6579         sdata->u.mgd.dialog_token_alloc++;
6580         ieee80211_send_neg_ttlm_req(sdata, &sdata->vif.neg_ttlm,
6581                                     sdata->u.mgd.dialog_token_alloc);
6582         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
6583                                   &sdata->u.mgd.neg_ttlm_timeout_work);
6584         wiphy_delayed_work_queue(sdata->local->hw.wiphy,
6585                                  &sdata->u.mgd.neg_ttlm_timeout_work,
6586                                  IEEE80211_NEG_TTLM_REQ_TIMEOUT);
6587         return 0;
6588 }
6589
6590 static void
6591 ieee80211_send_neg_ttlm_res(struct ieee80211_sub_if_data *sdata,
6592                             enum ieee80211_neg_ttlm_res ttlm_res,
6593                             u8 dialog_token,
6594                             struct ieee80211_neg_ttlm *neg_ttlm)
6595 {
6596         struct ieee80211_local *local = sdata->local;
6597         struct ieee80211_mgmt *mgmt;
6598         struct sk_buff *skb;
6599         int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.ttlm_res);
6600         int ttlm_max_len = 2 + 1 + sizeof(struct ieee80211_ttlm_elem) + 1 +
6601                 2 * 2 * IEEE80211_TTLM_NUM_TIDS;
6602
6603         skb = dev_alloc_skb(local->tx_headroom + hdr_len + ttlm_max_len);
6604         if (!skb)
6605                 return;
6606
6607         skb_reserve(skb, local->tx_headroom);
6608         mgmt = skb_put_zero(skb, hdr_len);
6609         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
6610                                           IEEE80211_STYPE_ACTION);
6611         memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
6612         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
6613         memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
6614
6615         mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
6616         mgmt->u.action.u.ttlm_res.action_code =
6617                 WLAN_PROTECTED_EHT_ACTION_TTLM_RES;
6618         mgmt->u.action.u.ttlm_res.dialog_token = dialog_token;
6619         switch (ttlm_res) {
6620         default:
6621                 WARN_ON(1);
6622                 fallthrough;
6623         case NEG_TTLM_RES_REJECT:
6624                 mgmt->u.action.u.ttlm_res.status_code =
6625                         WLAN_STATUS_DENIED_TID_TO_LINK_MAPPING;
6626                 break;
6627         case NEG_TTLM_RES_ACCEPT:
6628                 mgmt->u.action.u.ttlm_res.status_code = WLAN_STATUS_SUCCESS;
6629                 break;
6630         case NEG_TTLM_RES_SUGGEST_PREFERRED:
6631                 mgmt->u.action.u.ttlm_res.status_code =
6632                         WLAN_STATUS_PREF_TID_TO_LINK_MAPPING_SUGGESTED;
6633                 ieee80211_neg_ttlm_add_suggested_map(skb, neg_ttlm);
6634                 break;
6635         }
6636
6637         ieee80211_tx_skb(sdata, skb);
6638 }
6639
6640 static int
6641 ieee80211_parse_neg_ttlm(struct ieee80211_sub_if_data *sdata,
6642                          const struct ieee80211_ttlm_elem *ttlm,
6643                          struct ieee80211_neg_ttlm *neg_ttlm,
6644                          u8 *direction)
6645 {
6646         u8 control, link_map_presence, map_size, tid;
6647         u8 *pos;
6648
6649         /* The element size was already validated in
6650          * ieee80211_tid_to_link_map_size_ok()
6651          */
6652         pos = (void *)ttlm->optional;
6653
6654         control = ttlm->control;
6655
6656         /* mapping switch time and expected duration fields are not expected
6657          * in case of negotiated TTLM
6658          */
6659         if (control & (IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT |
6660                        IEEE80211_TTLM_CONTROL_EXPECTED_DUR_PRESENT)) {
6661                 mlme_dbg(sdata,
6662                          "Invalid TTLM element in negotiated TTLM request\n");
6663                 return -EINVAL;
6664         }
6665
6666         if (control & IEEE80211_TTLM_CONTROL_DEF_LINK_MAP) {
6667                 for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) {
6668                         neg_ttlm->downlink[tid] = sdata->vif.valid_links;
6669                         neg_ttlm->uplink[tid] = sdata->vif.valid_links;
6670                 }
6671                 *direction = IEEE80211_TTLM_DIRECTION_BOTH;
6672                 return 0;
6673         }
6674
6675         *direction = u8_get_bits(control, IEEE80211_TTLM_CONTROL_DIRECTION);
6676         if (*direction != IEEE80211_TTLM_DIRECTION_DOWN &&
6677             *direction != IEEE80211_TTLM_DIRECTION_UP &&
6678             *direction != IEEE80211_TTLM_DIRECTION_BOTH)
6679                 return -EINVAL;
6680
6681         link_map_presence = *pos;
6682         pos++;
6683
6684         if (control & IEEE80211_TTLM_CONTROL_LINK_MAP_SIZE)
6685                 map_size = 1;
6686         else
6687                 map_size = 2;
6688
6689         for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) {
6690                 u16 map;
6691
6692                 if (link_map_presence & BIT(tid)) {
6693                         map = ieee80211_get_ttlm(map_size, pos);
6694                         if (!map) {
6695                                 mlme_dbg(sdata,
6696                                          "No active links for TID %d", tid);
6697                                 return -EINVAL;
6698                         }
6699                 } else {
6700                         map = 0;
6701                 }
6702
6703                 switch (*direction) {
6704                 case IEEE80211_TTLM_DIRECTION_BOTH:
6705                         neg_ttlm->downlink[tid] = map;
6706                         neg_ttlm->uplink[tid] = map;
6707                         break;
6708                 case IEEE80211_TTLM_DIRECTION_DOWN:
6709                         neg_ttlm->downlink[tid] = map;
6710                         break;
6711                 case IEEE80211_TTLM_DIRECTION_UP:
6712                         neg_ttlm->uplink[tid] = map;
6713                         break;
6714                 default:
6715                         return -EINVAL;
6716                 }
6717                 pos += map_size;
6718         }
6719         return 0;
6720 }
6721
6722 void ieee80211_process_neg_ttlm_req(struct ieee80211_sub_if_data *sdata,
6723                                     struct ieee80211_mgmt *mgmt, size_t len)
6724 {
6725         u8 dialog_token, direction[IEEE80211_TTLM_MAX_CNT] = {}, i;
6726         size_t ies_len;
6727         enum ieee80211_neg_ttlm_res ttlm_res = NEG_TTLM_RES_ACCEPT;
6728         struct ieee802_11_elems *elems = NULL;
6729         struct ieee80211_neg_ttlm neg_ttlm = {};
6730
6731         BUILD_BUG_ON(ARRAY_SIZE(direction) != ARRAY_SIZE(elems->ttlm));
6732
6733         if (!ieee80211_vif_is_mld(&sdata->vif))
6734                 return;
6735
6736         dialog_token = mgmt->u.action.u.ttlm_req.dialog_token;
6737         ies_len  = len - offsetof(struct ieee80211_mgmt,
6738                                   u.action.u.ttlm_req.variable);
6739         elems = ieee802_11_parse_elems(mgmt->u.action.u.ttlm_req.variable,
6740                                        ies_len, true, NULL);
6741         if (!elems) {
6742                 ttlm_res = NEG_TTLM_RES_REJECT;
6743                 goto out;
6744         }
6745
6746         for (i = 0; i < elems->ttlm_num; i++) {
6747                 if (ieee80211_parse_neg_ttlm(sdata, elems->ttlm[i],
6748                                              &neg_ttlm, &direction[i]) ||
6749                     (direction[i] == IEEE80211_TTLM_DIRECTION_BOTH &&
6750                      elems->ttlm_num != 1)) {
6751                         ttlm_res = NEG_TTLM_RES_REJECT;
6752                         goto out;
6753                 }
6754         }
6755
6756         if (!elems->ttlm_num ||
6757             (elems->ttlm_num == 2 && direction[0] == direction[1])) {
6758                 ttlm_res = NEG_TTLM_RES_REJECT;
6759                 goto out;
6760         }
6761
6762         for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) {
6763                 if ((neg_ttlm.downlink[i] &&
6764                      (neg_ttlm.downlink[i] & ~sdata->vif.valid_links)) ||
6765                     (neg_ttlm.uplink[i] &&
6766                      (neg_ttlm.uplink[i] & ~sdata->vif.valid_links))) {
6767                         ttlm_res = NEG_TTLM_RES_REJECT;
6768                         goto out;
6769                 }
6770         }
6771
6772         ttlm_res = drv_can_neg_ttlm(sdata->local, sdata, &neg_ttlm);
6773
6774         if (ttlm_res != NEG_TTLM_RES_ACCEPT)
6775                 goto out;
6776
6777         ieee80211_apply_neg_ttlm(sdata, neg_ttlm);
6778 out:
6779         kfree(elems);
6780         ieee80211_send_neg_ttlm_res(sdata, ttlm_res, dialog_token, &neg_ttlm);
6781 }
6782
6783 void ieee80211_process_neg_ttlm_res(struct ieee80211_sub_if_data *sdata,
6784                                     struct ieee80211_mgmt *mgmt, size_t len)
6785 {
6786         if (!ieee80211_vif_is_mld(&sdata->vif) ||
6787             mgmt->u.action.u.ttlm_req.dialog_token !=
6788             sdata->u.mgd.dialog_token_alloc)
6789                 return;
6790
6791         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
6792                                   &sdata->u.mgd.neg_ttlm_timeout_work);
6793
6794         /* MLD station sends a TID to link mapping request, mainly to handle
6795          * BTM (BSS transition management) request, in which case it needs to
6796          * restrict the active links set.
6797          * In this case it's not expected that the MLD AP will reject the
6798          * negotiated TTLM request.
6799          * This can be better implemented in the future, to handle request
6800          * rejections.
6801          */
6802         if (mgmt->u.action.u.ttlm_res.status_code != WLAN_STATUS_SUCCESS)
6803                 __ieee80211_disconnect(sdata);
6804 }
6805
6806 void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
6807                                  struct sk_buff *skb)
6808 {
6809         struct ieee80211_link_data *link = &sdata->deflink;
6810         struct ieee80211_rx_status *rx_status;
6811         struct ieee80211_hdr *hdr;
6812         u16 fc;
6813
6814         lockdep_assert_wiphy(sdata->local->hw.wiphy);
6815
6816         rx_status = (struct ieee80211_rx_status *) skb->cb;
6817         hdr = (struct ieee80211_hdr *) skb->data;
6818         fc = le16_to_cpu(hdr->frame_control);
6819
6820         switch (fc & IEEE80211_FCTL_STYPE) {
6821         case IEEE80211_STYPE_S1G_BEACON:
6822                 ieee80211_rx_mgmt_beacon(link, hdr, skb->len, rx_status);
6823                 break;
6824         }
6825 }
6826
6827 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
6828                                   struct sk_buff *skb)
6829 {
6830         struct ieee80211_link_data *link = &sdata->deflink;
6831         struct ieee80211_rx_status *rx_status;
6832         struct ieee80211_mgmt *mgmt;
6833         u16 fc;
6834         int ies_len;
6835
6836         lockdep_assert_wiphy(sdata->local->hw.wiphy);
6837
6838         rx_status = (struct ieee80211_rx_status *) skb->cb;
6839         mgmt = (struct ieee80211_mgmt *) skb->data;
6840         fc = le16_to_cpu(mgmt->frame_control);
6841
6842         if (rx_status->link_valid) {
6843                 link = sdata_dereference(sdata->link[rx_status->link_id],
6844                                          sdata);
6845                 if (!link)
6846                         return;
6847         }
6848
6849         switch (fc & IEEE80211_FCTL_STYPE) {
6850         case IEEE80211_STYPE_BEACON:
6851                 ieee80211_rx_mgmt_beacon(link, (void *)mgmt,
6852                                          skb->len, rx_status);
6853                 break;
6854         case IEEE80211_STYPE_PROBE_RESP:
6855                 ieee80211_rx_mgmt_probe_resp(link, skb);
6856                 break;
6857         case IEEE80211_STYPE_AUTH:
6858                 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
6859                 break;
6860         case IEEE80211_STYPE_DEAUTH:
6861                 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
6862                 break;
6863         case IEEE80211_STYPE_DISASSOC:
6864                 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
6865                 break;
6866         case IEEE80211_STYPE_ASSOC_RESP:
6867         case IEEE80211_STYPE_REASSOC_RESP:
6868                 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
6869                 break;
6870         case IEEE80211_STYPE_ACTION:
6871                 if (!sdata->u.mgd.associated ||
6872                     !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
6873                         break;
6874
6875                 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
6876                         struct ieee802_11_elems *elems;
6877
6878                         ies_len = skb->len -
6879                                   offsetof(struct ieee80211_mgmt,
6880                                            u.action.u.chan_switch.variable);
6881
6882                         if (ies_len < 0)
6883                                 break;
6884
6885                         /* CSA IE cannot be overridden, no need for BSSID */
6886                         elems = ieee802_11_parse_elems(
6887                                         mgmt->u.action.u.chan_switch.variable,
6888                                         ies_len, true, NULL);
6889
6890                         if (elems && !elems->parse_error)
6891                                 ieee80211_sta_process_chanswitch(link,
6892                                                                  rx_status->mactime,
6893                                                                  rx_status->device_timestamp,
6894                                                                  elems, false);
6895                         kfree(elems);
6896                 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
6897                         struct ieee802_11_elems *elems;
6898
6899                         ies_len = skb->len -
6900                                   offsetof(struct ieee80211_mgmt,
6901                                            u.action.u.ext_chan_switch.variable);
6902
6903                         if (ies_len < 0)
6904                                 break;
6905
6906                         /*
6907                          * extended CSA IE can't be overridden, no need for
6908                          * BSSID
6909                          */
6910                         elems = ieee802_11_parse_elems(
6911                                         mgmt->u.action.u.ext_chan_switch.variable,
6912                                         ies_len, true, NULL);
6913
6914                         if (elems && !elems->parse_error) {
6915                                 /* for the handling code pretend it was an IE */
6916                                 elems->ext_chansw_ie =
6917                                         &mgmt->u.action.u.ext_chan_switch.data;
6918
6919                                 ieee80211_sta_process_chanswitch(link,
6920                                                                  rx_status->mactime,
6921                                                                  rx_status->device_timestamp,
6922                                                                  elems, false);
6923                         }
6924
6925                         kfree(elems);
6926                 }
6927                 break;
6928         }
6929 }
6930
6931 static void ieee80211_sta_timer(struct timer_list *t)
6932 {
6933         struct ieee80211_sub_if_data *sdata =
6934                 from_timer(sdata, t, u.mgd.timer);
6935
6936         wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
6937 }
6938
6939 void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
6940                                    u8 reason, bool tx)
6941 {
6942         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6943
6944         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
6945                                tx, frame_buf);
6946
6947         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
6948                                     reason, false);
6949 }
6950
6951 static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
6952 {
6953         struct ieee80211_local *local = sdata->local;
6954         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6955         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
6956         u32 tx_flags = 0;
6957         u16 trans = 1;
6958         u16 status = 0;
6959         struct ieee80211_prep_tx_info info = {
6960                 .subtype = IEEE80211_STYPE_AUTH,
6961         };
6962
6963         lockdep_assert_wiphy(sdata->local->hw.wiphy);
6964
6965         if (WARN_ON_ONCE(!auth_data))
6966                 return -EINVAL;
6967
6968         auth_data->tries++;
6969
6970         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
6971                 sdata_info(sdata, "authentication with %pM timed out\n",
6972                            auth_data->ap_addr);
6973
6974                 /*
6975                  * Most likely AP is not in the range so remove the
6976                  * bss struct for that AP.
6977                  */
6978                 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
6979
6980                 return -ETIMEDOUT;
6981         }
6982
6983         if (auth_data->algorithm == WLAN_AUTH_SAE)
6984                 info.duration = jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);
6985
6986         info.link_id = auth_data->link_id;
6987         drv_mgd_prepare_tx(local, sdata, &info);
6988
6989         sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
6990                    auth_data->ap_addr, auth_data->tries,
6991                    IEEE80211_AUTH_MAX_TRIES);
6992
6993         auth_data->expected_transaction = 2;
6994
6995         if (auth_data->algorithm == WLAN_AUTH_SAE) {
6996                 trans = auth_data->sae_trans;
6997                 status = auth_data->sae_status;
6998                 auth_data->expected_transaction = trans;
6999         }
7000
7001         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
7002                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
7003                            IEEE80211_TX_INTFL_MLME_CONN_TX;
7004
7005         ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
7006                             auth_data->data, auth_data->data_len,
7007                             auth_data->ap_addr, auth_data->ap_addr,
7008                             NULL, 0, 0, tx_flags);
7009
7010         if (tx_flags == 0) {
7011                 if (auth_data->algorithm == WLAN_AUTH_SAE)
7012                         auth_data->timeout = jiffies +
7013                                 IEEE80211_AUTH_TIMEOUT_SAE;
7014                 else
7015                         auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
7016         } else {
7017                 auth_data->timeout =
7018                         round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
7019         }
7020
7021         auth_data->timeout_started = true;
7022         run_again(sdata, auth_data->timeout);
7023
7024         return 0;
7025 }
7026
7027 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
7028 {
7029         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
7030         struct ieee80211_local *local = sdata->local;
7031         int ret;
7032
7033         lockdep_assert_wiphy(sdata->local->hw.wiphy);
7034
7035         assoc_data->tries++;
7036         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
7037                 sdata_info(sdata, "association with %pM timed out\n",
7038                            assoc_data->ap_addr);
7039
7040                 /*
7041                  * Most likely AP is not in the range so remove the
7042                  * bss struct for that AP.
7043                  */
7044                 cfg80211_unlink_bss(local->hw.wiphy,
7045                                     assoc_data->link[assoc_data->assoc_link_id].bss);
7046
7047                 return -ETIMEDOUT;
7048         }
7049
7050         sdata_info(sdata, "associate with %pM (try %d/%d)\n",
7051                    assoc_data->ap_addr, assoc_data->tries,
7052                    IEEE80211_ASSOC_MAX_TRIES);
7053         ret = ieee80211_send_assoc(sdata);
7054         if (ret)
7055                 return ret;
7056
7057         if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
7058                 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
7059                 assoc_data->timeout_started = true;
7060                 run_again(sdata, assoc_data->timeout);
7061         } else {
7062                 assoc_data->timeout =
7063                         round_jiffies_up(jiffies +
7064                                          IEEE80211_ASSOC_TIMEOUT_LONG);
7065                 assoc_data->timeout_started = true;
7066                 run_again(sdata, assoc_data->timeout);
7067         }
7068
7069         return 0;
7070 }
7071
7072 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
7073                                   __le16 fc, bool acked)
7074 {
7075         struct ieee80211_local *local = sdata->local;
7076
7077         sdata->u.mgd.status_fc = fc;
7078         sdata->u.mgd.status_acked = acked;
7079         sdata->u.mgd.status_received = true;
7080
7081         wiphy_work_queue(local->hw.wiphy, &sdata->work);
7082 }
7083
7084 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
7085 {
7086         struct ieee80211_local *local = sdata->local;
7087         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7088
7089         lockdep_assert_wiphy(sdata->local->hw.wiphy);
7090
7091         if (ifmgd->status_received) {
7092                 __le16 fc = ifmgd->status_fc;
7093                 bool status_acked = ifmgd->status_acked;
7094
7095                 ifmgd->status_received = false;
7096                 if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
7097                         if (status_acked) {
7098                                 if (ifmgd->auth_data->algorithm ==
7099                                     WLAN_AUTH_SAE)
7100                                         ifmgd->auth_data->timeout =
7101                                                 jiffies +
7102                                                 IEEE80211_AUTH_TIMEOUT_SAE;
7103                                 else
7104                                         ifmgd->auth_data->timeout =
7105                                                 jiffies +
7106                                                 IEEE80211_AUTH_TIMEOUT_SHORT;
7107                                 run_again(sdata, ifmgd->auth_data->timeout);
7108                         } else {
7109                                 ifmgd->auth_data->timeout = jiffies - 1;
7110                         }
7111                         ifmgd->auth_data->timeout_started = true;
7112                 } else if (ifmgd->assoc_data &&
7113                            !ifmgd->assoc_data->comeback &&
7114                            (ieee80211_is_assoc_req(fc) ||
7115                             ieee80211_is_reassoc_req(fc))) {
7116                         /*
7117                          * Update association timeout based on the TX status
7118                          * for the (Re)Association Request frame. Skip this if
7119                          * we have already processed a (Re)Association Response
7120                          * frame that indicated need for association comeback
7121                          * at a specific time in the future. This could happen
7122                          * if the TX status information is delayed enough for
7123                          * the response to be received and processed first.
7124                          */
7125                         if (status_acked) {
7126                                 ifmgd->assoc_data->timeout =
7127                                         jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
7128                                 run_again(sdata, ifmgd->assoc_data->timeout);
7129                         } else {
7130                                 ifmgd->assoc_data->timeout = jiffies - 1;
7131                         }
7132                         ifmgd->assoc_data->timeout_started = true;
7133                 }
7134         }
7135
7136         if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
7137             time_after(jiffies, ifmgd->auth_data->timeout)) {
7138                 if (ifmgd->auth_data->done || ifmgd->auth_data->waiting) {
7139                         /*
7140                          * ok ... we waited for assoc or continuation but
7141                          * userspace didn't do it, so kill the auth data
7142                          */
7143                         ieee80211_destroy_auth_data(sdata, false);
7144                 } else if (ieee80211_auth(sdata)) {
7145                         u8 ap_addr[ETH_ALEN];
7146                         struct ieee80211_event event = {
7147                                 .type = MLME_EVENT,
7148                                 .u.mlme.data = AUTH_EVENT,
7149                                 .u.mlme.status = MLME_TIMEOUT,
7150                         };
7151
7152                         memcpy(ap_addr, ifmgd->auth_data->ap_addr, ETH_ALEN);
7153
7154                         ieee80211_destroy_auth_data(sdata, false);
7155
7156                         cfg80211_auth_timeout(sdata->dev, ap_addr);
7157                         drv_event_callback(sdata->local, sdata, &event);
7158                 }
7159         } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
7160                 run_again(sdata, ifmgd->auth_data->timeout);
7161
7162         if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
7163             time_after(jiffies, ifmgd->assoc_data->timeout)) {
7164                 if ((ifmgd->assoc_data->need_beacon &&
7165                      !sdata->deflink.u.mgd.have_beacon) ||
7166                     ieee80211_do_assoc(sdata)) {
7167                         struct ieee80211_event event = {
7168                                 .type = MLME_EVENT,
7169                                 .u.mlme.data = ASSOC_EVENT,
7170                                 .u.mlme.status = MLME_TIMEOUT,
7171                         };
7172
7173                         ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
7174                         drv_event_callback(sdata->local, sdata, &event);
7175                 }
7176         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
7177                 run_again(sdata, ifmgd->assoc_data->timeout);
7178
7179         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
7180             ifmgd->associated) {
7181                 u8 *bssid = sdata->deflink.u.mgd.bssid;
7182                 int max_tries;
7183
7184                 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
7185                         max_tries = max_nullfunc_tries;
7186                 else
7187                         max_tries = max_probe_tries;
7188
7189                 /* ACK received for nullfunc probing frame */
7190                 if (!ifmgd->probe_send_count)
7191                         ieee80211_reset_ap_probe(sdata);
7192                 else if (ifmgd->nullfunc_failed) {
7193                         if (ifmgd->probe_send_count < max_tries) {
7194                                 mlme_dbg(sdata,
7195                                          "No ack for nullfunc frame to AP %pM, try %d/%i\n",
7196                                          bssid, ifmgd->probe_send_count,
7197                                          max_tries);
7198                                 ieee80211_mgd_probe_ap_send(sdata);
7199                         } else {
7200                                 mlme_dbg(sdata,
7201                                          "No ack for nullfunc frame to AP %pM, disconnecting.\n",
7202                                          bssid);
7203                                 ieee80211_sta_connection_lost(sdata,
7204                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
7205                                         false);
7206                         }
7207                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
7208                         run_again(sdata, ifmgd->probe_timeout);
7209                 else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
7210                         mlme_dbg(sdata,
7211                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
7212                                  bssid, probe_wait_ms);
7213                         ieee80211_sta_connection_lost(sdata,
7214                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
7215                 } else if (ifmgd->probe_send_count < max_tries) {
7216                         mlme_dbg(sdata,
7217                                  "No probe response from AP %pM after %dms, try %d/%i\n",
7218                                  bssid, probe_wait_ms,
7219                                  ifmgd->probe_send_count, max_tries);
7220                         ieee80211_mgd_probe_ap_send(sdata);
7221                 } else {
7222                         /*
7223                          * We actually lost the connection ... or did we?
7224                          * Let's make sure!
7225                          */
7226                         mlme_dbg(sdata,
7227                                  "No probe response from AP %pM after %dms, disconnecting.\n",
7228                                  bssid, probe_wait_ms);
7229
7230                         ieee80211_sta_connection_lost(sdata,
7231                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
7232                 }
7233         }
7234 }
7235
7236 static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
7237 {
7238         struct ieee80211_sub_if_data *sdata =
7239                 from_timer(sdata, t, u.mgd.bcn_mon_timer);
7240
7241         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
7242                 return;
7243
7244         if (sdata->vif.bss_conf.csa_active &&
7245             !sdata->deflink.u.mgd.csa_waiting_bcn)
7246                 return;
7247
7248         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
7249                 return;
7250
7251         sdata->u.mgd.connection_loss = false;
7252         wiphy_work_queue(sdata->local->hw.wiphy,
7253                          &sdata->u.mgd.beacon_connection_loss_work);
7254 }
7255
7256 static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
7257 {
7258         struct ieee80211_sub_if_data *sdata =
7259                 from_timer(sdata, t, u.mgd.conn_mon_timer);
7260         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7261         struct ieee80211_local *local = sdata->local;
7262         struct sta_info *sta;
7263         unsigned long timeout;
7264
7265         if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
7266                 return;
7267
7268         if (sdata->vif.bss_conf.csa_active &&
7269             !sdata->deflink.u.mgd.csa_waiting_bcn)
7270                 return;
7271
7272         sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
7273         if (!sta)
7274                 return;
7275
7276         timeout = sta->deflink.status_stats.last_ack;
7277         if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx))
7278                 timeout = sta->deflink.rx_stats.last_rx;
7279         timeout += IEEE80211_CONNECTION_IDLE_TIME;
7280
7281         /* If timeout is after now, then update timer to fire at
7282          * the later date, but do not actually probe at this time.
7283          */
7284         if (time_is_after_jiffies(timeout)) {
7285                 mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
7286                 return;
7287         }
7288
7289         wiphy_work_queue(local->hw.wiphy, &sdata->u.mgd.monitor_work);
7290 }
7291
7292 static void ieee80211_sta_monitor_work(struct wiphy *wiphy,
7293                                        struct wiphy_work *work)
7294 {
7295         struct ieee80211_sub_if_data *sdata =
7296                 container_of(work, struct ieee80211_sub_if_data,
7297                              u.mgd.monitor_work);
7298
7299         ieee80211_mgd_probe_ap(sdata, false);
7300 }
7301
7302 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
7303 {
7304         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
7305                 __ieee80211_stop_poll(sdata);
7306
7307                 /* let's probe the connection once */
7308                 if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
7309                         wiphy_work_queue(sdata->local->hw.wiphy,
7310                                          &sdata->u.mgd.monitor_work);
7311         }
7312 }
7313
7314 #ifdef CONFIG_PM
7315 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
7316 {
7317         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7318         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7319
7320         lockdep_assert_wiphy(sdata->local->hw.wiphy);
7321
7322         if (ifmgd->auth_data || ifmgd->assoc_data) {
7323                 const u8 *ap_addr = ifmgd->auth_data ?
7324                                 ifmgd->auth_data->ap_addr :
7325                                 ifmgd->assoc_data->ap_addr;
7326
7327                 /*
7328                  * If we are trying to authenticate / associate while suspending,
7329                  * cfg80211 won't know and won't actually abort those attempts,
7330                  * thus we need to do that ourselves.
7331                  */
7332                 ieee80211_send_deauth_disassoc(sdata, ap_addr, ap_addr,
7333                                                IEEE80211_STYPE_DEAUTH,
7334                                                WLAN_REASON_DEAUTH_LEAVING,
7335                                                false, frame_buf);
7336                 if (ifmgd->assoc_data)
7337                         ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
7338                 if (ifmgd->auth_data)
7339                         ieee80211_destroy_auth_data(sdata, false);
7340                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
7341                                       IEEE80211_DEAUTH_FRAME_LEN,
7342                                       false);
7343         }
7344
7345         /* This is a bit of a hack - we should find a better and more generic
7346          * solution to this. Normally when suspending, cfg80211 will in fact
7347          * deauthenticate. However, it doesn't (and cannot) stop an ongoing
7348          * auth (not so important) or assoc (this is the problem) process.
7349          *
7350          * As a consequence, it can happen that we are in the process of both
7351          * associating and suspending, and receive an association response
7352          * after cfg80211 has checked if it needs to disconnect, but before
7353          * we actually set the flag to drop incoming frames. This will then
7354          * cause the workqueue flush to process the association response in
7355          * the suspend, resulting in a successful association just before it
7356          * tries to remove the interface from the driver, which now though
7357          * has a channel context assigned ... this results in issues.
7358          *
7359          * To work around this (for now) simply deauth here again if we're
7360          * now connected.
7361          */
7362         if (ifmgd->associated && !sdata->local->wowlan) {
7363                 u8 bssid[ETH_ALEN];
7364                 struct cfg80211_deauth_request req = {
7365                         .reason_code = WLAN_REASON_DEAUTH_LEAVING,
7366                         .bssid = bssid,
7367                 };
7368
7369                 memcpy(bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
7370                 ieee80211_mgd_deauth(sdata, &req);
7371         }
7372 }
7373 #endif
7374
7375 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
7376 {
7377         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7378
7379         lockdep_assert_wiphy(sdata->local->hw.wiphy);
7380
7381         if (!ifmgd->associated)
7382                 return;
7383
7384         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
7385                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
7386                 mlme_dbg(sdata, "driver requested disconnect after resume\n");
7387                 ieee80211_sta_connection_lost(sdata,
7388                                               WLAN_REASON_UNSPECIFIED,
7389                                               true);
7390                 return;
7391         }
7392
7393         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_HW_RESTART) {
7394                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_HW_RESTART;
7395                 mlme_dbg(sdata, "driver requested disconnect after hardware restart\n");
7396                 ieee80211_sta_connection_lost(sdata,
7397                                               WLAN_REASON_UNSPECIFIED,
7398                                               true);
7399                 return;
7400         }
7401 }
7402
7403 static void ieee80211_request_smps_mgd_work(struct wiphy *wiphy,
7404                                             struct wiphy_work *work)
7405 {
7406         struct ieee80211_link_data *link =
7407                 container_of(work, struct ieee80211_link_data,
7408                              u.mgd.request_smps_work);
7409
7410         __ieee80211_request_smps_mgd(link->sdata, link,
7411                                      link->u.mgd.driver_smps_mode);
7412 }
7413
7414 /* interface setup */
7415 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
7416 {
7417         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7418
7419         wiphy_work_init(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
7420         wiphy_work_init(&ifmgd->beacon_connection_loss_work,
7421                         ieee80211_beacon_connection_loss_work);
7422         wiphy_work_init(&ifmgd->csa_connection_drop_work,
7423                         ieee80211_csa_connection_drop_work);
7424         wiphy_delayed_work_init(&ifmgd->tdls_peer_del_work,
7425                                 ieee80211_tdls_peer_del_work);
7426         wiphy_delayed_work_init(&ifmgd->ml_reconf_work,
7427                                 ieee80211_ml_reconf_work);
7428         timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
7429         timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
7430         timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
7431         wiphy_delayed_work_init(&ifmgd->tx_tspec_wk,
7432                                 ieee80211_sta_handle_tspec_ac_params_wk);
7433         wiphy_delayed_work_init(&ifmgd->ttlm_work,
7434                                 ieee80211_tid_to_link_map_work);
7435         wiphy_delayed_work_init(&ifmgd->neg_ttlm_timeout_work,
7436                                 ieee80211_neg_ttlm_timeout_work);
7437
7438         ifmgd->flags = 0;
7439         ifmgd->powersave = sdata->wdev.ps;
7440         ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
7441         ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
7442         /* Setup TDLS data */
7443         spin_lock_init(&ifmgd->teardown_lock);
7444         ifmgd->teardown_skb = NULL;
7445         ifmgd->orig_teardown_skb = NULL;
7446         ifmgd->mcast_seq_last = IEEE80211_SN_MODULO;
7447 }
7448
7449 static void ieee80211_recalc_smps_work(struct wiphy *wiphy,
7450                                        struct wiphy_work *work)
7451 {
7452         struct ieee80211_link_data *link =
7453                 container_of(work, struct ieee80211_link_data,
7454                              u.mgd.recalc_smps);
7455
7456         ieee80211_recalc_smps(link->sdata, link);
7457 }
7458
7459 void ieee80211_mgd_setup_link(struct ieee80211_link_data *link)
7460 {
7461         struct ieee80211_sub_if_data *sdata = link->sdata;
7462         struct ieee80211_local *local = sdata->local;
7463         unsigned int link_id = link->link_id;
7464
7465         link->u.mgd.p2p_noa_index = -1;
7466         link->conf->bssid = link->u.mgd.bssid;
7467         link->smps_mode = IEEE80211_SMPS_OFF;
7468
7469         wiphy_work_init(&link->u.mgd.request_smps_work,
7470                         ieee80211_request_smps_mgd_work);
7471         wiphy_work_init(&link->u.mgd.recalc_smps,
7472                         ieee80211_recalc_smps_work);
7473         if (local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
7474                 link->u.mgd.req_smps = IEEE80211_SMPS_AUTOMATIC;
7475         else
7476                 link->u.mgd.req_smps = IEEE80211_SMPS_OFF;
7477
7478         wiphy_delayed_work_init(&link->u.mgd.chswitch_work,
7479                                 ieee80211_chswitch_work);
7480
7481         if (sdata->u.mgd.assoc_data)
7482                 ether_addr_copy(link->conf->addr,
7483                                 sdata->u.mgd.assoc_data->link[link_id].addr);
7484         else if (!is_valid_ether_addr(link->conf->addr))
7485                 eth_random_addr(link->conf->addr);
7486 }
7487
7488 /* scan finished notification */
7489 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
7490 {
7491         struct ieee80211_sub_if_data *sdata;
7492
7493         /* Restart STA timers */
7494         rcu_read_lock();
7495         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
7496                 if (ieee80211_sdata_running(sdata))
7497                         ieee80211_restart_sta_timer(sdata);
7498         }
7499         rcu_read_unlock();
7500 }
7501
7502 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
7503                                      struct cfg80211_bss *cbss, s8 link_id,
7504                                      const u8 *ap_mld_addr, bool assoc,
7505                                      struct ieee80211_conn_settings *conn,
7506                                      bool override)
7507 {
7508         struct ieee80211_local *local = sdata->local;
7509         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7510         struct ieee80211_bss *bss = (void *)cbss->priv;
7511         struct sta_info *new_sta = NULL;
7512         struct ieee80211_link_data *link;
7513         bool have_sta = false;
7514         bool mlo;
7515         int err;
7516
7517         if (link_id >= 0) {
7518                 mlo = true;
7519                 if (WARN_ON(!ap_mld_addr))
7520                         return -EINVAL;
7521                 err = ieee80211_vif_set_links(sdata, BIT(link_id), 0);
7522         } else {
7523                 if (WARN_ON(ap_mld_addr))
7524                         return -EINVAL;
7525                 ap_mld_addr = cbss->bssid;
7526                 err = ieee80211_vif_set_links(sdata, 0, 0);
7527                 link_id = 0;
7528                 mlo = false;
7529         }
7530
7531         if (err)
7532                 return err;
7533
7534         link = sdata_dereference(sdata->link[link_id], sdata);
7535         if (WARN_ON(!link)) {
7536                 err = -ENOLINK;
7537                 goto out_err;
7538         }
7539
7540         if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) {
7541                 err = -EINVAL;
7542                 goto out_err;
7543         }
7544
7545         /* If a reconfig is happening, bail out */
7546         if (local->in_reconfig) {
7547                 err = -EBUSY;
7548                 goto out_err;
7549         }
7550
7551         if (assoc) {
7552                 rcu_read_lock();
7553                 have_sta = sta_info_get(sdata, ap_mld_addr);
7554                 rcu_read_unlock();
7555         }
7556
7557         if (!have_sta) {
7558                 if (mlo)
7559                         new_sta = sta_info_alloc_with_link(sdata, ap_mld_addr,
7560                                                            link_id, cbss->bssid,
7561                                                            GFP_KERNEL);
7562                 else
7563                         new_sta = sta_info_alloc(sdata, ap_mld_addr, GFP_KERNEL);
7564
7565                 if (!new_sta) {
7566                         err = -ENOMEM;
7567                         goto out_err;
7568                 }
7569
7570                 new_sta->sta.mlo = mlo;
7571         }
7572
7573         /*
7574          * Set up the information for the new channel before setting the
7575          * new channel. We can't - completely race-free - change the basic
7576          * rates bitmap and the channel (sband) that it refers to, but if
7577          * we set it up before we at least avoid calling into the driver's
7578          * bss_info_changed() method with invalid information (since we do
7579          * call that from changing the channel - only for IDLE and perhaps
7580          * some others, but ...).
7581          *
7582          * So to avoid that, just set up all the new information before the
7583          * channel, but tell the driver to apply it only afterwards, since
7584          * it might need the new channel for that.
7585          */
7586         if (new_sta) {
7587                 const struct cfg80211_bss_ies *ies;
7588                 struct link_sta_info *link_sta;
7589
7590                 rcu_read_lock();
7591                 link_sta = rcu_dereference(new_sta->link[link_id]);
7592                 if (WARN_ON(!link_sta)) {
7593                         rcu_read_unlock();
7594                         sta_info_free(local, new_sta);
7595                         err = -EINVAL;
7596                         goto out_err;
7597                 }
7598
7599                 err = ieee80211_mgd_setup_link_sta(link, new_sta,
7600                                                    link_sta, cbss);
7601                 if (err) {
7602                         rcu_read_unlock();
7603                         sta_info_free(local, new_sta);
7604                         goto out_err;
7605                 }
7606
7607                 memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
7608
7609                 /* set timing information */
7610                 link->conf->beacon_int = cbss->beacon_interval;
7611                 ies = rcu_dereference(cbss->beacon_ies);
7612                 if (ies) {
7613                         link->conf->sync_tsf = ies->tsf;
7614                         link->conf->sync_device_ts =
7615                                 bss->device_ts_beacon;
7616
7617                         ieee80211_get_dtim(ies,
7618                                            &link->conf->sync_dtim_count,
7619                                            NULL);
7620                 } else if (!ieee80211_hw_check(&sdata->local->hw,
7621                                                TIMING_BEACON_ONLY)) {
7622                         ies = rcu_dereference(cbss->proberesp_ies);
7623                         /* must be non-NULL since beacon IEs were NULL */
7624                         link->conf->sync_tsf = ies->tsf;
7625                         link->conf->sync_device_ts =
7626                                 bss->device_ts_presp;
7627                         link->conf->sync_dtim_count = 0;
7628                 } else {
7629                         link->conf->sync_tsf = 0;
7630                         link->conf->sync_device_ts = 0;
7631                         link->conf->sync_dtim_count = 0;
7632                 }
7633                 rcu_read_unlock();
7634         }
7635
7636         if (new_sta || override) {
7637                 /*
7638                  * Only set this if we're also going to calculate the AP
7639                  * settings etc., otherwise this was set before in a
7640                  * previous call. Note override is set to %true in assoc
7641                  * if the settings were changed.
7642                  */
7643                 link->u.mgd.conn = *conn;
7644                 err = ieee80211_prep_channel(sdata, link, link->link_id, cbss,
7645                                              mlo, &link->u.mgd.conn);
7646                 if (err) {
7647                         if (new_sta)
7648                                 sta_info_free(local, new_sta);
7649                         goto out_err;
7650                 }
7651                 /* pass out for use in assoc */
7652                 *conn = link->u.mgd.conn;
7653         }
7654
7655         if (new_sta) {
7656                 /*
7657                  * tell driver about BSSID, basic rates and timing
7658                  * this was set up above, before setting the channel
7659                  */
7660                 ieee80211_link_info_change_notify(sdata, link,
7661                                                   BSS_CHANGED_BSSID |
7662                                                   BSS_CHANGED_BASIC_RATES |
7663                                                   BSS_CHANGED_BEACON_INT);
7664
7665                 if (assoc)
7666                         sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
7667
7668                 err = sta_info_insert(new_sta);
7669                 new_sta = NULL;
7670                 if (err) {
7671                         sdata_info(sdata,
7672                                    "failed to insert STA entry for the AP (error %d)\n",
7673                                    err);
7674                         goto out_release_chan;
7675                 }
7676         } else
7677                 WARN_ON_ONCE(!ether_addr_equal(link->u.mgd.bssid, cbss->bssid));
7678
7679         /* Cancel scan to ensure that nothing interferes with connection */
7680         if (local->scanning)
7681                 ieee80211_scan_cancel(local);
7682
7683         return 0;
7684
7685 out_release_chan:
7686         ieee80211_link_release_channel(link);
7687 out_err:
7688         ieee80211_vif_set_links(sdata, 0, 0);
7689         return err;
7690 }
7691
7692 static bool ieee80211_mgd_csa_present(struct ieee80211_sub_if_data *sdata,
7693                                       const struct cfg80211_bss_ies *ies,
7694                                       u8 cur_channel, bool ignore_ecsa)
7695 {
7696         const struct element *csa_elem, *ecsa_elem;
7697         struct ieee80211_channel_sw_ie *csa = NULL;
7698         struct ieee80211_ext_chansw_ie *ecsa = NULL;
7699
7700         if (!ies)
7701                 return false;
7702
7703         csa_elem = cfg80211_find_elem(WLAN_EID_CHANNEL_SWITCH,
7704                                       ies->data, ies->len);
7705         if (csa_elem && csa_elem->datalen == sizeof(*csa))
7706                 csa = (void *)csa_elem->data;
7707
7708         ecsa_elem = cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN,
7709                                        ies->data, ies->len);
7710         if (ecsa_elem && ecsa_elem->datalen == sizeof(*ecsa))
7711                 ecsa = (void *)ecsa_elem->data;
7712
7713         if (csa && csa->count == 0)
7714                 csa = NULL;
7715         if (csa && !csa->mode && csa->new_ch_num == cur_channel)
7716                 csa = NULL;
7717
7718         if (ecsa && ecsa->count == 0)
7719                 ecsa = NULL;
7720         if (ecsa && !ecsa->mode && ecsa->new_ch_num == cur_channel)
7721                 ecsa = NULL;
7722
7723         if (ignore_ecsa && ecsa) {
7724                 sdata_info(sdata,
7725                            "Ignoring ECSA in probe response - was considered stuck!\n");
7726                 return csa;
7727         }
7728
7729         return csa || ecsa;
7730 }
7731
7732 static bool ieee80211_mgd_csa_in_process(struct ieee80211_sub_if_data *sdata,
7733                                          struct cfg80211_bss *bss)
7734 {
7735         u8 cur_channel;
7736         bool ret;
7737
7738         cur_channel = ieee80211_frequency_to_channel(bss->channel->center_freq);
7739
7740         rcu_read_lock();
7741         if (ieee80211_mgd_csa_present(sdata,
7742                                       rcu_dereference(bss->beacon_ies),
7743                                       cur_channel, false)) {
7744                 ret = true;
7745                 goto out;
7746         }
7747
7748         if (ieee80211_mgd_csa_present(sdata,
7749                                       rcu_dereference(bss->proberesp_ies),
7750                                       cur_channel, bss->proberesp_ecsa_stuck)) {
7751                 ret = true;
7752                 goto out;
7753         }
7754
7755         ret = false;
7756 out:
7757         rcu_read_unlock();
7758         return ret;
7759 }
7760
7761 /* config hooks */
7762 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
7763                        struct cfg80211_auth_request *req)
7764 {
7765         struct ieee80211_local *local = sdata->local;
7766         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7767         struct ieee80211_mgd_auth_data *auth_data;
7768         struct ieee80211_conn_settings conn;
7769         struct ieee80211_link_data *link;
7770         struct ieee80211_supported_band *sband;
7771         struct ieee80211_bss *bss;
7772         u16 auth_alg;
7773         int err;
7774         bool cont_auth, wmm_used;
7775
7776         lockdep_assert_wiphy(sdata->local->hw.wiphy);
7777
7778         /* prepare auth data structure */
7779
7780         switch (req->auth_type) {
7781         case NL80211_AUTHTYPE_OPEN_SYSTEM:
7782                 auth_alg = WLAN_AUTH_OPEN;
7783                 break;
7784         case NL80211_AUTHTYPE_SHARED_KEY:
7785                 if (fips_enabled)
7786                         return -EOPNOTSUPP;
7787                 auth_alg = WLAN_AUTH_SHARED_KEY;
7788                 break;
7789         case NL80211_AUTHTYPE_FT:
7790                 auth_alg = WLAN_AUTH_FT;
7791                 break;
7792         case NL80211_AUTHTYPE_NETWORK_EAP:
7793                 auth_alg = WLAN_AUTH_LEAP;
7794                 break;
7795         case NL80211_AUTHTYPE_SAE:
7796                 auth_alg = WLAN_AUTH_SAE;
7797                 break;
7798         case NL80211_AUTHTYPE_FILS_SK:
7799                 auth_alg = WLAN_AUTH_FILS_SK;
7800                 break;
7801         case NL80211_AUTHTYPE_FILS_SK_PFS:
7802                 auth_alg = WLAN_AUTH_FILS_SK_PFS;
7803                 break;
7804         case NL80211_AUTHTYPE_FILS_PK:
7805                 auth_alg = WLAN_AUTH_FILS_PK;
7806                 break;
7807         default:
7808                 return -EOPNOTSUPP;
7809         }
7810
7811         if (ifmgd->assoc_data)
7812                 return -EBUSY;
7813
7814         if (ieee80211_mgd_csa_in_process(sdata, req->bss)) {
7815                 sdata_info(sdata, "AP is in CSA process, reject auth\n");
7816                 return -EINVAL;
7817         }
7818
7819         auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
7820                             req->ie_len, GFP_KERNEL);
7821         if (!auth_data)
7822                 return -ENOMEM;
7823
7824         memcpy(auth_data->ap_addr,
7825                req->ap_mld_addr ?: req->bss->bssid,
7826                ETH_ALEN);
7827         auth_data->bss = req->bss;
7828         auth_data->link_id = req->link_id;
7829
7830         if (req->auth_data_len >= 4) {
7831                 if (req->auth_type == NL80211_AUTHTYPE_SAE) {
7832                         __le16 *pos = (__le16 *) req->auth_data;
7833
7834                         auth_data->sae_trans = le16_to_cpu(pos[0]);
7835                         auth_data->sae_status = le16_to_cpu(pos[1]);
7836                 }
7837                 memcpy(auth_data->data, req->auth_data + 4,
7838                        req->auth_data_len - 4);
7839                 auth_data->data_len += req->auth_data_len - 4;
7840         }
7841
7842         /* Check if continuing authentication or trying to authenticate with the
7843          * same BSS that we were in the process of authenticating with and avoid
7844          * removal and re-addition of the STA entry in
7845          * ieee80211_prep_connection().
7846          */
7847         cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss &&
7848                     ifmgd->auth_data->link_id == req->link_id;
7849
7850         if (req->ie && req->ie_len) {
7851                 memcpy(&auth_data->data[auth_data->data_len],
7852                        req->ie, req->ie_len);
7853                 auth_data->data_len += req->ie_len;
7854         }
7855
7856         if (req->key && req->key_len) {
7857                 auth_data->key_len = req->key_len;
7858                 auth_data->key_idx = req->key_idx;
7859                 memcpy(auth_data->key, req->key, req->key_len);
7860         }
7861
7862         auth_data->algorithm = auth_alg;
7863
7864         /* try to authenticate/probe */
7865
7866         if (ifmgd->auth_data) {
7867                 if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
7868                         auth_data->peer_confirmed =
7869                                 ifmgd->auth_data->peer_confirmed;
7870                 }
7871                 ieee80211_destroy_auth_data(sdata, cont_auth);
7872         }
7873
7874         /* prep auth_data so we don't go into idle on disassoc */
7875         ifmgd->auth_data = auth_data;
7876
7877         /* If this is continuation of an ongoing SAE authentication exchange
7878          * (i.e., request to send SAE Confirm) and the peer has already
7879          * confirmed, mark authentication completed since we are about to send
7880          * out SAE Confirm.
7881          */
7882         if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
7883             auth_data->peer_confirmed && auth_data->sae_trans == 2)
7884                 ieee80211_mark_sta_auth(sdata);
7885
7886         if (ifmgd->associated) {
7887                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7888
7889                 sdata_info(sdata,
7890                            "disconnect from AP %pM for new auth to %pM\n",
7891                            sdata->vif.cfg.ap_addr, auth_data->ap_addr);
7892                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7893                                        WLAN_REASON_UNSPECIFIED,
7894                                        false, frame_buf);
7895
7896                 ieee80211_report_disconnect(sdata, frame_buf,
7897                                             sizeof(frame_buf), true,
7898                                             WLAN_REASON_UNSPECIFIED,
7899                                             false);
7900         }
7901
7902         /* needed for transmitting the auth frame(s) properly */
7903         memcpy(sdata->vif.cfg.ap_addr, auth_data->ap_addr, ETH_ALEN);
7904
7905         bss = (void *)req->bss->priv;
7906         wmm_used = bss->wmm_used && (local->hw.queues >= IEEE80211_NUM_ACS);
7907
7908         sband = local->hw.wiphy->bands[req->bss->channel->band];
7909
7910         ieee80211_determine_our_sta_mode_auth(sdata, sband, req, wmm_used,
7911                                               &conn);
7912
7913         err = ieee80211_prep_connection(sdata, req->bss, req->link_id,
7914                                         req->ap_mld_addr, cont_auth,
7915                                         &conn, false);
7916         if (err)
7917                 goto err_clear;
7918
7919         if (req->link_id >= 0)
7920                 link = sdata_dereference(sdata->link[req->link_id], sdata);
7921         else
7922                 link = &sdata->deflink;
7923
7924         if (WARN_ON(!link)) {
7925                 err = -ENOLINK;
7926                 goto err_clear;
7927         }
7928
7929         sdata_info(sdata, "authenticate with %pM (local address=%pM)\n",
7930                    auth_data->ap_addr, link->conf->addr);
7931
7932         err = ieee80211_auth(sdata);
7933         if (err) {
7934                 sta_info_destroy_addr(sdata, auth_data->ap_addr);
7935                 goto err_clear;
7936         }
7937
7938         /* hold our own reference */
7939         cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
7940         return 0;
7941
7942  err_clear:
7943         if (!ieee80211_vif_is_mld(&sdata->vif)) {
7944                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
7945                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
7946                                                   BSS_CHANGED_BSSID);
7947                 ieee80211_link_release_channel(&sdata->deflink);
7948         }
7949         ifmgd->auth_data = NULL;
7950         kfree(auth_data);
7951         return err;
7952 }
7953
7954 static void
7955 ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
7956                            struct ieee80211_mgd_assoc_data *assoc_data,
7957                            struct cfg80211_assoc_request *req,
7958                            struct ieee80211_conn_settings *conn,
7959                            unsigned int link_id)
7960 {
7961         struct ieee80211_local *local = sdata->local;
7962         const struct cfg80211_bss_ies *bss_ies;
7963         struct ieee80211_supported_band *sband;
7964         struct ieee80211_link_data *link;
7965         struct cfg80211_bss *cbss;
7966         struct ieee80211_bss *bss;
7967
7968         cbss = assoc_data->link[link_id].bss;
7969         if (WARN_ON(!cbss))
7970                 return;
7971
7972         bss = (void *)cbss->priv;
7973
7974         sband = local->hw.wiphy->bands[cbss->channel->band];
7975         if (WARN_ON(!sband))
7976                 return;
7977
7978         link = sdata_dereference(sdata->link[link_id], sdata);
7979         if (WARN_ON(!link))
7980                 return;
7981
7982         /* for MLO connections assume advertising all rates is OK */
7983         if (!req->ap_mld_addr) {
7984                 assoc_data->supp_rates = bss->supp_rates;
7985                 assoc_data->supp_rates_len = bss->supp_rates_len;
7986         }
7987
7988         /* copy and link elems for the STA profile */
7989         if (req->links[link_id].elems_len) {
7990                 memcpy(assoc_data->ie_pos, req->links[link_id].elems,
7991                        req->links[link_id].elems_len);
7992                 assoc_data->link[link_id].elems = assoc_data->ie_pos;
7993                 assoc_data->link[link_id].elems_len = req->links[link_id].elems_len;
7994                 assoc_data->ie_pos += req->links[link_id].elems_len;
7995         }
7996
7997         link->u.mgd.beacon_crc_valid = false;
7998         link->u.mgd.dtim_period = 0;
7999         link->u.mgd.have_beacon = false;
8000
8001         /* override HT configuration only if the AP and we support it */
8002         if (conn->mode >= IEEE80211_CONN_MODE_HT) {
8003                 struct ieee80211_sta_ht_cap sta_ht_cap;
8004
8005                 memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
8006                 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
8007         }
8008
8009         rcu_read_lock();
8010         bss_ies = rcu_dereference(cbss->beacon_ies);
8011         if (bss_ies) {
8012                 u8 dtim_count = 0;
8013
8014                 ieee80211_get_dtim(bss_ies, &dtim_count,
8015                                    &link->u.mgd.dtim_period);
8016
8017                 sdata->deflink.u.mgd.have_beacon = true;
8018
8019                 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
8020                         link->conf->sync_tsf = bss_ies->tsf;
8021                         link->conf->sync_device_ts = bss->device_ts_beacon;
8022                         link->conf->sync_dtim_count = dtim_count;
8023                 }
8024         } else {
8025                 bss_ies = rcu_dereference(cbss->ies);
8026         }
8027
8028         if (bss_ies) {
8029                 const struct element *elem;
8030
8031                 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
8032                                               bss_ies->data, bss_ies->len);
8033                 if (elem && elem->datalen >= 3)
8034                         link->conf->profile_periodicity = elem->data[2];
8035                 else
8036                         link->conf->profile_periodicity = 0;
8037
8038                 elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
8039                                           bss_ies->data, bss_ies->len);
8040                 if (elem && elem->datalen >= 11 &&
8041                     (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
8042                         link->conf->ema_ap = true;
8043                 else
8044                         link->conf->ema_ap = false;
8045         }
8046         rcu_read_unlock();
8047
8048         if (bss->corrupt_data) {
8049                 char *corrupt_type = "data";
8050
8051                 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
8052                         if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
8053                                 corrupt_type = "beacon and probe response";
8054                         else
8055                                 corrupt_type = "beacon";
8056                 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) {
8057                         corrupt_type = "probe response";
8058                 }
8059                 sdata_info(sdata, "associating to AP %pM with corrupt %s\n",
8060                            cbss->bssid, corrupt_type);
8061         }
8062
8063         if (link->u.mgd.req_smps == IEEE80211_SMPS_AUTOMATIC) {
8064                 if (sdata->u.mgd.powersave)
8065                         link->smps_mode = IEEE80211_SMPS_DYNAMIC;
8066                 else
8067                         link->smps_mode = IEEE80211_SMPS_OFF;
8068         } else {
8069                 link->smps_mode = link->u.mgd.req_smps;
8070         }
8071 }
8072
8073 static int
8074 ieee80211_mgd_get_ap_ht_vht_capa(struct ieee80211_sub_if_data *sdata,
8075                                  struct ieee80211_mgd_assoc_data *assoc_data,
8076                                  int link_id)
8077 {
8078         struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
8079         enum nl80211_band band = cbss->channel->band;
8080         struct ieee80211_supported_band *sband;
8081         const struct element *elem;
8082         int err;
8083
8084         /* neither HT nor VHT elements used on 6 GHz */
8085         if (band == NL80211_BAND_6GHZ)
8086                 return 0;
8087
8088         if (assoc_data->link[link_id].conn.mode < IEEE80211_CONN_MODE_HT)
8089                 return 0;
8090
8091         rcu_read_lock();
8092         elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_OPERATION);
8093         if (!elem || elem->datalen < sizeof(struct ieee80211_ht_operation)) {
8094                 mlme_link_id_dbg(sdata, link_id, "no HT operation on BSS %pM\n",
8095                                  cbss->bssid);
8096                 err = -EINVAL;
8097                 goto out_rcu;
8098         }
8099         assoc_data->link[link_id].ap_ht_param =
8100                 ((struct ieee80211_ht_operation *)(elem->data))->ht_param;
8101         rcu_read_unlock();
8102
8103         if (assoc_data->link[link_id].conn.mode < IEEE80211_CONN_MODE_VHT)
8104                 return 0;
8105
8106         /* some drivers want to support VHT on 2.4 GHz even */
8107         sband = sdata->local->hw.wiphy->bands[band];
8108         if (!sband->vht_cap.vht_supported)
8109                 return 0;
8110
8111         rcu_read_lock();
8112         elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
8113         /* but even then accept it not being present on the AP */
8114         if (!elem && band == NL80211_BAND_2GHZ) {
8115                 err = 0;
8116                 goto out_rcu;
8117         }
8118         if (!elem || elem->datalen < sizeof(struct ieee80211_vht_cap)) {
8119                 mlme_link_id_dbg(sdata, link_id, "no VHT capa on BSS %pM\n",
8120                                  cbss->bssid);
8121                 err = -EINVAL;
8122                 goto out_rcu;
8123         }
8124         memcpy(&assoc_data->link[link_id].ap_vht_cap, elem->data,
8125                sizeof(struct ieee80211_vht_cap));
8126         rcu_read_unlock();
8127
8128         return 0;
8129 out_rcu:
8130         rcu_read_unlock();
8131         return err;
8132 }
8133
8134 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
8135                         struct cfg80211_assoc_request *req)
8136 {
8137         unsigned int assoc_link_id = req->link_id < 0 ? 0 : req->link_id;
8138         struct ieee80211_local *local = sdata->local;
8139         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
8140         struct ieee80211_mgd_assoc_data *assoc_data;
8141         const struct element *ssid_elem;
8142         struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
8143         struct ieee80211_link_data *link;
8144         struct cfg80211_bss *cbss;
8145         bool override, uapsd_supported;
8146         bool match_auth;
8147         int i, err;
8148         size_t size = sizeof(*assoc_data) + req->ie_len;
8149
8150         for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++)
8151                 size += req->links[i].elems_len;
8152
8153         /* FIXME: no support for 4-addr MLO yet */
8154         if (sdata->u.mgd.use_4addr && req->link_id >= 0)
8155                 return -EOPNOTSUPP;
8156
8157         assoc_data = kzalloc(size, GFP_KERNEL);
8158         if (!assoc_data)
8159                 return -ENOMEM;
8160
8161         cbss = req->link_id < 0 ? req->bss : req->links[req->link_id].bss;
8162
8163         if (ieee80211_mgd_csa_in_process(sdata, cbss)) {
8164                 sdata_info(sdata, "AP is in CSA process, reject assoc\n");
8165                 err = -EINVAL;
8166                 goto err_free;
8167         }
8168
8169         rcu_read_lock();
8170         ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
8171         if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) {
8172                 rcu_read_unlock();
8173                 err = -EINVAL;
8174                 goto err_free;
8175         }
8176
8177         memcpy(assoc_data->ssid, ssid_elem->data, ssid_elem->datalen);
8178         assoc_data->ssid_len = ssid_elem->datalen;
8179         rcu_read_unlock();
8180
8181         if (req->ap_mld_addr)
8182                 memcpy(assoc_data->ap_addr, req->ap_mld_addr, ETH_ALEN);
8183         else
8184                 memcpy(assoc_data->ap_addr, cbss->bssid, ETH_ALEN);
8185
8186         if (ifmgd->associated) {
8187                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
8188
8189                 sdata_info(sdata,
8190                            "disconnect from AP %pM for new assoc to %pM\n",
8191                            sdata->vif.cfg.ap_addr, assoc_data->ap_addr);
8192                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
8193                                        WLAN_REASON_UNSPECIFIED,
8194                                        false, frame_buf);
8195
8196                 ieee80211_report_disconnect(sdata, frame_buf,
8197                                             sizeof(frame_buf), true,
8198                                             WLAN_REASON_UNSPECIFIED,
8199                                             false);
8200         }
8201
8202         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
8203         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
8204                sizeof(ifmgd->ht_capa_mask));
8205
8206         memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
8207         memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
8208                sizeof(ifmgd->vht_capa_mask));
8209
8210         memcpy(&ifmgd->s1g_capa, &req->s1g_capa, sizeof(ifmgd->s1g_capa));
8211         memcpy(&ifmgd->s1g_capa_mask, &req->s1g_capa_mask,
8212                sizeof(ifmgd->s1g_capa_mask));
8213
8214         /* keep some setup (AP STA, channel, ...) if matching */
8215         match_auth = ifmgd->auth_data &&
8216                      ether_addr_equal(ifmgd->auth_data->ap_addr,
8217                                       assoc_data->ap_addr) &&
8218                      ifmgd->auth_data->link_id == req->link_id;
8219
8220         if (req->ap_mld_addr) {
8221                 uapsd_supported = true;
8222
8223                 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
8224                         struct ieee80211_supported_band *sband;
8225                         struct cfg80211_bss *link_cbss = req->links[i].bss;
8226                         struct ieee80211_bss *bss;
8227
8228                         if (!link_cbss)
8229                                 continue;
8230
8231                         bss = (void *)link_cbss->priv;
8232
8233                         if (!bss->wmm_used) {
8234                                 err = -EINVAL;
8235                                 goto err_free;
8236                         }
8237
8238                         if (req->flags & (ASSOC_REQ_DISABLE_HT |
8239                                           ASSOC_REQ_DISABLE_VHT |
8240                                           ASSOC_REQ_DISABLE_HE |
8241                                           ASSOC_REQ_DISABLE_EHT)) {
8242                                 err = -EINVAL;
8243                                 goto err_free;
8244                         }
8245
8246                         if (link_cbss->channel->band == NL80211_BAND_S1GHZ) {
8247                                 err = -EINVAL;
8248                                 goto err_free;
8249                         }
8250
8251                         link = sdata_dereference(sdata->link[i], sdata);
8252                         if (link)
8253                                 ether_addr_copy(assoc_data->link[i].addr,
8254                                                 link->conf->addr);
8255                         else
8256                                 eth_random_addr(assoc_data->link[i].addr);
8257                         sband = local->hw.wiphy->bands[link_cbss->channel->band];
8258
8259                         if (match_auth && i == assoc_link_id && link)
8260                                 assoc_data->link[i].conn = link->u.mgd.conn;
8261                         else
8262                                 assoc_data->link[i].conn =
8263                                         ieee80211_conn_settings_unlimited;
8264                         ieee80211_determine_our_sta_mode_assoc(sdata, sband,
8265                                                                req, true, i,
8266                                                                &assoc_data->link[i].conn);
8267                         assoc_data->link[i].bss = link_cbss;
8268                         assoc_data->link[i].disabled = req->links[i].disabled;
8269
8270                         if (!bss->uapsd_supported)
8271                                 uapsd_supported = false;
8272
8273                         if (assoc_data->link[i].conn.mode < IEEE80211_CONN_MODE_EHT) {
8274                                 err = -EINVAL;
8275                                 req->links[i].error = err;
8276                                 goto err_free;
8277                         }
8278
8279                         err = ieee80211_mgd_get_ap_ht_vht_capa(sdata,
8280                                                                assoc_data, i);
8281                         if (err) {
8282                                 err = -EINVAL;
8283                                 req->links[i].error = err;
8284                                 goto err_free;
8285                         }
8286                 }
8287
8288                 assoc_data->wmm = true;
8289         } else {
8290                 struct ieee80211_supported_band *sband;
8291                 struct ieee80211_bss *bss = (void *)cbss->priv;
8292
8293                 memcpy(assoc_data->link[0].addr, sdata->vif.addr, ETH_ALEN);
8294                 assoc_data->s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
8295
8296                 assoc_data->wmm = bss->wmm_used &&
8297                                   (local->hw.queues >= IEEE80211_NUM_ACS);
8298
8299                 if (cbss->channel->band == NL80211_BAND_6GHZ &&
8300                     req->flags & (ASSOC_REQ_DISABLE_HT |
8301                                   ASSOC_REQ_DISABLE_VHT |
8302                                   ASSOC_REQ_DISABLE_HE)) {
8303                         err = -EINVAL;
8304                         goto err_free;
8305                 }
8306
8307                 sband = local->hw.wiphy->bands[cbss->channel->band];
8308
8309                 assoc_data->link[0].bss = cbss;
8310
8311                 if (match_auth)
8312                         assoc_data->link[0].conn = sdata->deflink.u.mgd.conn;
8313                 else
8314                         assoc_data->link[0].conn =
8315                                 ieee80211_conn_settings_unlimited;
8316                 ieee80211_determine_our_sta_mode_assoc(sdata, sband, req,
8317                                                        assoc_data->wmm, 0,
8318                                                        &assoc_data->link[0].conn);
8319
8320                 uapsd_supported = bss->uapsd_supported;
8321
8322                 err = ieee80211_mgd_get_ap_ht_vht_capa(sdata, assoc_data, 0);
8323                 if (err)
8324                         goto err_free;
8325         }
8326
8327         assoc_data->spp_amsdu = req->flags & ASSOC_REQ_SPP_AMSDU;
8328
8329         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
8330                 err = -EBUSY;
8331                 goto err_free;
8332         }
8333
8334         if (ifmgd->assoc_data) {
8335                 err = -EBUSY;
8336                 goto err_free;
8337         }
8338
8339         /* Cleanup is delayed if auth_data matches */
8340         if (ifmgd->auth_data && !match_auth)
8341                 ieee80211_destroy_auth_data(sdata, false);
8342
8343         if (req->ie && req->ie_len) {
8344                 memcpy(assoc_data->ie, req->ie, req->ie_len);
8345                 assoc_data->ie_len = req->ie_len;
8346                 assoc_data->ie_pos = assoc_data->ie + assoc_data->ie_len;
8347         } else {
8348                 assoc_data->ie_pos = assoc_data->ie;
8349         }
8350
8351         if (req->fils_kek) {
8352                 /* should already be checked in cfg80211 - so warn */
8353                 if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
8354                         err = -EINVAL;
8355                         goto err_free;
8356                 }
8357                 memcpy(assoc_data->fils_kek, req->fils_kek,
8358                        req->fils_kek_len);
8359                 assoc_data->fils_kek_len = req->fils_kek_len;
8360         }
8361
8362         if (req->fils_nonces)
8363                 memcpy(assoc_data->fils_nonces, req->fils_nonces,
8364                        2 * FILS_NONCE_LEN);
8365
8366         /* default timeout */
8367         assoc_data->timeout = jiffies;
8368         assoc_data->timeout_started = true;
8369
8370         assoc_data->assoc_link_id = assoc_link_id;
8371
8372         if (req->ap_mld_addr) {
8373                 /* if there was no authentication, set up the link */
8374                 err = ieee80211_vif_set_links(sdata, BIT(assoc_link_id), 0);
8375                 if (err)
8376                         goto err_clear;
8377         }
8378
8379         link = sdata_dereference(sdata->link[assoc_link_id], sdata);
8380         if (WARN_ON(!link)) {
8381                 err = -EINVAL;
8382                 goto err_clear;
8383         }
8384
8385         override = link->u.mgd.conn.mode !=
8386                         assoc_data->link[assoc_link_id].conn.mode ||
8387                    link->u.mgd.conn.bw_limit !=
8388                         assoc_data->link[assoc_link_id].conn.bw_limit;
8389         link->u.mgd.conn = assoc_data->link[assoc_link_id].conn;
8390
8391         ieee80211_setup_assoc_link(sdata, assoc_data, req, &link->u.mgd.conn,
8392                                    assoc_link_id);
8393
8394         if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
8395                  ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
8396              "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
8397                 sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
8398
8399         if (assoc_data->wmm && uapsd_supported &&
8400             (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
8401                 assoc_data->uapsd = true;
8402                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
8403         } else {
8404                 assoc_data->uapsd = false;
8405                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
8406         }
8407
8408         if (req->prev_bssid)
8409                 memcpy(assoc_data->prev_ap_addr, req->prev_bssid, ETH_ALEN);
8410
8411         if (req->use_mfp) {
8412                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
8413                 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
8414         } else {
8415                 ifmgd->mfp = IEEE80211_MFP_DISABLED;
8416                 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
8417         }
8418
8419         if (req->flags & ASSOC_REQ_USE_RRM)
8420                 ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
8421         else
8422                 ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
8423
8424         if (req->crypto.control_port)
8425                 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
8426         else
8427                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
8428
8429         sdata->control_port_protocol = req->crypto.control_port_ethertype;
8430         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
8431         sdata->control_port_over_nl80211 =
8432                                         req->crypto.control_port_over_nl80211;
8433         sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
8434
8435         /* kick off associate process */
8436         ifmgd->assoc_data = assoc_data;
8437
8438         for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
8439                 if (!assoc_data->link[i].bss)
8440                         continue;
8441                 if (i == assoc_data->assoc_link_id)
8442                         continue;
8443                 /* only calculate the mode, hence link == NULL */
8444                 err = ieee80211_prep_channel(sdata, NULL, i,
8445                                              assoc_data->link[i].bss, true,
8446                                              &assoc_data->link[i].conn);
8447                 if (err) {
8448                         req->links[i].error = err;
8449                         goto err_clear;
8450                 }
8451         }
8452
8453         memcpy(vif_cfg->ssid, assoc_data->ssid, assoc_data->ssid_len);
8454         vif_cfg->ssid_len = assoc_data->ssid_len;
8455
8456         /* needed for transmitting the assoc frames properly */
8457         memcpy(sdata->vif.cfg.ap_addr, assoc_data->ap_addr, ETH_ALEN);
8458
8459         err = ieee80211_prep_connection(sdata, cbss, req->link_id,
8460                                         req->ap_mld_addr, true,
8461                                         &assoc_data->link[assoc_link_id].conn,
8462                                         override);
8463         if (err)
8464                 goto err_clear;
8465
8466         if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC)) {
8467                 const struct cfg80211_bss_ies *beacon_ies;
8468
8469                 rcu_read_lock();
8470                 beacon_ies = rcu_dereference(req->bss->beacon_ies);
8471                 if (!beacon_ies) {
8472                         /*
8473                          * Wait up to one beacon interval ...
8474                          * should this be more if we miss one?
8475                          */
8476                         sdata_info(sdata, "waiting for beacon from %pM\n",
8477                                    link->u.mgd.bssid);
8478                         assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
8479                         assoc_data->timeout_started = true;
8480                         assoc_data->need_beacon = true;
8481                 }
8482                 rcu_read_unlock();
8483         }
8484
8485         run_again(sdata, assoc_data->timeout);
8486
8487         /* We are associating, clean up auth_data */
8488         if (ifmgd->auth_data)
8489                 ieee80211_destroy_auth_data(sdata, true);
8490
8491         return 0;
8492  err_clear:
8493         if (!ifmgd->auth_data) {
8494                 eth_zero_addr(sdata->deflink.u.mgd.bssid);
8495                 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
8496                                                   BSS_CHANGED_BSSID);
8497         }
8498         ifmgd->assoc_data = NULL;
8499  err_free:
8500         kfree(assoc_data);
8501         return err;
8502 }
8503
8504 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
8505                          struct cfg80211_deauth_request *req)
8506 {
8507         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
8508         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
8509         bool tx = !req->local_state_change;
8510         struct ieee80211_prep_tx_info info = {
8511                 .subtype = IEEE80211_STYPE_DEAUTH,
8512         };
8513
8514         if (ifmgd->auth_data &&
8515             ether_addr_equal(ifmgd->auth_data->ap_addr, req->bssid)) {
8516                 sdata_info(sdata,
8517                            "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
8518                            req->bssid, req->reason_code,
8519                            ieee80211_get_reason_code_string(req->reason_code));
8520
8521                 info.link_id = ifmgd->auth_data->link_id;
8522                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
8523                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
8524                                                IEEE80211_STYPE_DEAUTH,
8525                                                req->reason_code, tx,
8526                                                frame_buf);
8527                 ieee80211_destroy_auth_data(sdata, false);
8528                 ieee80211_report_disconnect(sdata, frame_buf,
8529                                             sizeof(frame_buf), true,
8530                                             req->reason_code, false);
8531                 drv_mgd_complete_tx(sdata->local, sdata, &info);
8532                 return 0;
8533         }
8534
8535         if (ifmgd->assoc_data &&
8536             ether_addr_equal(ifmgd->assoc_data->ap_addr, req->bssid)) {
8537                 sdata_info(sdata,
8538                            "aborting association with %pM by local choice (Reason: %u=%s)\n",
8539                            req->bssid, req->reason_code,
8540                            ieee80211_get_reason_code_string(req->reason_code));
8541
8542                 info.link_id = ifmgd->assoc_data->assoc_link_id;
8543                 drv_mgd_prepare_tx(sdata->local, sdata, &info);
8544                 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
8545                                                IEEE80211_STYPE_DEAUTH,
8546                                                req->reason_code, tx,
8547                                                frame_buf);
8548                 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
8549                 ieee80211_report_disconnect(sdata, frame_buf,
8550                                             sizeof(frame_buf), true,
8551                                             req->reason_code, false);
8552                 drv_mgd_complete_tx(sdata->local, sdata, &info);
8553                 return 0;
8554         }
8555
8556         if (ifmgd->associated &&
8557             ether_addr_equal(sdata->vif.cfg.ap_addr, req->bssid)) {
8558                 sdata_info(sdata,
8559                            "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
8560                            req->bssid, req->reason_code,
8561                            ieee80211_get_reason_code_string(req->reason_code));
8562
8563                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
8564                                        req->reason_code, tx, frame_buf);
8565                 ieee80211_report_disconnect(sdata, frame_buf,
8566                                             sizeof(frame_buf), true,
8567                                             req->reason_code, false);
8568                 drv_mgd_complete_tx(sdata->local, sdata, &info);
8569                 return 0;
8570         }
8571
8572         return -ENOTCONN;
8573 }
8574
8575 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
8576                            struct cfg80211_disassoc_request *req)
8577 {
8578         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
8579
8580         if (!sdata->u.mgd.associated ||
8581             memcmp(sdata->vif.cfg.ap_addr, req->ap_addr, ETH_ALEN))
8582                 return -ENOTCONN;
8583
8584         sdata_info(sdata,
8585                    "disassociating from %pM by local choice (Reason: %u=%s)\n",
8586                    req->ap_addr, req->reason_code,
8587                    ieee80211_get_reason_code_string(req->reason_code));
8588
8589         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
8590                                req->reason_code, !req->local_state_change,
8591                                frame_buf);
8592
8593         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
8594                                     req->reason_code, false);
8595
8596         return 0;
8597 }
8598
8599 void ieee80211_mgd_stop_link(struct ieee80211_link_data *link)
8600 {
8601         wiphy_work_cancel(link->sdata->local->hw.wiphy,
8602                           &link->u.mgd.request_smps_work);
8603         wiphy_work_cancel(link->sdata->local->hw.wiphy,
8604                           &link->u.mgd.recalc_smps);
8605         wiphy_delayed_work_cancel(link->sdata->local->hw.wiphy,
8606                                   &link->u.mgd.chswitch_work);
8607 }
8608
8609 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
8610 {
8611         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
8612
8613         /*
8614          * Make sure some work items will not run after this,
8615          * they will not do anything but might not have been
8616          * cancelled when disconnecting.
8617          */
8618         wiphy_work_cancel(sdata->local->hw.wiphy,
8619                           &ifmgd->monitor_work);
8620         wiphy_work_cancel(sdata->local->hw.wiphy,
8621                           &ifmgd->beacon_connection_loss_work);
8622         wiphy_work_cancel(sdata->local->hw.wiphy,
8623                           &ifmgd->csa_connection_drop_work);
8624         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
8625                                   &ifmgd->tdls_peer_del_work);
8626         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
8627                                   &ifmgd->ml_reconf_work);
8628         wiphy_delayed_work_cancel(sdata->local->hw.wiphy, &ifmgd->ttlm_work);
8629         wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
8630                                   &ifmgd->neg_ttlm_timeout_work);
8631
8632         if (ifmgd->assoc_data)
8633                 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
8634         if (ifmgd->auth_data)
8635                 ieee80211_destroy_auth_data(sdata, false);
8636         spin_lock_bh(&ifmgd->teardown_lock);
8637         if (ifmgd->teardown_skb) {
8638                 kfree_skb(ifmgd->teardown_skb);
8639                 ifmgd->teardown_skb = NULL;
8640                 ifmgd->orig_teardown_skb = NULL;
8641         }
8642         kfree(ifmgd->assoc_req_ies);
8643         ifmgd->assoc_req_ies = NULL;
8644         ifmgd->assoc_req_ies_len = 0;
8645         spin_unlock_bh(&ifmgd->teardown_lock);
8646         del_timer_sync(&ifmgd->timer);
8647 }
8648
8649 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
8650                                enum nl80211_cqm_rssi_threshold_event rssi_event,
8651                                s32 rssi_level,
8652                                gfp_t gfp)
8653 {
8654         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
8655
8656         trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
8657
8658         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
8659 }
8660 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
8661
8662 void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
8663 {
8664         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
8665
8666         trace_api_cqm_beacon_loss_notify(sdata->local, sdata);
8667
8668         cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
8669 }
8670 EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);
8671
8672 static void _ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data *sdata,
8673                                             int rssi_min_thold,
8674                                             int rssi_max_thold)
8675 {
8676         trace_api_enable_rssi_reports(sdata, rssi_min_thold, rssi_max_thold);
8677
8678         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
8679                 return;
8680
8681         /*
8682          * Scale up threshold values before storing it, as the RSSI averaging
8683          * algorithm uses a scaled up value as well. Change this scaling
8684          * factor if the RSSI averaging algorithm changes.
8685          */
8686         sdata->u.mgd.rssi_min_thold = rssi_min_thold*16;
8687         sdata->u.mgd.rssi_max_thold = rssi_max_thold*16;
8688 }
8689
8690 void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
8691                                     int rssi_min_thold,
8692                                     int rssi_max_thold)
8693 {
8694         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
8695
8696         WARN_ON(rssi_min_thold == rssi_max_thold ||
8697                 rssi_min_thold > rssi_max_thold);
8698
8699         _ieee80211_enable_rssi_reports(sdata, rssi_min_thold,
8700                                        rssi_max_thold);
8701 }
8702 EXPORT_SYMBOL(ieee80211_enable_rssi_reports);
8703
8704 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
8705 {
8706         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
8707
8708         _ieee80211_enable_rssi_reports(sdata, 0, 0);
8709 }
8710 EXPORT_SYMBOL(ieee80211_disable_rssi_reports);