linux/net/mac80211/mlme.c
<<
>>
Prefs
   1/*
   2 * BSS client mode implementation
   3 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
   4 * Copyright 2004, Instant802 Networks, Inc.
   5 * Copyright 2005, Devicescape Software, Inc.
   6 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8 * Copyright 2013-2014  Intel Mobile Communications GmbH
   9 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
  10 *
  11 * This program is free software; you can redistribute it and/or modify
  12 * it under the terms of the GNU General Public License version 2 as
  13 * published by the Free Software Foundation.
  14 */
  15
  16#include <linux/delay.h>
  17#include <linux/if_ether.h>
  18#include <linux/skbuff.h>
  19#include <linux/if_arp.h>
  20#include <linux/etherdevice.h>
  21#include <linux/moduleparam.h>
  22#include <linux/rtnetlink.h>
  23#include <linux/crc32.h>
  24#include <linux/slab.h>
  25#include <linux/export.h>
  26#include <net/mac80211.h>
  27#include <asm/unaligned.h>
  28
  29#include "ieee80211_i.h"
  30#include "driver-ops.h"
  31#include "rate.h"
  32#include "led.h"
  33#include "fils_aead.h"
  34
  35#define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
  36#define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
  37#define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
  38#define IEEE80211_AUTH_MAX_TRIES        3
  39#define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
  40#define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
  41#define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
  42#define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
  43#define IEEE80211_ASSOC_MAX_TRIES       3
  44
  45static int max_nullfunc_tries = 2;
  46module_param(max_nullfunc_tries, int, 0644);
  47MODULE_PARM_DESC(max_nullfunc_tries,
  48                 "Maximum nullfunc tx tries before disconnecting (reason 4).");
  49
  50static int max_probe_tries = 5;
  51module_param(max_probe_tries, int, 0644);
  52MODULE_PARM_DESC(max_probe_tries,
  53                 "Maximum probe tries before disconnecting (reason 4).");
  54
  55/*
  56 * Beacon loss timeout is calculated as N frames times the
  57 * advertised beacon interval.  This may need to be somewhat
  58 * higher than what hardware might detect to account for
  59 * delays in the host processing frames. But since we also
  60 * probe on beacon miss before declaring the connection lost
  61 * default to what we want.
  62 */
  63static int beacon_loss_count = 7;
  64module_param(beacon_loss_count, int, 0644);
  65MODULE_PARM_DESC(beacon_loss_count,
  66                 "Number of beacon intervals before we decide beacon was lost.");
  67
  68/*
  69 * Time the connection can be idle before we probe
  70 * it to see if we can still talk to the AP.
  71 */
  72#define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
  73/*
  74 * Time we wait for a probe response after sending
  75 * a probe request because of beacon loss or for
  76 * checking the connection still works.
  77 */
  78static int probe_wait_ms = 500;
  79module_param(probe_wait_ms, int, 0644);
  80MODULE_PARM_DESC(probe_wait_ms,
  81                 "Maximum time(ms) to wait for probe response"
  82                 " before disconnecting (reason 4).");
  83
  84/*
  85 * How many Beacon frames need to have been used in average signal strength
  86 * before starting to indicate signal change events.
  87 */
  88#define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
  89
  90/*
  91 * We can have multiple work items (and connection probing)
  92 * scheduling this timer, but we need to take care to only
  93 * reschedule it when it should fire _earlier_ than it was
  94 * asked for before, or if it's not pending right now. This
  95 * function ensures that. Note that it then is required to
  96 * run this function for all timeouts after the first one
  97 * has happened -- the work that runs from this timer will
  98 * do that.
  99 */
 100static void run_again(struct ieee80211_sub_if_data *sdata,
 101                      unsigned long timeout)
 102{
 103        sdata_assert_lock(sdata);
 104
 105        if (!timer_pending(&sdata->u.mgd.timer) ||
 106            time_before(timeout, sdata->u.mgd.timer.expires))
 107                mod_timer(&sdata->u.mgd.timer, timeout);
 108}
 109
 110void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 111{
 112        if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
 113                return;
 114
 115        if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 116                return;
 117
 118        mod_timer(&sdata->u.mgd.bcn_mon_timer,
 119                  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 120}
 121
 122void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 123{
 124        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 125
 126        if (unlikely(!ifmgd->associated))
 127                return;
 128
 129        if (ifmgd->probe_send_count)
 130                ifmgd->probe_send_count = 0;
 131
 132        if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
 133                return;
 134
 135        mod_timer(&ifmgd->conn_mon_timer,
 136                  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 137}
 138
 139static int ecw2cw(int ecw)
 140{
 141        return (1 << ecw) - 1;
 142}
 143
 144static u32
 145ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 146                             struct ieee80211_supported_band *sband,
 147                             struct ieee80211_channel *channel,
 148                             const struct ieee80211_ht_cap *ht_cap,
 149                             const struct ieee80211_ht_operation *ht_oper,
 150                             const struct ieee80211_vht_operation *vht_oper,
 151                             struct cfg80211_chan_def *chandef, bool tracking)
 152{
 153        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 154        struct cfg80211_chan_def vht_chandef;
 155        struct ieee80211_sta_ht_cap sta_ht_cap;
 156        u32 ht_cfreq, ret;
 157
 158        memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
 159        ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
 160
 161        chandef->chan = channel;
 162        chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
 163        chandef->center_freq1 = channel->center_freq;
 164        chandef->center_freq2 = 0;
 165
 166        if (!ht_cap || !ht_oper || !sta_ht_cap.ht_supported) {
 167                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
 168                goto out;
 169        }
 170
 171        chandef->width = NL80211_CHAN_WIDTH_20;
 172
 173        if (!(ht_cap->cap_info &
 174              cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
 175                ret = IEEE80211_STA_DISABLE_40MHZ;
 176                vht_chandef = *chandef;
 177                goto out;
 178        }
 179
 180        ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
 181                                                  channel->band);
 182        /* check that channel matches the right operating channel */
 183        if (!tracking && channel->center_freq != ht_cfreq) {
 184                /*
 185                 * It's possible that some APs are confused here;
 186                 * Netgear WNDR3700 sometimes reports 4 higher than
 187                 * the actual channel in association responses, but
 188                 * since we look at probe response/beacon data here
 189                 * it should be OK.
 190                 */
 191                sdata_info(sdata,
 192                           "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
 193                           channel->center_freq, ht_cfreq,
 194                           ht_oper->primary_chan, channel->band);
 195                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
 196                goto out;
 197        }
 198
 199        /* check 40 MHz support, if we have it */
 200        if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
 201                ieee80211_chandef_ht_oper(ht_oper, chandef);
 202        } else {
 203                /* 40 MHz (and 80 MHz) must be supported for VHT */
 204                ret = IEEE80211_STA_DISABLE_VHT;
 205                /* also mark 40 MHz disabled */
 206                ret |= IEEE80211_STA_DISABLE_40MHZ;
 207                goto out;
 208        }
 209
 210        if (!vht_oper || !sband->vht_cap.vht_supported) {
 211                ret = IEEE80211_STA_DISABLE_VHT;
 212                goto out;
 213        }
 214
 215        vht_chandef = *chandef;
 216        if (!ieee80211_chandef_vht_oper(vht_oper, &vht_chandef)) {
 217                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 218                        sdata_info(sdata,
 219                                   "AP VHT information is invalid, disable VHT\n");
 220                ret = IEEE80211_STA_DISABLE_VHT;
 221                goto out;
 222        }
 223
 224        if (!cfg80211_chandef_valid(&vht_chandef)) {
 225                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 226                        sdata_info(sdata,
 227                                   "AP VHT information is invalid, disable VHT\n");
 228                ret = IEEE80211_STA_DISABLE_VHT;
 229                goto out;
 230        }
 231
 232        if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
 233                ret = 0;
 234                goto out;
 235        }
 236
 237        if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
 238                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 239                        sdata_info(sdata,
 240                                   "AP VHT information doesn't match HT, disable VHT\n");
 241                ret = IEEE80211_STA_DISABLE_VHT;
 242                goto out;
 243        }
 244
 245        *chandef = vht_chandef;
 246
 247        ret = 0;
 248
 249out:
 250        /*
 251         * When tracking the current AP, don't do any further checks if the
 252         * new chandef is identical to the one we're currently using for the
 253         * connection. This keeps us from playing ping-pong with regulatory,
 254         * without it the following can happen (for example):
 255         *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
 256         *  - AP advertises regdom US
 257         *  - CRDA loads regdom US with 80 MHz prohibited (old database)
 258         *  - the code below detects an unsupported channel, downgrades, and
 259         *    we disconnect from the AP in the caller
 260         *  - disconnect causes CRDA to reload world regdomain and the game
 261         *    starts anew.
 262         * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
 263         *
 264         * It seems possible that there are still scenarios with CSA or real
 265         * bandwidth changes where a this could happen, but those cases are
 266         * less common and wouldn't completely prevent using the AP.
 267         */
 268        if (tracking &&
 269            cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
 270                return ret;
 271
 272        /* don't print the message below for VHT mismatch if VHT is disabled */
 273        if (ret & IEEE80211_STA_DISABLE_VHT)
 274                vht_chandef = *chandef;
 275
 276        /*
 277         * Ignore the DISABLED flag when we're already connected and only
 278         * tracking the APs beacon for bandwidth changes - otherwise we
 279         * might get disconnected here if we connect to an AP, update our
 280         * regulatory information based on the AP's country IE and the
 281         * information we have is wrong/outdated and disables the channel
 282         * that we're actually using for the connection to the AP.
 283         */
 284        while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
 285                                        tracking ? 0 :
 286                                                   IEEE80211_CHAN_DISABLED)) {
 287                if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
 288                        ret = IEEE80211_STA_DISABLE_HT |
 289                              IEEE80211_STA_DISABLE_VHT;
 290                        break;
 291                }
 292
 293                ret |= ieee80211_chandef_downgrade(chandef);
 294        }
 295
 296        if (chandef->width != vht_chandef.width && !tracking)
 297                sdata_info(sdata,
 298                           "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 299
 300        WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
 301        return ret;
 302}
 303
 304static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
 305                               struct sta_info *sta,
 306                               const struct ieee80211_ht_cap *ht_cap,
 307                               const struct ieee80211_ht_operation *ht_oper,
 308                               const struct ieee80211_vht_operation *vht_oper,
 309                               const u8 *bssid, u32 *changed)
 310{
 311        struct ieee80211_local *local = sdata->local;
 312        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 313        struct ieee80211_supported_band *sband;
 314        struct ieee80211_channel *chan;
 315        struct cfg80211_chan_def chandef;
 316        u16 ht_opmode;
 317        u32 flags;
 318        enum ieee80211_sta_rx_bandwidth new_sta_bw;
 319        int ret;
 320
 321        /* if HT was/is disabled, don't track any bandwidth changes */
 322        if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
 323                return 0;
 324
 325        /* don't check VHT if we associated as non-VHT station */
 326        if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
 327                vht_oper = NULL;
 328
 329        if (WARN_ON_ONCE(!sta))
 330                return -EINVAL;
 331
 332        /*
 333         * if bss configuration changed store the new one -
 334         * this may be applicable even if channel is identical
 335         */
 336        ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 337        if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
 338                *changed |= BSS_CHANGED_HT;
 339                sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
 340        }
 341
 342        chan = sdata->vif.bss_conf.chandef.chan;
 343        sband = local->hw.wiphy->bands[chan->band];
 344
 345        /* calculate new channel (type) based on HT/VHT operation IEs */
 346        flags = ieee80211_determine_chantype(sdata, sband, chan,
 347                                             ht_cap, ht_oper, vht_oper,
 348                                             &chandef, true);
 349
 350        /*
 351         * Downgrade the new channel if we associated with restricted
 352         * capabilities. For example, if we associated as a 20 MHz STA
 353         * to a 40 MHz AP (due to regulatory, capabilities or config
 354         * reasons) then switching to a 40 MHz channel now won't do us
 355         * any good -- we couldn't use it with the AP.
 356         */
 357        if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
 358            chandef.width == NL80211_CHAN_WIDTH_80P80)
 359                flags |= ieee80211_chandef_downgrade(&chandef);
 360        if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
 361            chandef.width == NL80211_CHAN_WIDTH_160)
 362                flags |= ieee80211_chandef_downgrade(&chandef);
 363        if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
 364            chandef.width > NL80211_CHAN_WIDTH_20)
 365                flags |= ieee80211_chandef_downgrade(&chandef);
 366
 367        if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
 368                return 0;
 369
 370        sdata_info(sdata,
 371                   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
 372                   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
 373                   chandef.center_freq1, chandef.center_freq2);
 374
 375        if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
 376                                      IEEE80211_STA_DISABLE_VHT |
 377                                      IEEE80211_STA_DISABLE_40MHZ |
 378                                      IEEE80211_STA_DISABLE_80P80MHZ |
 379                                      IEEE80211_STA_DISABLE_160MHZ)) ||
 380            !cfg80211_chandef_valid(&chandef)) {
 381                sdata_info(sdata,
 382                           "AP %pM changed bandwidth in a way we can't support - disconnect\n",
 383                           ifmgd->bssid);
 384                return -EINVAL;
 385        }
 386
 387        switch (chandef.width) {
 388        case NL80211_CHAN_WIDTH_20_NOHT:
 389        case NL80211_CHAN_WIDTH_20:
 390                new_sta_bw = IEEE80211_STA_RX_BW_20;
 391                break;
 392        case NL80211_CHAN_WIDTH_40:
 393                new_sta_bw = IEEE80211_STA_RX_BW_40;
 394                break;
 395        case NL80211_CHAN_WIDTH_80:
 396                new_sta_bw = IEEE80211_STA_RX_BW_80;
 397                break;
 398        case NL80211_CHAN_WIDTH_80P80:
 399        case NL80211_CHAN_WIDTH_160:
 400                new_sta_bw = IEEE80211_STA_RX_BW_160;
 401                break;
 402        default:
 403                return -EINVAL;
 404        }
 405
 406        if (new_sta_bw > sta->cur_max_bandwidth)
 407                new_sta_bw = sta->cur_max_bandwidth;
 408
 409        if (new_sta_bw < sta->sta.bandwidth) {
 410                sta->sta.bandwidth = new_sta_bw;
 411                rate_control_rate_update(local, sband, sta,
 412                                         IEEE80211_RC_BW_CHANGED);
 413        }
 414
 415        ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
 416        if (ret) {
 417                sdata_info(sdata,
 418                           "AP %pM changed bandwidth to incompatible one - disconnect\n",
 419                           ifmgd->bssid);
 420                return ret;
 421        }
 422
 423        if (new_sta_bw > sta->sta.bandwidth) {
 424                sta->sta.bandwidth = new_sta_bw;
 425                rate_control_rate_update(local, sband, sta,
 426                                         IEEE80211_RC_BW_CHANGED);
 427        }
 428
 429        return 0;
 430}
 431
 432/* frame sending functions */
 433
 434static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 435                                struct sk_buff *skb, u8 ap_ht_param,
 436                                struct ieee80211_supported_band *sband,
 437                                struct ieee80211_channel *channel,
 438                                enum ieee80211_smps_mode smps)
 439{
 440        u8 *pos;
 441        u32 flags = channel->flags;
 442        u16 cap;
 443        struct ieee80211_sta_ht_cap ht_cap;
 444
 445        BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 446
 447        memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
 448        ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 449
 450        /* determine capability flags */
 451        cap = ht_cap.cap;
 452
 453        switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
 454        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
 455                if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
 456                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 457                        cap &= ~IEEE80211_HT_CAP_SGI_40;
 458                }
 459                break;
 460        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
 461                if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
 462                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 463                        cap &= ~IEEE80211_HT_CAP_SGI_40;
 464                }
 465                break;
 466        }
 467
 468        /*
 469         * If 40 MHz was disabled associate as though we weren't
 470         * capable of 40 MHz -- some broken APs will never fall
 471         * back to trying to transmit in 20 MHz.
 472         */
 473        if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
 474                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 475                cap &= ~IEEE80211_HT_CAP_SGI_40;
 476        }
 477
 478        /* set SM PS mode properly */
 479        cap &= ~IEEE80211_HT_CAP_SM_PS;
 480        switch (smps) {
 481        case IEEE80211_SMPS_AUTOMATIC:
 482        case IEEE80211_SMPS_NUM_MODES:
 483                WARN_ON(1);
 484        case IEEE80211_SMPS_OFF:
 485                cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
 486                        IEEE80211_HT_CAP_SM_PS_SHIFT;
 487                break;
 488        case IEEE80211_SMPS_STATIC:
 489                cap |= WLAN_HT_CAP_SM_PS_STATIC <<
 490                        IEEE80211_HT_CAP_SM_PS_SHIFT;
 491                break;
 492        case IEEE80211_SMPS_DYNAMIC:
 493                cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
 494                        IEEE80211_HT_CAP_SM_PS_SHIFT;
 495                break;
 496        }
 497
 498        /* reserve and fill IE */
 499        pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
 500        ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 501}
 502
 503/* This function determines vht capability flags for the association
 504 * and builds the IE.
 505 * Note - the function may set the owner of the MU-MIMO capability
 506 */
 507static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
 508                                 struct sk_buff *skb,
 509                                 struct ieee80211_supported_band *sband,
 510                                 struct ieee80211_vht_cap *ap_vht_cap)
 511{
 512        struct ieee80211_local *local = sdata->local;
 513        u8 *pos;
 514        u32 cap;
 515        struct ieee80211_sta_vht_cap vht_cap;
 516        u32 mask, ap_bf_sts, our_bf_sts;
 517
 518        BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 519
 520        memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
 521        ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
 522
 523        /* determine capability flags */
 524        cap = vht_cap.cap;
 525
 526        if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
 527                u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 528
 529                cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 530                if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
 531                    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
 532                        cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
 533        }
 534
 535        if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
 536                cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
 537                cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 538        }
 539
 540        /*
 541         * Some APs apparently get confused if our capabilities are better
 542         * than theirs, so restrict what we advertise in the assoc request.
 543         */
 544        if (!(ap_vht_cap->vht_cap_info &
 545                        cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
 546                cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
 547                         IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 548        else if (!(ap_vht_cap->vht_cap_info &
 549                        cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
 550                cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 551
 552        /*
 553         * If some other vif is using the MU-MIMO capablity we cannot associate
 554         * using MU-MIMO - this will lead to contradictions in the group-id
 555         * mechanism.
 556         * Ownership is defined since association request, in order to avoid
 557         * simultaneous associations with MU-MIMO.
 558         */
 559        if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
 560                bool disable_mu_mimo = false;
 561                struct ieee80211_sub_if_data *other;
 562
 563                list_for_each_entry_rcu(other, &local->interfaces, list) {
 564                        if (other->vif.mu_mimo_owner) {
 565                                disable_mu_mimo = true;
 566                                break;
 567                        }
 568                }
 569                if (disable_mu_mimo)
 570                        cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
 571                else
 572                        sdata->vif.mu_mimo_owner = true;
 573        }
 574
 575        mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
 576
 577        ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
 578        our_bf_sts = cap & mask;
 579
 580        if (ap_bf_sts < our_bf_sts) {
 581                cap &= ~mask;
 582                cap |= ap_bf_sts;
 583        }
 584
 585        /* reserve and fill IE */
 586        pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
 587        ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
 588}
 589
 590static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 591{
 592        struct ieee80211_local *local = sdata->local;
 593        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 594        struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
 595        struct sk_buff *skb;
 596        struct ieee80211_mgmt *mgmt;
 597        u8 *pos, qos_info;
 598        size_t offset = 0, noffset;
 599        int i, count, rates_len, supp_rates_len, shift;
 600        u16 capab;
 601        struct ieee80211_supported_band *sband;
 602        struct ieee80211_chanctx_conf *chanctx_conf;
 603        struct ieee80211_channel *chan;
 604        u32 rates = 0;
 605
 606        sdata_assert_lock(sdata);
 607
 608        rcu_read_lock();
 609        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 610        if (WARN_ON(!chanctx_conf)) {
 611                rcu_read_unlock();
 612                return;
 613        }
 614        chan = chanctx_conf->def.chan;
 615        rcu_read_unlock();
 616        sband = local->hw.wiphy->bands[chan->band];
 617        shift = ieee80211_vif_get_shift(&sdata->vif);
 618
 619        if (assoc_data->supp_rates_len) {
 620                /*
 621                 * Get all rates supported by the device and the AP as
 622                 * some APs don't like getting a superset of their rates
 623                 * in the association request (e.g. D-Link DAP 1353 in
 624                 * b-only mode)...
 625                 */
 626                rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
 627                                                     assoc_data->supp_rates,
 628                                                     assoc_data->supp_rates_len,
 629                                                     &rates);
 630        } else {
 631                /*
 632                 * In case AP not provide any supported rates information
 633                 * before association, we send information element(s) with
 634                 * all rates that we support.
 635                 */
 636                rates_len = 0;
 637                for (i = 0; i < sband->n_bitrates; i++) {
 638                        rates |= BIT(i);
 639                        rates_len++;
 640                }
 641        }
 642
 643        skb = alloc_skb(local->hw.extra_tx_headroom +
 644                        sizeof(*mgmt) + /* bit too much but doesn't matter */
 645                        2 + assoc_data->ssid_len + /* SSID */
 646                        4 + rates_len + /* (extended) rates */
 647                        4 + /* power capability */
 648                        2 + 2 * sband->n_channels + /* supported channels */
 649                        2 + sizeof(struct ieee80211_ht_cap) + /* HT */
 650                        2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
 651                        assoc_data->ie_len + /* extra IEs */
 652                        (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
 653                        9, /* WMM */
 654                        GFP_KERNEL);
 655        if (!skb)
 656                return;
 657
 658        skb_reserve(skb, local->hw.extra_tx_headroom);
 659
 660        capab = WLAN_CAPABILITY_ESS;
 661
 662        if (sband->band == NL80211_BAND_2GHZ) {
 663                capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 664                capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 665        }
 666
 667        if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
 668                capab |= WLAN_CAPABILITY_PRIVACY;
 669
 670        if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
 671            ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
 672                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 673
 674        if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
 675                capab |= WLAN_CAPABILITY_RADIO_MEASURE;
 676
 677        mgmt = skb_put_zero(skb, 24);
 678        memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
 679        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
 680        memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
 681
 682        if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
 683                skb_put(skb, 10);
 684                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 685                                                  IEEE80211_STYPE_REASSOC_REQ);
 686                mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 687                mgmt->u.reassoc_req.listen_interval =
 688                                cpu_to_le16(local->hw.conf.listen_interval);
 689                memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
 690                       ETH_ALEN);
 691        } else {
 692                skb_put(skb, 4);
 693                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 694                                                  IEEE80211_STYPE_ASSOC_REQ);
 695                mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 696                mgmt->u.assoc_req.listen_interval =
 697                                cpu_to_le16(local->hw.conf.listen_interval);
 698        }
 699
 700        /* SSID */
 701        pos = skb_put(skb, 2 + assoc_data->ssid_len);
 702        *pos++ = WLAN_EID_SSID;
 703        *pos++ = assoc_data->ssid_len;
 704        memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
 705
 706        /* add all rates which were marked to be used above */
 707        supp_rates_len = rates_len;
 708        if (supp_rates_len > 8)
 709                supp_rates_len = 8;
 710
 711        pos = skb_put(skb, supp_rates_len + 2);
 712        *pos++ = WLAN_EID_SUPP_RATES;
 713        *pos++ = supp_rates_len;
 714
 715        count = 0;
 716        for (i = 0; i < sband->n_bitrates; i++) {
 717                if (BIT(i) & rates) {
 718                        int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 719                                                5 * (1 << shift));
 720                        *pos++ = (u8) rate;
 721                        if (++count == 8)
 722                                break;
 723                }
 724        }
 725
 726        if (rates_len > count) {
 727                pos = skb_put(skb, rates_len - count + 2);
 728                *pos++ = WLAN_EID_EXT_SUPP_RATES;
 729                *pos++ = rates_len - count;
 730
 731                for (i++; i < sband->n_bitrates; i++) {
 732                        if (BIT(i) & rates) {
 733                                int rate;
 734                                rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
 735                                                    5 * (1 << shift));
 736                                *pos++ = (u8) rate;
 737                        }
 738                }
 739        }
 740
 741        if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
 742            capab & WLAN_CAPABILITY_RADIO_MEASURE) {
 743                pos = skb_put(skb, 4);
 744                *pos++ = WLAN_EID_PWR_CAPABILITY;
 745                *pos++ = 2;
 746                *pos++ = 0; /* min tx power */
 747                 /* max tx power */
 748                *pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
 749        }
 750
 751        if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
 752                /* TODO: get this in reg domain format */
 753                pos = skb_put(skb, 2 * sband->n_channels + 2);
 754                *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
 755                *pos++ = 2 * sband->n_channels;
 756                for (i = 0; i < sband->n_channels; i++) {
 757                        *pos++ = ieee80211_frequency_to_channel(
 758                                        sband->channels[i].center_freq);
 759                        *pos++ = 1; /* one channel in the subband*/
 760                }
 761        }
 762
 763        /* if present, add any custom IEs that go before HT */
 764        if (assoc_data->ie_len) {
 765                static const u8 before_ht[] = {
 766                        WLAN_EID_SSID,
 767                        WLAN_EID_SUPP_RATES,
 768                        WLAN_EID_EXT_SUPP_RATES,
 769                        WLAN_EID_PWR_CAPABILITY,
 770                        WLAN_EID_SUPPORTED_CHANNELS,
 771                        WLAN_EID_RSN,
 772                        WLAN_EID_QOS_CAPA,
 773                        WLAN_EID_RRM_ENABLED_CAPABILITIES,
 774                        WLAN_EID_MOBILITY_DOMAIN,
 775                        WLAN_EID_FAST_BSS_TRANSITION,   /* reassoc only */
 776                        WLAN_EID_RIC_DATA,              /* reassoc only */
 777                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 778                };
 779                static const u8 after_ric[] = {
 780                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 781                        WLAN_EID_HT_CAPABILITY,
 782                        WLAN_EID_BSS_COEX_2040,
 783                        WLAN_EID_EXT_CAPABILITY,
 784                        WLAN_EID_QOS_TRAFFIC_CAPA,
 785                        WLAN_EID_TIM_BCAST_REQ,
 786                        WLAN_EID_INTERWORKING,
 787                        /* 60GHz doesn't happen right now */
 788                        WLAN_EID_VHT_CAPABILITY,
 789                        WLAN_EID_OPMODE_NOTIF,
 790                };
 791
 792                noffset = ieee80211_ie_split_ric(assoc_data->ie,
 793                                                 assoc_data->ie_len,
 794                                                 before_ht,
 795                                                 ARRAY_SIZE(before_ht),
 796                                                 after_ric,
 797                                                 ARRAY_SIZE(after_ric),
 798                                                 offset);
 799                skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
 800                offset = noffset;
 801        }
 802
 803        if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
 804                         !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
 805                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
 806
 807        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
 808                ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
 809                                    sband, chan, sdata->smps_mode);
 810
 811        /* if present, add any custom IEs that go before VHT */
 812        if (assoc_data->ie_len) {
 813                static const u8 before_vht[] = {
 814                        WLAN_EID_SSID,
 815                        WLAN_EID_SUPP_RATES,
 816                        WLAN_EID_EXT_SUPP_RATES,
 817                        WLAN_EID_PWR_CAPABILITY,
 818                        WLAN_EID_SUPPORTED_CHANNELS,
 819                        WLAN_EID_RSN,
 820                        WLAN_EID_QOS_CAPA,
 821                        WLAN_EID_RRM_ENABLED_CAPABILITIES,
 822                        WLAN_EID_MOBILITY_DOMAIN,
 823                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 824                        WLAN_EID_HT_CAPABILITY,
 825                        WLAN_EID_BSS_COEX_2040,
 826                        WLAN_EID_EXT_CAPABILITY,
 827                        WLAN_EID_QOS_TRAFFIC_CAPA,
 828                        WLAN_EID_TIM_BCAST_REQ,
 829                        WLAN_EID_INTERWORKING,
 830                };
 831
 832                /* RIC already taken above, so no need to handle here anymore */
 833                noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
 834                                             before_vht, ARRAY_SIZE(before_vht),
 835                                             offset);
 836                skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
 837                offset = noffset;
 838        }
 839
 840        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
 841                ieee80211_add_vht_ie(sdata, skb, sband,
 842                                     &assoc_data->ap_vht_cap);
 843
 844        /* if present, add any custom non-vendor IEs that go after HT */
 845        if (assoc_data->ie_len) {
 846                noffset = ieee80211_ie_split_vendor(assoc_data->ie,
 847                                                    assoc_data->ie_len,
 848                                                    offset);
 849                skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
 850                offset = noffset;
 851        }
 852
 853        if (assoc_data->wmm) {
 854                if (assoc_data->uapsd) {
 855                        qos_info = ifmgd->uapsd_queues;
 856                        qos_info |= (ifmgd->uapsd_max_sp_len <<
 857                                     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
 858                } else {
 859                        qos_info = 0;
 860                }
 861
 862                pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
 863        }
 864
 865        /* add any remaining custom (i.e. vendor specific here) IEs */
 866        if (assoc_data->ie_len) {
 867                noffset = assoc_data->ie_len;
 868                skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
 869        }
 870
 871        if (assoc_data->fils_kek_len &&
 872            fils_encrypt_assoc_req(skb, assoc_data) < 0) {
 873                dev_kfree_skb(skb);
 874                return;
 875        }
 876
 877        drv_mgd_prepare_tx(local, sdata);
 878
 879        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 880        if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
 881                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
 882                                                IEEE80211_TX_INTFL_MLME_CONN_TX;
 883        ieee80211_tx_skb(sdata, skb);
 884}
 885
 886void ieee80211_send_pspoll(struct ieee80211_local *local,
 887                           struct ieee80211_sub_if_data *sdata)
 888{
 889        struct ieee80211_pspoll *pspoll;
 890        struct sk_buff *skb;
 891
 892        skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
 893        if (!skb)
 894                return;
 895
 896        pspoll = (struct ieee80211_pspoll *) skb->data;
 897        pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 898
 899        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 900        ieee80211_tx_skb(sdata, skb);
 901}
 902
 903void ieee80211_send_nullfunc(struct ieee80211_local *local,
 904                             struct ieee80211_sub_if_data *sdata,
 905                             bool powersave)
 906{
 907        struct sk_buff *skb;
 908        struct ieee80211_hdr_3addr *nullfunc;
 909        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 910
 911        skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
 912        if (!skb)
 913                return;
 914
 915        nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
 916        if (powersave)
 917                nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 918
 919        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
 920                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
 921
 922        if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
 923                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 924
 925        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
 926                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
 927
 928        ieee80211_tx_skb(sdata, skb);
 929}
 930
 931static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
 932                                          struct ieee80211_sub_if_data *sdata)
 933{
 934        struct sk_buff *skb;
 935        struct ieee80211_hdr *nullfunc;
 936        __le16 fc;
 937
 938        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
 939                return;
 940
 941        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
 942        if (!skb)
 943                return;
 944
 945        skb_reserve(skb, local->hw.extra_tx_headroom);
 946
 947        nullfunc = skb_put_zero(skb, 30);
 948        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
 949                         IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
 950        nullfunc->frame_control = fc;
 951        memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
 952        memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
 953        memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
 954        memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
 955
 956        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 957        ieee80211_tx_skb(sdata, skb);
 958}
 959
 960/* spectrum management related things */
 961static void ieee80211_chswitch_work(struct work_struct *work)
 962{
 963        struct ieee80211_sub_if_data *sdata =
 964                container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
 965        struct ieee80211_local *local = sdata->local;
 966        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 967        int ret;
 968
 969        if (!ieee80211_sdata_running(sdata))
 970                return;
 971
 972        sdata_lock(sdata);
 973        mutex_lock(&local->mtx);
 974        mutex_lock(&local->chanctx_mtx);
 975
 976        if (!ifmgd->associated)
 977                goto out;
 978
 979        if (!sdata->vif.csa_active)
 980                goto out;
 981
 982        /*
 983         * using reservation isn't immediate as it may be deferred until later
 984         * with multi-vif. once reservation is complete it will re-schedule the
 985         * work with no reserved_chanctx so verify chandef to check if it
 986         * completed successfully
 987         */
 988
 989        if (sdata->reserved_chanctx) {
 990                /*
 991                 * with multi-vif csa driver may call ieee80211_csa_finish()
 992                 * many times while waiting for other interfaces to use their
 993                 * reservations
 994                 */
 995                if (sdata->reserved_ready)
 996                        goto out;
 997
 998                ret = ieee80211_vif_use_reserved_context(sdata);
 999                if (ret) {
1000                        sdata_info(sdata,
1001                                   "failed to use reserved channel context, disconnecting (err=%d)\n",
1002                                   ret);
1003                        ieee80211_queue_work(&sdata->local->hw,
1004                                             &ifmgd->csa_connection_drop_work);
1005                        goto out;
1006                }
1007
1008                goto out;
1009        }
1010
1011        if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
1012                                        &sdata->csa_chandef)) {
1013                sdata_info(sdata,
1014                           "failed to finalize channel switch, disconnecting\n");
1015                ieee80211_queue_work(&sdata->local->hw,
1016                                     &ifmgd->csa_connection_drop_work);
1017                goto out;
1018        }
1019
1020        /* XXX: shouldn't really modify cfg80211-owned data! */
1021        ifmgd->associated->channel = sdata->csa_chandef.chan;
1022
1023        ifmgd->csa_waiting_bcn = true;
1024
1025        ieee80211_sta_reset_beacon_monitor(sdata);
1026        ieee80211_sta_reset_conn_monitor(sdata);
1027
1028out:
1029        mutex_unlock(&local->chanctx_mtx);
1030        mutex_unlock(&local->mtx);
1031        sdata_unlock(sdata);
1032}
1033
1034static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
1035{
1036        struct ieee80211_local *local = sdata->local;
1037        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1038        int ret;
1039
1040        sdata_assert_lock(sdata);
1041
1042        WARN_ON(!sdata->vif.csa_active);
1043
1044        if (sdata->csa_block_tx) {
1045                ieee80211_wake_vif_queues(local, sdata,
1046                                          IEEE80211_QUEUE_STOP_REASON_CSA);
1047                sdata->csa_block_tx = false;
1048        }
1049
1050        sdata->vif.csa_active = false;
1051        ifmgd->csa_waiting_bcn = false;
1052
1053        ret = drv_post_channel_switch(sdata);
1054        if (ret) {
1055                sdata_info(sdata,
1056                           "driver post channel switch failed, disconnecting\n");
1057                ieee80211_queue_work(&local->hw,
1058                                     &ifmgd->csa_connection_drop_work);
1059                return;
1060        }
1061
1062        cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1063}
1064
1065void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1066{
1067        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1068        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1069
1070        trace_api_chswitch_done(sdata, success);
1071        if (!success) {
1072                sdata_info(sdata,
1073                           "driver channel switch failed, disconnecting\n");
1074                ieee80211_queue_work(&sdata->local->hw,
1075                                     &ifmgd->csa_connection_drop_work);
1076        } else {
1077                ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1078        }
1079}
1080EXPORT_SYMBOL(ieee80211_chswitch_done);
1081
1082static void ieee80211_chswitch_timer(unsigned long data)
1083{
1084        struct ieee80211_sub_if_data *sdata =
1085                (struct ieee80211_sub_if_data *) data;
1086
1087        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1088}
1089
1090static void
1091ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1092                                 u64 timestamp, u32 device_timestamp,
1093                                 struct ieee802_11_elems *elems,
1094                                 bool beacon)
1095{
1096        struct ieee80211_local *local = sdata->local;
1097        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1098        struct cfg80211_bss *cbss = ifmgd->associated;
1099        struct ieee80211_chanctx_conf *conf;
1100        struct ieee80211_chanctx *chanctx;
1101        enum nl80211_band current_band;
1102        struct ieee80211_csa_ie csa_ie;
1103        struct ieee80211_channel_switch ch_switch;
1104        int res;
1105
1106        sdata_assert_lock(sdata);
1107
1108        if (!cbss)
1109                return;
1110
1111        if (local->scanning)
1112                return;
1113
1114        /* disregard subsequent announcements if we are already processing */
1115        if (sdata->vif.csa_active)
1116                return;
1117
1118        current_band = cbss->channel->band;
1119        res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1120                                           ifmgd->flags,
1121                                           ifmgd->associated->bssid, &csa_ie);
1122        if (res < 0)
1123                ieee80211_queue_work(&local->hw,
1124                                     &ifmgd->csa_connection_drop_work);
1125        if (res)
1126                return;
1127
1128        if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1129                                     IEEE80211_CHAN_DISABLED)) {
1130                sdata_info(sdata,
1131                           "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1132                           ifmgd->associated->bssid,
1133                           csa_ie.chandef.chan->center_freq,
1134                           csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1135                           csa_ie.chandef.center_freq2);
1136                ieee80211_queue_work(&local->hw,
1137                                     &ifmgd->csa_connection_drop_work);
1138                return;
1139        }
1140
1141        if (cfg80211_chandef_identical(&csa_ie.chandef,
1142                                       &sdata->vif.bss_conf.chandef)) {
1143                if (ifmgd->csa_ignored_same_chan)
1144                        return;
1145                sdata_info(sdata,
1146                           "AP %pM tries to chanswitch to same channel, ignore\n",
1147                           ifmgd->associated->bssid);
1148                ifmgd->csa_ignored_same_chan = true;
1149                return;
1150        }
1151
1152        /*
1153         * Drop all TDLS peers - either we disconnect or move to a different
1154         * channel from this point on. There's no telling what our peer will do.
1155         * The TDLS WIDER_BW scenario is also problematic, as peers might now
1156         * have an incompatible wider chandef.
1157         */
1158        ieee80211_teardown_tdls_peers(sdata);
1159
1160        mutex_lock(&local->mtx);
1161        mutex_lock(&local->chanctx_mtx);
1162        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
1163                                         lockdep_is_held(&local->chanctx_mtx));
1164        if (!conf) {
1165                sdata_info(sdata,
1166                           "no channel context assigned to vif?, disconnecting\n");
1167                goto drop_connection;
1168        }
1169
1170        chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1171
1172        if (local->use_chanctx &&
1173            !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1174                sdata_info(sdata,
1175                           "driver doesn't support chan-switch with channel contexts\n");
1176                goto drop_connection;
1177        }
1178
1179        ch_switch.timestamp = timestamp;
1180        ch_switch.device_timestamp = device_timestamp;
1181        ch_switch.block_tx = csa_ie.mode;
1182        ch_switch.chandef = csa_ie.chandef;
1183        ch_switch.count = csa_ie.count;
1184
1185        if (drv_pre_channel_switch(sdata, &ch_switch)) {
1186                sdata_info(sdata,
1187                           "preparing for channel switch failed, disconnecting\n");
1188                goto drop_connection;
1189        }
1190
1191        res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
1192                                            chanctx->mode, false);
1193        if (res) {
1194                sdata_info(sdata,
1195                           "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1196                           res);
1197                goto drop_connection;
1198        }
1199        mutex_unlock(&local->chanctx_mtx);
1200
1201        sdata->vif.csa_active = true;
1202        sdata->csa_chandef = csa_ie.chandef;
1203        sdata->csa_block_tx = csa_ie.mode;
1204        ifmgd->csa_ignored_same_chan = false;
1205
1206        if (sdata->csa_block_tx)
1207                ieee80211_stop_vif_queues(local, sdata,
1208                                          IEEE80211_QUEUE_STOP_REASON_CSA);
1209        mutex_unlock(&local->mtx);
1210
1211        cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
1212                                          csa_ie.count);
1213
1214        if (local->ops->channel_switch) {
1215                /* use driver's channel switch callback */
1216                drv_channel_switch(local, sdata, &ch_switch);
1217                return;
1218        }
1219
1220        /* channel switch handled in software */
1221        if (csa_ie.count <= 1)
1222                ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1223        else
1224                mod_timer(&ifmgd->chswitch_timer,
1225                          TU_TO_EXP_TIME((csa_ie.count - 1) *
1226                                         cbss->beacon_interval));
1227        return;
1228 drop_connection:
1229        ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
1230        mutex_unlock(&local->chanctx_mtx);
1231        mutex_unlock(&local->mtx);
1232}
1233
1234static bool
1235ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
1236                                 struct ieee80211_channel *channel,
1237                                 const u8 *country_ie, u8 country_ie_len,
1238                                 const u8 *pwr_constr_elem,
1239                                 int *chan_pwr, int *pwr_reduction)
1240{
1241        struct ieee80211_country_ie_triplet *triplet;
1242        int chan = ieee80211_frequency_to_channel(channel->center_freq);
1243        int i, chan_increment;
1244        bool have_chan_pwr = false;
1245
1246        /* Invalid IE */
1247        if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1248                return false;
1249
1250        triplet = (void *)(country_ie + 3);
1251        country_ie_len -= 3;
1252
1253        switch (channel->band) {
1254        default:
1255                WARN_ON_ONCE(1);
1256                /* fall through */
1257        case NL80211_BAND_2GHZ:
1258        case NL80211_BAND_60GHZ:
1259                chan_increment = 1;
1260                break;
1261        case NL80211_BAND_5GHZ:
1262                chan_increment = 4;
1263                break;
1264        }
1265
1266        /* find channel */
1267        while (country_ie_len >= 3) {
1268                u8 first_channel = triplet->chans.first_channel;
1269
1270                if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
1271                        goto next;
1272
1273                for (i = 0; i < triplet->chans.num_channels; i++) {
1274                        if (first_channel + i * chan_increment == chan) {
1275                                have_chan_pwr = true;
1276                                *chan_pwr = triplet->chans.max_power;
1277                                break;
1278                        }
1279                }
1280                if (have_chan_pwr)
1281                        break;
1282
1283 next:
1284                triplet++;
1285                country_ie_len -= 3;
1286        }
1287
1288        if (have_chan_pwr && pwr_constr_elem)
1289                *pwr_reduction = *pwr_constr_elem;
1290        else
1291                *pwr_reduction = 0;
1292
1293        return have_chan_pwr;
1294}
1295
1296static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
1297                                      struct ieee80211_channel *channel,
1298                                      const u8 *cisco_dtpc_ie,
1299                                      int *pwr_level)
1300{
1301        /* From practical testing, the first data byte of the DTPC element
1302         * seems to contain the requested dBm level, and the CLI on Cisco
1303         * APs clearly state the range is -127 to 127 dBm, which indicates
1304         * a signed byte, although it seemingly never actually goes negative.
1305         * The other byte seems to always be zero.
1306         */
1307        *pwr_level = (__s8)cisco_dtpc_ie[4];
1308}
1309
1310static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
1311                                       struct ieee80211_channel *channel,
1312                                       struct ieee80211_mgmt *mgmt,
1313                                       const u8 *country_ie, u8 country_ie_len,
1314                                       const u8 *pwr_constr_ie,
1315                                       const u8 *cisco_dtpc_ie)
1316{
1317        bool has_80211h_pwr = false, has_cisco_pwr = false;
1318        int chan_pwr = 0, pwr_reduction_80211h = 0;
1319        int pwr_level_cisco, pwr_level_80211h;
1320        int new_ap_level;
1321        __le16 capab = mgmt->u.probe_resp.capab_info;
1322
1323        if (country_ie &&
1324            (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
1325             capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1326                has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
1327                        sdata, channel, country_ie, country_ie_len,
1328                        pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1329                pwr_level_80211h =
1330                        max_t(int, 0, chan_pwr - pwr_reduction_80211h);
1331        }
1332
1333        if (cisco_dtpc_ie) {
1334                ieee80211_find_cisco_dtpc(
1335                        sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
1336                has_cisco_pwr = true;
1337        }
1338
1339        if (!has_80211h_pwr && !has_cisco_pwr)
1340                return 0;
1341
1342        /* If we have both 802.11h and Cisco DTPC, apply both limits
1343         * by picking the smallest of the two power levels advertised.
1344         */
1345        if (has_80211h_pwr &&
1346            (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1347                new_ap_level = pwr_level_80211h;
1348
1349                if (sdata->ap_power_level == new_ap_level)
1350                        return 0;
1351
1352                sdata_dbg(sdata,
1353                          "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
1354                          pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
1355                          sdata->u.mgd.bssid);
1356        } else {  /* has_cisco_pwr is always true here. */
1357                new_ap_level = pwr_level_cisco;
1358
1359                if (sdata->ap_power_level == new_ap_level)
1360                        return 0;
1361
1362                sdata_dbg(sdata,
1363                          "Limiting TX power to %d dBm as advertised by %pM\n",
1364                          pwr_level_cisco, sdata->u.mgd.bssid);
1365        }
1366
1367        sdata->ap_power_level = new_ap_level;
1368        if (__ieee80211_recalc_txpower(sdata))
1369                return BSS_CHANGED_TXPOWER;
1370        return 0;
1371}
1372
1373/* powersave */
1374static void ieee80211_enable_ps(struct ieee80211_local *local,
1375                                struct ieee80211_sub_if_data *sdata)
1376{
1377        struct ieee80211_conf *conf = &local->hw.conf;
1378
1379        /*
1380         * If we are scanning right now then the parameters will
1381         * take effect when scan finishes.
1382         */
1383        if (local->scanning)
1384                return;
1385
1386        if (conf->dynamic_ps_timeout > 0 &&
1387            !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1388                mod_timer(&local->dynamic_ps_timer, jiffies +
1389                          msecs_to_jiffies(conf->dynamic_ps_timeout));
1390        } else {
1391                if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1392                        ieee80211_send_nullfunc(local, sdata, true);
1393
1394                if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1395                    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1396                        return;
1397
1398                conf->flags |= IEEE80211_CONF_PS;
1399                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1400        }
1401}
1402
1403static void ieee80211_change_ps(struct ieee80211_local *local)
1404{
1405        struct ieee80211_conf *conf = &local->hw.conf;
1406
1407        if (local->ps_sdata) {
1408                ieee80211_enable_ps(local, local->ps_sdata);
1409        } else if (conf->flags & IEEE80211_CONF_PS) {
1410                conf->flags &= ~IEEE80211_CONF_PS;
1411                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1412                del_timer_sync(&local->dynamic_ps_timer);
1413                cancel_work_sync(&local->dynamic_ps_enable_work);
1414        }
1415}
1416
1417static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
1418{
1419        struct ieee80211_if_managed *mgd = &sdata->u.mgd;
1420        struct sta_info *sta = NULL;
1421        bool authorized = false;
1422
1423        if (!mgd->powersave)
1424                return false;
1425
1426        if (mgd->broken_ap)
1427                return false;
1428
1429        if (!mgd->associated)
1430                return false;
1431
1432        if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1433                return false;
1434
1435        if (!mgd->have_beacon)
1436                return false;
1437
1438        rcu_read_lock();
1439        sta = sta_info_get(sdata, mgd->bssid);
1440        if (sta)
1441                authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1442        rcu_read_unlock();
1443
1444        return authorized;
1445}
1446
1447/* need to hold RTNL or interface lock */
1448void ieee80211_recalc_ps(struct ieee80211_local *local)
1449{
1450        struct ieee80211_sub_if_data *sdata, *found = NULL;
1451        int count = 0;
1452        int timeout;
1453
1454        if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1455                local->ps_sdata = NULL;
1456                return;
1457        }
1458
1459        list_for_each_entry(sdata, &local->interfaces, list) {
1460                if (!ieee80211_sdata_running(sdata))
1461                        continue;
1462                if (sdata->vif.type == NL80211_IFTYPE_AP) {
1463                        /* If an AP vif is found, then disable PS
1464                         * by setting the count to zero thereby setting
1465                         * ps_sdata to NULL.
1466                         */
1467                        count = 0;
1468                        break;
1469                }
1470                if (sdata->vif.type != NL80211_IFTYPE_STATION)
1471                        continue;
1472                found = sdata;
1473                count++;
1474        }
1475
1476        if (count == 1 && ieee80211_powersave_allowed(found)) {
1477                u8 dtimper = found->u.mgd.dtim_period;
1478
1479                timeout = local->dynamic_ps_forced_timeout;
1480                if (timeout < 0)
1481                        timeout = 100;
1482                local->hw.conf.dynamic_ps_timeout = timeout;
1483
1484                /* If the TIM IE is invalid, pretend the value is 1 */
1485                if (!dtimper)
1486                        dtimper = 1;
1487
1488                local->hw.conf.ps_dtim_period = dtimper;
1489                local->ps_sdata = found;
1490        } else {
1491                local->ps_sdata = NULL;
1492        }
1493
1494        ieee80211_change_ps(local);
1495}
1496
1497void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
1498{
1499        bool ps_allowed = ieee80211_powersave_allowed(sdata);
1500
1501        if (sdata->vif.bss_conf.ps != ps_allowed) {
1502                sdata->vif.bss_conf.ps = ps_allowed;
1503                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
1504        }
1505}
1506
1507void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
1508{
1509        struct ieee80211_local *local =
1510                container_of(work, struct ieee80211_local,
1511                             dynamic_ps_disable_work);
1512
1513        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1514                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1515                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1516        }
1517
1518        ieee80211_wake_queues_by_reason(&local->hw,
1519                                        IEEE80211_MAX_QUEUE_MAP,
1520                                        IEEE80211_QUEUE_STOP_REASON_PS,
1521                                        false);
1522}
1523
1524void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
1525{
1526        struct ieee80211_local *local =
1527                container_of(work, struct ieee80211_local,
1528                             dynamic_ps_enable_work);
1529        struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1530        struct ieee80211_if_managed *ifmgd;
1531        unsigned long flags;
1532        int q;
1533
1534        /* can only happen when PS was just disabled anyway */
1535        if (!sdata)
1536                return;
1537
1538        ifmgd = &sdata->u.mgd;
1539
1540        if (local->hw.conf.flags & IEEE80211_CONF_PS)
1541                return;
1542
1543        if (local->hw.conf.dynamic_ps_timeout > 0) {
1544                /* don't enter PS if TX frames are pending */
1545                if (drv_tx_frames_pending(local)) {
1546                        mod_timer(&local->dynamic_ps_timer, jiffies +
1547                                  msecs_to_jiffies(
1548                                  local->hw.conf.dynamic_ps_timeout));
1549                        return;
1550                }
1551
1552                /*
1553                 * transmission can be stopped by others which leads to
1554                 * dynamic_ps_timer expiry. Postpone the ps timer if it
1555                 * is not the actual idle state.
1556                 */
1557                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1558                for (q = 0; q < local->hw.queues; q++) {
1559                        if (local->queue_stop_reasons[q]) {
1560                                spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1561                                                       flags);
1562                                mod_timer(&local->dynamic_ps_timer, jiffies +
1563                                          msecs_to_jiffies(
1564                                          local->hw.conf.dynamic_ps_timeout));
1565                                return;
1566                        }
1567                }
1568                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1569        }
1570
1571        if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1572            !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1573                if (drv_tx_frames_pending(local)) {
1574                        mod_timer(&local->dynamic_ps_timer, jiffies +
1575                                  msecs_to_jiffies(
1576                                  local->hw.conf.dynamic_ps_timeout));
1577                } else {
1578                        ieee80211_send_nullfunc(local, sdata, true);
1579                        /* Flush to get the tx status of nullfunc frame */
1580                        ieee80211_flush_queues(local, sdata, false);
1581                }
1582        }
1583
1584        if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
1585              ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1586            (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1587                ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
1588                local->hw.conf.flags |= IEEE80211_CONF_PS;
1589                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1590        }
1591}
1592
1593void ieee80211_dynamic_ps_timer(unsigned long data)
1594{
1595        struct ieee80211_local *local = (void *) data;
1596
1597        ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1598}
1599
1600void ieee80211_dfs_cac_timer_work(struct work_struct *work)
1601{
1602        struct delayed_work *delayed_work = to_delayed_work(work);
1603        struct ieee80211_sub_if_data *sdata =
1604                container_of(delayed_work, struct ieee80211_sub_if_data,
1605                             dfs_cac_timer_work);
1606        struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1607
1608        mutex_lock(&sdata->local->mtx);
1609        if (sdata->wdev.cac_started) {
1610                ieee80211_vif_release_channel(sdata);
1611                cfg80211_cac_event(sdata->dev, &chandef,
1612                                   NL80211_RADAR_CAC_FINISHED,
1613                                   GFP_KERNEL);
1614        }
1615        mutex_unlock(&sdata->local->mtx);
1616}
1617
1618static bool
1619__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
1620{
1621        struct ieee80211_local *local = sdata->local;
1622        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1623        bool ret = false;
1624        int ac;
1625
1626        if (local->hw.queues < IEEE80211_NUM_ACS)
1627                return false;
1628
1629        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1630                struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
1631                int non_acm_ac;
1632                unsigned long now = jiffies;
1633
1634                if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
1635                    tx_tspec->admitted_time &&
1636                    time_after(now, tx_tspec->time_slice_start + HZ)) {
1637                        tx_tspec->consumed_tx_time = 0;
1638                        tx_tspec->time_slice_start = now;
1639
1640                        if (tx_tspec->downgraded)
1641                                tx_tspec->action =
1642                                        TX_TSPEC_ACTION_STOP_DOWNGRADE;
1643                }
1644
1645                switch (tx_tspec->action) {
1646                case TX_TSPEC_ACTION_STOP_DOWNGRADE:
1647                        /* take the original parameters */
1648                        if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
1649                                sdata_err(sdata,
1650                                          "failed to set TX queue parameters for queue %d\n",
1651                                          ac);
1652                        tx_tspec->action = TX_TSPEC_ACTION_NONE;
1653                        tx_tspec->downgraded = false;
1654                        ret = true;
1655                        break;
1656                case TX_TSPEC_ACTION_DOWNGRADE:
1657                        if (time_after(now, tx_tspec->time_slice_start + HZ)) {
1658                                tx_tspec->action = TX_TSPEC_ACTION_NONE;
1659                                ret = true;
1660                                break;
1661                        }
1662                        /* downgrade next lower non-ACM AC */
1663                        for (non_acm_ac = ac + 1;
1664                             non_acm_ac < IEEE80211_NUM_ACS;
1665                             non_acm_ac++)
1666                                if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
1667                                        break;
1668                        /* Usually the loop will result in using BK even if it
1669                         * requires admission control, but such a configuration
1670                         * makes no sense and we have to transmit somehow - the
1671                         * AC selection does the same thing.
1672                         * If we started out trying to downgrade from BK, then
1673                         * the extra condition here might be needed.
1674                         */
1675                        if (non_acm_ac >= IEEE80211_NUM_ACS)
1676                                non_acm_ac = IEEE80211_AC_BK;
1677                        if (drv_conf_tx(local, sdata, ac,
1678                                        &sdata->tx_conf[non_acm_ac]))
1679                                sdata_err(sdata,
1680                                          "failed to set TX queue parameters for queue %d\n",
1681                                          ac);
1682                        tx_tspec->action = TX_TSPEC_ACTION_NONE;
1683                        ret = true;
1684                        schedule_delayed_work(&ifmgd->tx_tspec_wk,
1685                                tx_tspec->time_slice_start + HZ - now + 1);
1686                        break;
1687                case TX_TSPEC_ACTION_NONE:
1688                        /* nothing now */
1689                        break;
1690                }
1691        }
1692
1693        return ret;
1694}
1695
1696void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
1697{
1698        if (__ieee80211_sta_handle_tspec_ac_params(sdata))
1699                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
1700}
1701
1702static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
1703{
1704        struct ieee80211_sub_if_data *sdata;
1705
1706        sdata = container_of(work, struct ieee80211_sub_if_data,
1707                             u.mgd.tx_tspec_wk.work);
1708        ieee80211_sta_handle_tspec_ac_params(sdata);
1709}
1710
1711/* MLME */
1712static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1713                                     struct ieee80211_sub_if_data *sdata,
1714                                     const u8 *wmm_param, size_t wmm_param_len)
1715{
1716        struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1717        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1718        size_t left;
1719        int count, ac;
1720        const u8 *pos;
1721        u8 uapsd_queues = 0;
1722
1723        if (!local->ops->conf_tx)
1724                return false;
1725
1726        if (local->hw.queues < IEEE80211_NUM_ACS)
1727                return false;
1728
1729        if (!wmm_param)
1730                return false;
1731
1732        if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1733                return false;
1734
1735        if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1736                uapsd_queues = ifmgd->uapsd_queues;
1737
1738        count = wmm_param[6] & 0x0f;
1739        if (count == ifmgd->wmm_last_param_set)
1740                return false;
1741        ifmgd->wmm_last_param_set = count;
1742
1743        pos = wmm_param + 8;
1744        left = wmm_param_len - 8;
1745
1746        memset(&params, 0, sizeof(params));
1747
1748        sdata->wmm_acm = 0;
1749        for (; left >= 4; left -= 4, pos += 4) {
1750                int aci = (pos[0] >> 5) & 0x03;
1751                int acm = (pos[0] >> 4) & 0x01;
1752                bool uapsd = false;
1753
1754                switch (aci) {
1755                case 1: /* AC_BK */
1756                        ac = IEEE80211_AC_BK;
1757                        if (acm)
1758                                sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
1759                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
1760                                uapsd = true;
1761                        break;
1762                case 2: /* AC_VI */
1763                        ac = IEEE80211_AC_VI;
1764                        if (acm)
1765                                sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
1766                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
1767                                uapsd = true;
1768                        break;
1769                case 3: /* AC_VO */
1770                        ac = IEEE80211_AC_VO;
1771                        if (acm)
1772                                sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
1773                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
1774                                uapsd = true;
1775                        break;
1776                case 0: /* AC_BE */
1777                default:
1778                        ac = IEEE80211_AC_BE;
1779                        if (acm)
1780                                sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
1781                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
1782                                uapsd = true;
1783                        break;
1784                }
1785
1786                params[ac].aifs = pos[0] & 0x0f;
1787
1788                if (params[ac].aifs < 2) {
1789                        sdata_info(sdata,
1790                                   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
1791                                   params[ac].aifs, aci);
1792                        params[ac].aifs = 2;
1793                }
1794                params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
1795                params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
1796                params[ac].txop = get_unaligned_le16(pos + 2);
1797                params[ac].acm = acm;
1798                params[ac].uapsd = uapsd;
1799
1800                if (params[ac].cw_min > params[ac].cw_max) {
1801                        sdata_info(sdata,
1802                                   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
1803                                   params[ac].cw_min, params[ac].cw_max, aci);
1804                        return false;
1805                }
1806        }
1807
1808        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1809                mlme_dbg(sdata,
1810                         "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
1811                         ac, params[ac].acm,
1812                         params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
1813                         params[ac].txop, params[ac].uapsd,
1814                         ifmgd->tx_tspec[ac].downgraded);
1815                sdata->tx_conf[ac] = params[ac];
1816                if (!ifmgd->tx_tspec[ac].downgraded &&
1817                    drv_conf_tx(local, sdata, ac, &params[ac]))
1818                        sdata_err(sdata,
1819                                  "failed to set TX queue parameters for AC %d\n",
1820                                  ac);
1821        }
1822
1823        /* enable WMM or activate new settings */
1824        sdata->vif.bss_conf.qos = true;
1825        return true;
1826}
1827
1828static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1829{
1830        lockdep_assert_held(&sdata->local->mtx);
1831
1832        sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1833        ieee80211_run_deferred_scan(sdata->local);
1834}
1835
1836static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1837{
1838        mutex_lock(&sdata->local->mtx);
1839        __ieee80211_stop_poll(sdata);
1840        mutex_unlock(&sdata->local->mtx);
1841}
1842
1843static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
1844                                           u16 capab, bool erp_valid, u8 erp)
1845{
1846        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1847        struct ieee80211_supported_band *sband;
1848        u32 changed = 0;
1849        bool use_protection;
1850        bool use_short_preamble;
1851        bool use_short_slot;
1852
1853        sband = ieee80211_get_sband(sdata);
1854        if (!sband)
1855                return changed;
1856
1857        if (erp_valid) {
1858                use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
1859                use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
1860        } else {
1861                use_protection = false;
1862                use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
1863        }
1864
1865        use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
1866        if (sband->band == NL80211_BAND_5GHZ)
1867                use_short_slot = true;
1868
1869        if (use_protection != bss_conf->use_cts_prot) {
1870                bss_conf->use_cts_prot = use_protection;
1871                changed |= BSS_CHANGED_ERP_CTS_PROT;
1872        }
1873
1874        if (use_short_preamble != bss_conf->use_short_preamble) {
1875                bss_conf->use_short_preamble = use_short_preamble;
1876                changed |= BSS_CHANGED_ERP_PREAMBLE;
1877        }
1878
1879        if (use_short_slot != bss_conf->use_short_slot) {
1880                bss_conf->use_short_slot = use_short_slot;
1881                changed |= BSS_CHANGED_ERP_SLOT;
1882        }
1883
1884        return changed;
1885}
1886
1887static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1888                                     struct cfg80211_bss *cbss,
1889                                     u32 bss_info_changed)
1890{
1891        struct ieee80211_bss *bss = (void *)cbss->priv;
1892        struct ieee80211_local *local = sdata->local;
1893        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1894
1895        bss_info_changed |= BSS_CHANGED_ASSOC;
1896        bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1897                bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1898
1899        sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1900                beacon_loss_count * bss_conf->beacon_int));
1901
1902        sdata->u.mgd.associated = cbss;
1903        memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1904
1905        ieee80211_check_rate_mask(sdata);
1906
1907        sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
1908
1909        if (sdata->vif.p2p ||
1910            sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
1911                const struct cfg80211_bss_ies *ies;
1912
1913                rcu_read_lock();
1914                ies = rcu_dereference(cbss->ies);
1915                if (ies) {
1916                        int ret;
1917
1918                        ret = cfg80211_get_p2p_attr(
1919                                        ies->data, ies->len,
1920                                        IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
1921                                        (u8 *) &bss_conf->p2p_noa_attr,
1922                                        sizeof(bss_conf->p2p_noa_attr));
1923                        if (ret >= 2) {
1924                                sdata->u.mgd.p2p_noa_index =
1925                                        bss_conf->p2p_noa_attr.index;
1926                                bss_info_changed |= BSS_CHANGED_P2P_PS;
1927                        }
1928                }
1929                rcu_read_unlock();
1930        }
1931
1932        /* just to be sure */
1933        ieee80211_stop_poll(sdata);
1934
1935        ieee80211_led_assoc(local, 1);
1936
1937        if (sdata->u.mgd.have_beacon) {
1938                /*
1939                 * If the AP is buggy we may get here with no DTIM period
1940                 * known, so assume it's 1 which is the only safe assumption
1941                 * in that case, although if the TIM IE is broken powersave
1942                 * probably just won't work at all.
1943                 */
1944                bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1945                bss_conf->beacon_rate = bss->beacon_rate;
1946                bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1947        } else {
1948                bss_conf->beacon_rate = NULL;
1949                bss_conf->dtim_period = 0;
1950        }
1951
1952        bss_conf->assoc = 1;
1953
1954        /* Tell the driver to monitor connection quality (if supported) */
1955        if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1956            bss_conf->cqm_rssi_thold)
1957                bss_info_changed |= BSS_CHANGED_CQM;
1958
1959        /* Enable ARP filtering */
1960        if (bss_conf->arp_addr_cnt)
1961                bss_info_changed |= BSS_CHANGED_ARP_FILTER;
1962
1963        ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1964
1965        mutex_lock(&local->iflist_mtx);
1966        ieee80211_recalc_ps(local);
1967        mutex_unlock(&local->iflist_mtx);
1968
1969        ieee80211_recalc_smps(sdata);
1970        ieee80211_recalc_ps_vif(sdata);
1971
1972        netif_carrier_on(sdata->dev);
1973}
1974
1975static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1976                                   u16 stype, u16 reason, bool tx,
1977                                   u8 *frame_buf)
1978{
1979        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1980        struct ieee80211_local *local = sdata->local;
1981        u32 changed = 0;
1982
1983        sdata_assert_lock(sdata);
1984
1985        if (WARN_ON_ONCE(tx && !frame_buf))
1986                return;
1987
1988        if (WARN_ON(!ifmgd->associated))
1989                return;
1990
1991        ieee80211_stop_poll(sdata);
1992
1993        ifmgd->associated = NULL;
1994        netif_carrier_off(sdata->dev);
1995
1996        /*
1997         * if we want to get out of ps before disassoc (why?) we have
1998         * to do it before sending disassoc, as otherwise the null-packet
1999         * won't be valid.
2000         */
2001        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2002                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2003                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2004        }
2005        local->ps_sdata = NULL;
2006
2007        /* disable per-vif ps */
2008        ieee80211_recalc_ps_vif(sdata);
2009
2010        /* make sure ongoing transmission finishes */
2011        synchronize_net();
2012
2013        /*
2014         * drop any frame before deauth/disassoc, this can be data or
2015         * management frame. Since we are disconnecting, we should not
2016         * insist sending these frames which can take time and delay
2017         * the disconnection and possible the roaming.
2018         */
2019        if (tx)
2020                ieee80211_flush_queues(local, sdata, true);
2021
2022        /* deauthenticate/disassociate now */
2023        if (tx || frame_buf)
2024                ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
2025                                               reason, tx, frame_buf);
2026
2027        /* flush out frame - make sure the deauth was actually sent */
2028        if (tx)
2029                ieee80211_flush_queues(local, sdata, false);
2030
2031        /* clear bssid only after building the needed mgmt frames */
2032        eth_zero_addr(ifmgd->bssid);
2033
2034        /* remove AP and TDLS peers */
2035        sta_info_flush(sdata);
2036
2037        /* finally reset all BSS / config parameters */
2038        changed |= ieee80211_reset_erp_info(sdata);
2039
2040        ieee80211_led_assoc(local, 0);
2041        changed |= BSS_CHANGED_ASSOC;
2042        sdata->vif.bss_conf.assoc = false;
2043
2044        ifmgd->p2p_noa_index = -1;
2045        memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
2046               sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2047
2048        /* on the next assoc, re-program HT/VHT parameters */
2049        memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
2050        memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2051        memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
2052        memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2053
2054        /* reset MU-MIMO ownership and group data */
2055        memset(sdata->vif.bss_conf.mu_group.membership, 0,
2056               sizeof(sdata->vif.bss_conf.mu_group.membership));
2057        memset(sdata->vif.bss_conf.mu_group.position, 0,
2058               sizeof(sdata->vif.bss_conf.mu_group.position));
2059        changed |= BSS_CHANGED_MU_GROUPS;
2060        sdata->vif.mu_mimo_owner = false;
2061
2062        sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2063
2064        del_timer_sync(&local->dynamic_ps_timer);
2065        cancel_work_sync(&local->dynamic_ps_enable_work);
2066
2067        /* Disable ARP filtering */
2068        if (sdata->vif.bss_conf.arp_addr_cnt)
2069                changed |= BSS_CHANGED_ARP_FILTER;
2070
2071        sdata->vif.bss_conf.qos = false;
2072        changed |= BSS_CHANGED_QOS;
2073
2074        /* The BSSID (not really interesting) and HT changed */
2075        changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
2076        ieee80211_bss_info_change_notify(sdata, changed);
2077
2078        /* disassociated - set to defaults now */
2079        ieee80211_set_wmm_default(sdata, false, false);
2080
2081        del_timer_sync(&sdata->u.mgd.conn_mon_timer);
2082        del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
2083        del_timer_sync(&sdata->u.mgd.timer);
2084        del_timer_sync(&sdata->u.mgd.chswitch_timer);
2085
2086        sdata->vif.bss_conf.dtim_period = 0;
2087        sdata->vif.bss_conf.beacon_rate = NULL;
2088
2089        ifmgd->have_beacon = false;
2090
2091        ifmgd->flags = 0;
2092        mutex_lock(&local->mtx);
2093        ieee80211_vif_release_channel(sdata);
2094
2095        sdata->vif.csa_active = false;
2096        ifmgd->csa_waiting_bcn = false;
2097        ifmgd->csa_ignored_same_chan = false;
2098        if (sdata->csa_block_tx) {
2099                ieee80211_wake_vif_queues(local, sdata,
2100                                          IEEE80211_QUEUE_STOP_REASON_CSA);
2101                sdata->csa_block_tx = false;
2102        }
2103        mutex_unlock(&local->mtx);
2104
2105        /* existing TX TSPEC sessions no longer exist */
2106        memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
2107        cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
2108
2109        sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2110}
2111
2112void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
2113                             struct ieee80211_hdr *hdr)
2114{
2115        /*
2116         * We can postpone the mgd.timer whenever receiving unicast frames
2117         * from AP because we know that the connection is working both ways
2118         * at that time. But multicast frames (and hence also beacons) must
2119         * be ignored here, because we need to trigger the timer during
2120         * data idle periods for sending the periodic probe request to the
2121         * AP we're connected to.
2122         */
2123        if (is_multicast_ether_addr(hdr->addr1))
2124                return;
2125
2126        ieee80211_sta_reset_conn_monitor(sdata);
2127}
2128
2129static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
2130{
2131        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2132        struct ieee80211_local *local = sdata->local;
2133
2134        mutex_lock(&local->mtx);
2135        if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
2136                goto out;
2137
2138        __ieee80211_stop_poll(sdata);
2139
2140        mutex_lock(&local->iflist_mtx);
2141        ieee80211_recalc_ps(local);
2142        mutex_unlock(&local->iflist_mtx);
2143
2144        if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2145                goto out;
2146
2147        /*
2148         * We've received a probe response, but are not sure whether
2149         * we have or will be receiving any beacons or data, so let's
2150         * schedule the timers again, just in case.
2151         */
2152        ieee80211_sta_reset_beacon_monitor(sdata);
2153
2154        mod_timer(&ifmgd->conn_mon_timer,
2155                  round_jiffies_up(jiffies +
2156                                   IEEE80211_CONNECTION_IDLE_TIME));
2157out:
2158        mutex_unlock(&local->mtx);
2159}
2160
2161static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
2162                                           struct ieee80211_hdr *hdr,
2163                                           u16 tx_time)
2164{
2165        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2166        u16 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
2167        int ac = ieee80211_ac_from_tid(tid);
2168        struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
2169        unsigned long now = jiffies;
2170
2171        if (likely(!tx_tspec->admitted_time))
2172                return;
2173
2174        if (time_after(now, tx_tspec->time_slice_start + HZ)) {
2175                tx_tspec->consumed_tx_time = 0;
2176                tx_tspec->time_slice_start = now;
2177
2178                if (tx_tspec->downgraded) {
2179                        tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
2180                        schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
2181                }
2182        }
2183
2184        if (tx_tspec->downgraded)
2185                return;
2186
2187        tx_tspec->consumed_tx_time += tx_time;
2188
2189        if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
2190                tx_tspec->downgraded = true;
2191                tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
2192                schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
2193        }
2194}
2195
2196void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2197                             struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2198{
2199        ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
2200
2201        if (!ieee80211_is_data(hdr->frame_control))
2202            return;
2203
2204        if (ieee80211_is_nullfunc(hdr->frame_control) &&
2205            sdata->u.mgd.probe_send_count > 0) {
2206                if (ack)
2207                        ieee80211_sta_reset_conn_monitor(sdata);
2208                else
2209                        sdata->u.mgd.nullfunc_failed = true;
2210                ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2211                return;
2212        }
2213
2214        if (ack)
2215                ieee80211_sta_reset_conn_monitor(sdata);
2216}
2217
2218static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
2219{
2220        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2221        const u8 *ssid;
2222        u8 *dst = ifmgd->associated->bssid;
2223        u8 unicast_limit = max(1, max_probe_tries - 3);
2224        struct sta_info *sta;
2225
2226        /*
2227         * Try sending broadcast probe requests for the last three
2228         * probe requests after the first ones failed since some
2229         * buggy APs only support broadcast probe requests.
2230         */
2231        if (ifmgd->probe_send_count >= unicast_limit)
2232                dst = NULL;
2233
2234        /*
2235         * When the hardware reports an accurate Tx ACK status, it's
2236         * better to send a nullfunc frame instead of a probe request,
2237         * as it will kick us off the AP quickly if we aren't associated
2238         * anymore. The timeout will be reset if the frame is ACKed by
2239         * the AP.
2240         */
2241        ifmgd->probe_send_count++;
2242
2243        if (dst) {
2244                mutex_lock(&sdata->local->sta_mtx);
2245                sta = sta_info_get(sdata, dst);
2246                if (!WARN_ON(!sta))
2247                        ieee80211_check_fast_rx(sta);
2248                mutex_unlock(&sdata->local->sta_mtx);
2249        }
2250
2251        if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2252                ifmgd->nullfunc_failed = false;
2253                ieee80211_send_nullfunc(sdata->local, sdata, false);
2254        } else {
2255                int ssid_len;
2256
2257                rcu_read_lock();
2258                ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2259                if (WARN_ON_ONCE(ssid == NULL))
2260                        ssid_len = 0;
2261                else
2262                        ssid_len = ssid[1];
2263
2264                ieee80211_send_probe_req(sdata, sdata->vif.addr, dst,
2265                                         ssid + 2, ssid_len, NULL,
2266                                         0, (u32) -1, true, 0,
2267                                         ifmgd->associated->channel, false);
2268                rcu_read_unlock();
2269        }
2270
2271        ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2272        run_again(sdata, ifmgd->probe_timeout);
2273}
2274
2275static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
2276                                   bool beacon)
2277{
2278        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2279        bool already = false;
2280
2281        if (!ieee80211_sdata_running(sdata))
2282                return;
2283
2284        sdata_lock(sdata);
2285
2286        if (!ifmgd->associated)
2287                goto out;
2288
2289        mutex_lock(&sdata->local->mtx);
2290
2291        if (sdata->local->tmp_channel || sdata->local->scanning) {
2292                mutex_unlock(&sdata->local->mtx);
2293                goto out;
2294        }
2295
2296        if (beacon) {
2297                mlme_dbg_ratelimited(sdata,
2298                                     "detected beacon loss from AP (missed %d beacons) - probing\n",
2299                                     beacon_loss_count);
2300
2301                ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2302        }
2303
2304        /*
2305         * The driver/our work has already reported this event or the
2306         * connection monitoring has kicked in and we have already sent
2307         * a probe request. Or maybe the AP died and the driver keeps
2308         * reporting until we disassociate...
2309         *
2310         * In either case we have to ignore the current call to this
2311         * function (except for setting the correct probe reason bit)
2312         * because otherwise we would reset the timer every time and
2313         * never check whether we received a probe response!
2314         */
2315        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
2316                already = true;
2317
2318        ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
2319
2320        mutex_unlock(&sdata->local->mtx);
2321
2322        if (already)
2323                goto out;
2324
2325        mutex_lock(&sdata->local->iflist_mtx);
2326        ieee80211_recalc_ps(sdata->local);
2327        mutex_unlock(&sdata->local->iflist_mtx);
2328
2329        ifmgd->probe_send_count = 0;
2330        ieee80211_mgd_probe_ap_send(sdata);
2331 out:
2332        sdata_unlock(sdata);
2333}
2334
2335struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
2336                                          struct ieee80211_vif *vif)
2337{
2338        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2339        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2340        struct cfg80211_bss *cbss;
2341        struct sk_buff *skb;
2342        const u8 *ssid;
2343        int ssid_len;
2344
2345        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2346                return NULL;
2347
2348        sdata_assert_lock(sdata);
2349
2350        if (ifmgd->associated)
2351                cbss = ifmgd->associated;
2352        else if (ifmgd->auth_data)
2353                cbss = ifmgd->auth_data->bss;
2354        else if (ifmgd->assoc_data)
2355                cbss = ifmgd->assoc_data->bss;
2356        else
2357                return NULL;
2358
2359        rcu_read_lock();
2360        ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2361        if (WARN_ON_ONCE(ssid == NULL))
2362                ssid_len = 0;
2363        else
2364                ssid_len = ssid[1];
2365
2366        skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
2367                                        (u32) -1, cbss->channel,
2368                                        ssid + 2, ssid_len,
2369                                        NULL, 0, true);
2370        rcu_read_unlock();
2371
2372        return skb;
2373}
2374EXPORT_SYMBOL(ieee80211_ap_probereq_get);
2375
2376static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
2377                                        const u8 *buf, size_t len, bool tx,
2378                                        u16 reason)
2379{
2380        struct ieee80211_event event = {
2381                .type = MLME_EVENT,
2382                .u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
2383                .u.mlme.reason = reason,
2384        };
2385
2386        if (tx)
2387                cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
2388        else
2389                cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
2390
2391        drv_event_callback(sdata->local, sdata, &event);
2392}
2393
2394static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2395{
2396        struct ieee80211_local *local = sdata->local;
2397        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2398        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2399
2400        sdata_lock(sdata);
2401        if (!ifmgd->associated) {
2402                sdata_unlock(sdata);
2403                return;
2404        }
2405
2406        /* AP is probably out of range (or not reachable for another reason) so
2407         * remove the bss struct for that AP.
2408         */
2409        cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);
2410
2411        ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
2412                               WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2413                               true, frame_buf);
2414        mutex_lock(&local->mtx);
2415        sdata->vif.csa_active = false;
2416        ifmgd->csa_waiting_bcn = false;
2417        if (sdata->csa_block_tx) {
2418                ieee80211_wake_vif_queues(local, sdata,
2419                                          IEEE80211_QUEUE_STOP_REASON_CSA);
2420                sdata->csa_block_tx = false;
2421        }
2422        mutex_unlock(&local->mtx);
2423
2424        ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
2425                                    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
2426
2427        sdata_unlock(sdata);
2428}
2429
2430static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
2431{
2432        struct ieee80211_sub_if_data *sdata =
2433                container_of(work, struct ieee80211_sub_if_data,
2434                             u.mgd.beacon_connection_loss_work);
2435        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2436
2437        if (ifmgd->associated)
2438                ifmgd->beacon_loss_count++;
2439
2440        if (ifmgd->connection_loss) {
2441                sdata_info(sdata, "Connection to AP %pM lost\n",
2442                           ifmgd->bssid);
2443                __ieee80211_disconnect(sdata);
2444        } else {
2445                ieee80211_mgd_probe_ap(sdata, true);
2446        }
2447}
2448
2449static void ieee80211_csa_connection_drop_work(struct work_struct *work)
2450{
2451        struct ieee80211_sub_if_data *sdata =
2452                container_of(work, struct ieee80211_sub_if_data,
2453                             u.mgd.csa_connection_drop_work);
2454
2455        __ieee80211_disconnect(sdata);
2456}
2457
2458void ieee80211_beacon_loss(struct ieee80211_vif *vif)
2459{
2460        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2461        struct ieee80211_hw *hw = &sdata->local->hw;
2462
2463        trace_api_beacon_loss(sdata);
2464
2465        sdata->u.mgd.connection_loss = false;
2466        ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2467}
2468EXPORT_SYMBOL(ieee80211_beacon_loss);
2469
2470void ieee80211_connection_loss(struct ieee80211_vif *vif)
2471{
2472        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2473        struct ieee80211_hw *hw = &sdata->local->hw;
2474
2475        trace_api_connection_loss(sdata);
2476
2477        sdata->u.mgd.connection_loss = true;
2478        ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2479}
2480EXPORT_SYMBOL(ieee80211_connection_loss);
2481
2482
2483static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
2484                                        bool assoc)
2485{
2486        struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2487
2488        sdata_assert_lock(sdata);
2489
2490        if (!assoc) {
2491                /*
2492                 * we are not authenticated yet, the only timer that could be
2493                 * running is the timeout for the authentication response which
2494                 * which is not relevant anymore.
2495                 */
2496                del_timer_sync(&sdata->u.mgd.timer);
2497                sta_info_destroy_addr(sdata, auth_data->bss->bssid);
2498
2499                eth_zero_addr(sdata->u.mgd.bssid);
2500                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2501                sdata->u.mgd.flags = 0;
2502                mutex_lock(&sdata->local->mtx);
2503                ieee80211_vif_release_channel(sdata);
2504                mutex_unlock(&sdata->local->mtx);
2505        }
2506
2507        cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
2508        kfree(auth_data);
2509        sdata->u.mgd.auth_data = NULL;
2510}
2511
2512static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2513                                         bool assoc, bool abandon)
2514{
2515        struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2516
2517        sdata_assert_lock(sdata);
2518
2519        if (!assoc) {
2520                /*
2521                 * we are not associated yet, the only timer that could be
2522                 * running is the timeout for the association response which
2523                 * which is not relevant anymore.
2524                 */
2525                del_timer_sync(&sdata->u.mgd.timer);
2526                sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
2527
2528                eth_zero_addr(sdata->u.mgd.bssid);
2529                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2530                sdata->u.mgd.flags = 0;
2531                sdata->vif.mu_mimo_owner = false;
2532
2533                mutex_lock(&sdata->local->mtx);
2534                ieee80211_vif_release_channel(sdata);
2535                mutex_unlock(&sdata->local->mtx);
2536
2537                if (abandon)
2538                        cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
2539        }
2540
2541        kfree(assoc_data);
2542        sdata->u.mgd.assoc_data = NULL;
2543}
2544
2545static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
2546                                     struct ieee80211_mgmt *mgmt, size_t len)
2547{
2548        struct ieee80211_local *local = sdata->local;
2549        struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2550        u8 *pos;
2551        struct ieee802_11_elems elems;
2552        u32 tx_flags = 0;
2553
2554        pos = mgmt->u.auth.variable;
2555        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2556        if (!elems.challenge)
2557                return;
2558        auth_data->expected_transaction = 4;
2559        drv_mgd_prepare_tx(sdata->local, sdata);
2560        if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2561                tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2562                           IEEE80211_TX_INTFL_MLME_CONN_TX;
2563        ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
2564                            elems.challenge - 2, elems.challenge_len + 2,
2565                            auth_data->bss->bssid, auth_data->bss->bssid,
2566                            auth_data->key, auth_data->key_len,
2567                            auth_data->key_idx, tx_flags);
2568}
2569
2570static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
2571                                   struct ieee80211_mgmt *mgmt, size_t len)
2572{
2573        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2574        u8 bssid[ETH_ALEN];
2575        u16 auth_alg, auth_transaction, status_code;
2576        struct sta_info *sta;
2577        struct ieee80211_event event = {
2578                .type = MLME_EVENT,
2579                .u.mlme.data = AUTH_EVENT,
2580        };
2581
2582        sdata_assert_lock(sdata);
2583
2584        if (len < 24 + 6)
2585                return;
2586
2587        if (!ifmgd->auth_data || ifmgd->auth_data->done)
2588                return;
2589
2590        memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
2591
2592        if (!ether_addr_equal(bssid, mgmt->bssid))
2593                return;
2594
2595        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
2596        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
2597        status_code = le16_to_cpu(mgmt->u.auth.status_code);
2598
2599        if (auth_alg != ifmgd->auth_data->algorithm ||
2600            auth_transaction != ifmgd->auth_data->expected_transaction) {
2601                sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
2602                           mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
2603                           auth_transaction,
2604                           ifmgd->auth_data->expected_transaction);
2605                return;
2606        }
2607
2608        if (status_code != WLAN_STATUS_SUCCESS) {
2609                sdata_info(sdata, "%pM denied authentication (status %d)\n",
2610                           mgmt->sa, status_code);
2611                ieee80211_destroy_auth_data(sdata, false);
2612                cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2613                event.u.mlme.status = MLME_DENIED;
2614                event.u.mlme.reason = status_code;
2615                drv_event_callback(sdata->local, sdata, &event);
2616                return;
2617        }
2618
2619        switch (ifmgd->auth_data->algorithm) {
2620        case WLAN_AUTH_OPEN:
2621        case WLAN_AUTH_LEAP:
2622        case WLAN_AUTH_FT:
2623        case WLAN_AUTH_SAE:
2624        case WLAN_AUTH_FILS_SK:
2625        case WLAN_AUTH_FILS_SK_PFS:
2626        case WLAN_AUTH_FILS_PK:
2627                break;
2628        case WLAN_AUTH_SHARED_KEY:
2629                if (ifmgd->auth_data->expected_transaction != 4) {
2630                        ieee80211_auth_challenge(sdata, mgmt, len);
2631                        /* need another frame */
2632                        return;
2633                }
2634                break;
2635        default:
2636                WARN_ONCE(1, "invalid auth alg %d",
2637                          ifmgd->auth_data->algorithm);
2638                return;
2639        }
2640
2641        event.u.mlme.status = MLME_SUCCESS;
2642        drv_event_callback(sdata->local, sdata, &event);
2643        sdata_info(sdata, "authenticated\n");
2644        ifmgd->auth_data->done = true;
2645        ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2646        ifmgd->auth_data->timeout_started = true;
2647        run_again(sdata, ifmgd->auth_data->timeout);
2648
2649        if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
2650            ifmgd->auth_data->expected_transaction != 2) {
2651                /*
2652                 * Report auth frame to user space for processing since another
2653                 * round of Authentication frames is still needed.
2654                 */
2655                cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2656                return;
2657        }
2658
2659        /* move station state to auth */
2660        mutex_lock(&sdata->local->sta_mtx);
2661        sta = sta_info_get(sdata, bssid);
2662        if (!sta) {
2663                WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2664                goto out_err;
2665        }
2666        if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
2667                sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2668                goto out_err;
2669        }
2670        mutex_unlock(&sdata->local->sta_mtx);
2671
2672        cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2673        return;
2674 out_err:
2675        mutex_unlock(&sdata->local->sta_mtx);
2676        /* ignore frame -- wait for timeout */
2677}
2678
2679#define case_WLAN(type) \
2680        case WLAN_REASON_##type: return #type
2681
2682static const char *ieee80211_get_reason_code_string(u16 reason_code)
2683{
2684        switch (reason_code) {
2685        case_WLAN(UNSPECIFIED);
2686        case_WLAN(PREV_AUTH_NOT_VALID);
2687        case_WLAN(DEAUTH_LEAVING);
2688        case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
2689        case_WLAN(DISASSOC_AP_BUSY);
2690        case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
2691        case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
2692        case_WLAN(DISASSOC_STA_HAS_LEFT);
2693        case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
2694        case_WLAN(DISASSOC_BAD_POWER);
2695        case_WLAN(DISASSOC_BAD_SUPP_CHAN);
2696        case_WLAN(INVALID_IE);
2697        case_WLAN(MIC_FAILURE);
2698        case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
2699        case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
2700        case_WLAN(IE_DIFFERENT);
2701        case_WLAN(INVALID_GROUP_CIPHER);
2702        case_WLAN(INVALID_PAIRWISE_CIPHER);
2703        case_WLAN(INVALID_AKMP);
2704        case_WLAN(UNSUPP_RSN_VERSION);
2705        case_WLAN(INVALID_RSN_IE_CAP);
2706        case_WLAN(IEEE8021X_FAILED);
2707        case_WLAN(CIPHER_SUITE_REJECTED);
2708        case_WLAN(DISASSOC_UNSPECIFIED_QOS);
2709        case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
2710        case_WLAN(DISASSOC_LOW_ACK);
2711        case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
2712        case_WLAN(QSTA_LEAVE_QBSS);
2713        case_WLAN(QSTA_NOT_USE);
2714        case_WLAN(QSTA_REQUIRE_SETUP);
2715        case_WLAN(QSTA_TIMEOUT);
2716        case_WLAN(QSTA_CIPHER_NOT_SUPP);
2717        case_WLAN(MESH_PEER_CANCELED);
2718        case_WLAN(MESH_MAX_PEERS);
2719        case_WLAN(MESH_CONFIG);
2720        case_WLAN(MESH_CLOSE);
2721        case_WLAN(MESH_MAX_RETRIES);
2722        case_WLAN(MESH_CONFIRM_TIMEOUT);
2723        case_WLAN(MESH_INVALID_GTK);
2724        case_WLAN(MESH_INCONSISTENT_PARAM);
2725        case_WLAN(MESH_INVALID_SECURITY);
2726        case_WLAN(MESH_PATH_ERROR);
2727        case_WLAN(MESH_PATH_NOFORWARD);
2728        case_WLAN(MESH_PATH_DEST_UNREACHABLE);
2729        case_WLAN(MAC_EXISTS_IN_MBSS);
2730        case_WLAN(MESH_CHAN_REGULATORY);
2731        case_WLAN(MESH_CHAN);
2732        default: return "<unknown>";
2733        }
2734}
2735
2736static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
2737                                     struct ieee80211_mgmt *mgmt, size_t len)
2738{
2739        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2740        u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2741
2742        sdata_assert_lock(sdata);
2743
2744        if (len < 24 + 2)
2745                return;
2746
2747        if (ifmgd->associated &&
2748            ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
2749                const u8 *bssid = ifmgd->associated->bssid;
2750
2751                sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
2752                           bssid, reason_code,
2753                           ieee80211_get_reason_code_string(reason_code));
2754
2755                ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2756
2757                ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
2758                                            reason_code);
2759                return;
2760        }
2761
2762        if (ifmgd->assoc_data &&
2763            ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
2764                const u8 *bssid = ifmgd->assoc_data->bss->bssid;
2765
2766                sdata_info(sdata,
2767                           "deauthenticated from %pM while associating (Reason: %u=%s)\n",
2768                           bssid, reason_code,
2769                           ieee80211_get_reason_code_string(reason_code));
2770
2771                ieee80211_destroy_assoc_data(sdata, false, true);
2772
2773                cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2774                return;
2775        }
2776}
2777
2778
2779static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
2780                                       struct ieee80211_mgmt *mgmt, size_t len)
2781{
2782        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2783        u16 reason_code;
2784
2785        sdata_assert_lock(sdata);
2786
2787        if (len < 24 + 2)
2788                return;
2789
2790        if (!ifmgd->associated ||
2791            !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2792                return;
2793
2794        reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
2795
2796        sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
2797                   mgmt->sa, reason_code,
2798                   ieee80211_get_reason_code_string(reason_code));
2799
2800        ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2801
2802        ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
2803}
2804
2805static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
2806                                u8 *supp_rates, unsigned int supp_rates_len,
2807                                u32 *rates, u32 *basic_rates,
2808                                bool *have_higher_than_11mbit,
2809                                int *min_rate, int *min_rate_index,
2810                                int shift)
2811{
2812        int i, j;
2813
2814        for (i = 0; i < supp_rates_len; i++) {
2815                int rate = supp_rates[i] & 0x7f;
2816                bool is_basic = !!(supp_rates[i] & 0x80);
2817
2818                if ((rate * 5 * (1 << shift)) > 110)
2819                        *have_higher_than_11mbit = true;
2820
2821                /*
2822                 * Skip HT and VHT BSS membership selectors since they're not
2823                 * rates.
2824                 *
2825                 * Note: Even though the membership selector and the basic
2826                 *       rate flag share the same bit, they are not exactly
2827                 *       the same.
2828                 */
2829                if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
2830                    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY))
2831                        continue;
2832
2833                for (j = 0; j < sband->n_bitrates; j++) {
2834                        struct ieee80211_rate *br;
2835                        int brate;
2836
2837                        br = &sband->bitrates[j];
2838
2839                        brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
2840                        if (brate == rate) {
2841                                *rates |= BIT(j);
2842                                if (is_basic)
2843                                        *basic_rates |= BIT(j);
2844                                if ((rate * 5) < *min_rate) {
2845                                        *min_rate = rate * 5;
2846                                        *min_rate_index = j;
2847                                }
2848                                break;
2849                        }
2850                }
2851        }
2852}
2853
2854static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
2855                                    struct cfg80211_bss *cbss,
2856                                    struct ieee80211_mgmt *mgmt, size_t len)
2857{
2858        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2859        struct ieee80211_local *local = sdata->local;
2860        struct ieee80211_supported_band *sband;
2861        struct sta_info *sta;
2862        u8 *pos;
2863        u16 capab_info, aid;
2864        struct ieee802_11_elems elems;
2865        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2866        const struct cfg80211_bss_ies *bss_ies = NULL;
2867        struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2868        u32 changed = 0;
2869        int err;
2870        bool ret;
2871
2872        /* AssocResp and ReassocResp have identical structure */
2873
2874        aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2875        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2876
2877        if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
2878                sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
2879                           aid);
2880        aid &= ~(BIT(15) | BIT(14));
2881
2882        ifmgd->broken_ap = false;
2883
2884        if (aid == 0 || aid > IEEE80211_MAX_AID) {
2885                sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
2886                           aid);
2887                aid = 0;
2888                ifmgd->broken_ap = true;
2889        }
2890
2891        pos = mgmt->u.assoc_resp.variable;
2892        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2893
2894        if (!elems.supp_rates) {
2895                sdata_info(sdata, "no SuppRates element in AssocResp\n");
2896                return false;
2897        }
2898
2899        ifmgd->aid = aid;
2900        ifmgd->tdls_chan_switch_prohibited =
2901                elems.ext_capab && elems.ext_capab_len >= 5 &&
2902                (elems.ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
2903
2904        /*
2905         * Some APs are erroneously not including some information in their
2906         * (re)association response frames. Try to recover by using the data
2907         * from the beacon or probe response. This seems to afflict mobile
2908         * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
2909         * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
2910         */
2911        if ((assoc_data->wmm && !elems.wmm_param) ||
2912            (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2913             (!elems.ht_cap_elem || !elems.ht_operation)) ||
2914            (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2915             (!elems.vht_cap_elem || !elems.vht_operation))) {
2916                const struct cfg80211_bss_ies *ies;
2917                struct ieee802_11_elems bss_elems;
2918
2919                rcu_read_lock();
2920                ies = rcu_dereference(cbss->ies);
2921                if (ies)
2922                        bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
2923                                          GFP_ATOMIC);
2924                rcu_read_unlock();
2925                if (!bss_ies)
2926                        return false;
2927
2928                ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
2929                                       false, &bss_elems);
2930                if (assoc_data->wmm &&
2931                    !elems.wmm_param && bss_elems.wmm_param) {
2932                        elems.wmm_param = bss_elems.wmm_param;
2933                        sdata_info(sdata,
2934                                   "AP bug: WMM param missing from AssocResp\n");
2935                }
2936
2937                /*
2938                 * Also check if we requested HT/VHT, otherwise the AP doesn't
2939                 * have to include the IEs in the (re)association response.
2940                 */
2941                if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
2942                    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2943                        elems.ht_cap_elem = bss_elems.ht_cap_elem;
2944                        sdata_info(sdata,
2945                                   "AP bug: HT capability missing from AssocResp\n");
2946                }
2947                if (!elems.ht_operation && bss_elems.ht_operation &&
2948                    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2949                        elems.ht_operation = bss_elems.ht_operation;
2950                        sdata_info(sdata,
2951                                   "AP bug: HT operation missing from AssocResp\n");
2952                }
2953                if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
2954                    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2955                        elems.vht_cap_elem = bss_elems.vht_cap_elem;
2956                        sdata_info(sdata,
2957                                   "AP bug: VHT capa missing from AssocResp\n");
2958                }
2959                if (!elems.vht_operation && bss_elems.vht_operation &&
2960                    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2961                        elems.vht_operation = bss_elems.vht_operation;
2962                        sdata_info(sdata,
2963                                   "AP bug: VHT operation missing from AssocResp\n");
2964                }
2965        }
2966
2967        /*
2968         * We previously checked these in the beacon/probe response, so
2969         * they should be present here. This is just a safety net.
2970         */
2971        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2972            (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
2973                sdata_info(sdata,
2974                           "HT AP is missing WMM params or HT capability/operation\n");
2975                ret = false;
2976                goto out;
2977        }
2978
2979        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2980            (!elems.vht_cap_elem || !elems.vht_operation)) {
2981                sdata_info(sdata,
2982                           "VHT AP is missing VHT capability/operation\n");
2983                ret = false;
2984                goto out;
2985        }
2986
2987        mutex_lock(&sdata->local->sta_mtx);
2988        /*
2989         * station info was already allocated and inserted before
2990         * the association and should be available to us
2991         */
2992        sta = sta_info_get(sdata, cbss->bssid);
2993        if (WARN_ON(!sta)) {
2994                mutex_unlock(&sdata->local->sta_mtx);
2995                ret = false;
2996                goto out;
2997        }
2998
2999        sband = ieee80211_get_sband(sdata);
3000        if (!sband) {
3001                mutex_unlock(&sdata->local->sta_mtx);
3002                ret = false;
3003                goto out;
3004        }
3005
3006        /* Set up internal HT/VHT capabilities */
3007        if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
3008                ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3009                                                  elems.ht_cap_elem, sta);
3010
3011        if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
3012                ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3013                                                    elems.vht_cap_elem, sta);
3014
3015        /*
3016         * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
3017         * in their association response, so ignore that data for our own
3018         * configuration. If it changed since the last beacon, we'll get the
3019         * next beacon and update then.
3020         */
3021
3022        /*
3023         * If an operating mode notification IE is present, override the
3024         * NSS calculation (that would be done in rate_control_rate_init())
3025         * and use the # of streams from that element.
3026         */
3027        if (elems.opmode_notif &&
3028            !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
3029                u8 nss;
3030
3031                nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
3032                nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
3033                nss += 1;
3034                sta->sta.rx_nss = nss;
3035        }
3036
3037        rate_control_rate_init(sta);
3038
3039        if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
3040                set_sta_flag(sta, WLAN_STA_MFP);
3041                sta->sta.mfp = true;
3042        } else {
3043                sta->sta.mfp = false;
3044        }
3045
3046        sta->sta.wme = elems.wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3047
3048        err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3049        if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
3050                err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
3051        if (err) {
3052                sdata_info(sdata,
3053                           "failed to move station %pM to desired state\n",
3054                           sta->sta.addr);
3055                WARN_ON(__sta_info_destroy(sta));
3056                mutex_unlock(&sdata->local->sta_mtx);
3057                ret = false;
3058                goto out;
3059        }
3060
3061        mutex_unlock(&sdata->local->sta_mtx);
3062
3063        /*
3064         * Always handle WMM once after association regardless
3065         * of the first value the AP uses. Setting -1 here has
3066         * that effect because the AP values is an unsigned
3067         * 4-bit value.
3068         */
3069        ifmgd->wmm_last_param_set = -1;
3070
3071        if (ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
3072                ieee80211_set_wmm_default(sdata, false, false);
3073        } else if (!ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3074                                             elems.wmm_param_len)) {
3075                /* still enable QoS since we might have HT/VHT */
3076                ieee80211_set_wmm_default(sdata, false, true);
3077                /* set the disable-WMM flag in this case to disable
3078                 * tracking WMM parameter changes in the beacon if
3079                 * the parameters weren't actually valid. Doing so
3080                 * avoids changing parameters very strangely when
3081                 * the AP is going back and forth between valid and
3082                 * invalid parameters.
3083                 */
3084                ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
3085        }
3086        changed |= BSS_CHANGED_QOS;
3087
3088        if (elems.max_idle_period_ie) {
3089                bss_conf->max_idle_period =
3090                        le16_to_cpu(elems.max_idle_period_ie->max_idle_period);
3091                bss_conf->protected_keep_alive =
3092                        !!(elems.max_idle_period_ie->idle_options &
3093                           WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
3094                changed |= BSS_CHANGED_KEEP_ALIVE;
3095        } else {
3096                bss_conf->max_idle_period = 0;
3097                bss_conf->protected_keep_alive = false;
3098        }
3099
3100        /* set AID and assoc capability,
3101         * ieee80211_set_associated() will tell the driver */
3102        bss_conf->aid = aid;
3103        bss_conf->assoc_capability = capab_info;
3104        ieee80211_set_associated(sdata, cbss, changed);
3105
3106        /*
3107         * If we're using 4-addr mode, let the AP know that we're
3108         * doing so, so that it can create the STA VLAN on its side
3109         */
3110        if (ifmgd->use_4addr)
3111                ieee80211_send_4addr_nullfunc(local, sdata);
3112
3113        /*
3114         * Start timer to probe the connection to the AP now.
3115         * Also start the timer that will detect beacon loss.
3116         */
3117        ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3118        ieee80211_sta_reset_beacon_monitor(sdata);
3119
3120        ret = true;
3121 out:
3122        kfree(bss_ies);
3123        return ret;
3124}
3125
3126static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
3127                                         struct ieee80211_mgmt *mgmt,
3128                                         size_t len)
3129{
3130        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3131        struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
3132        u16 capab_info, status_code, aid;
3133        struct ieee802_11_elems elems;
3134        int ac, uapsd_queues = -1;
3135        u8 *pos;
3136        bool reassoc;
3137        struct cfg80211_bss *bss;
3138        struct ieee80211_event event = {
3139                .type = MLME_EVENT,
3140                .u.mlme.data = ASSOC_EVENT,
3141        };
3142
3143        sdata_assert_lock(sdata);
3144
3145        if (!assoc_data)
3146                return;
3147        if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3148                return;
3149
3150        /*
3151         * AssocResp and ReassocResp have identical structure, so process both
3152         * of them in this function.
3153         */
3154
3155        if (len < 24 + 6)
3156                return;
3157
3158        reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
3159        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3160        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
3161        aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
3162
3163        sdata_info(sdata,
3164                   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
3165                   reassoc ? "Rea" : "A", mgmt->sa,
3166                   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
3167
3168        if (assoc_data->fils_kek_len &&
3169            fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
3170                return;
3171
3172        pos = mgmt->u.assoc_resp.variable;
3173        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
3174
3175        if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3176            elems.timeout_int &&
3177            elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
3178                u32 tu, ms;
3179                tu = le32_to_cpu(elems.timeout_int->value);
3180                ms = tu * 1024 / 1000;
3181                sdata_info(sdata,
3182                           "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
3183                           mgmt->sa, tu, ms);
3184                assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3185                assoc_data->timeout_started = true;
3186                if (ms > IEEE80211_ASSOC_TIMEOUT)
3187                        run_again(sdata, assoc_data->timeout);
3188                return;
3189        }
3190
3191        bss = assoc_data->bss;
3192
3193        if (status_code != WLAN_STATUS_SUCCESS) {
3194                sdata_info(sdata, "%pM denied association (code=%d)\n",
3195                           mgmt->sa, status_code);
3196                ieee80211_destroy_assoc_data(sdata, false, false);
3197                event.u.mlme.status = MLME_DENIED;
3198                event.u.mlme.reason = status_code;
3199                drv_event_callback(sdata->local, sdata, &event);
3200        } else {
3201                if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
3202                        /* oops -- internal error -- send timeout for now */
3203                        ieee80211_destroy_assoc_data(sdata, false, false);
3204                        cfg80211_assoc_timeout(sdata->dev, bss);
3205                        return;
3206                }
3207                event.u.mlme.status = MLME_SUCCESS;
3208                drv_event_callback(sdata->local, sdata, &event);
3209                sdata_info(sdata, "associated\n");
3210
3211                /*
3212                 * destroy assoc_data afterwards, as otherwise an idle
3213                 * recalc after assoc_data is NULL but before associated
3214                 * is set can cause the interface to go idle
3215                 */
3216                ieee80211_destroy_assoc_data(sdata, true, false);
3217
3218                /* get uapsd queues configuration */
3219                uapsd_queues = 0;
3220                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
3221                        if (sdata->tx_conf[ac].uapsd)
3222                                uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
3223        }
3224
3225        cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues);
3226}
3227
3228static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
3229                                  struct ieee80211_mgmt *mgmt, size_t len,
3230                                  struct ieee80211_rx_status *rx_status,
3231                                  struct ieee802_11_elems *elems)
3232{
3233        struct ieee80211_local *local = sdata->local;
3234        struct ieee80211_bss *bss;
3235        struct ieee80211_channel *channel;
3236
3237        sdata_assert_lock(sdata);
3238
3239        channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
3240        if (!channel)
3241                return;
3242
3243        bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
3244                                        channel);
3245        if (bss) {
3246                sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3247                ieee80211_rx_bss_put(local, bss);
3248        }
3249}
3250
3251
3252static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
3253                                         struct sk_buff *skb)
3254{
3255        struct ieee80211_mgmt *mgmt = (void *)skb->data;
3256        struct ieee80211_if_managed *ifmgd;
3257        struct ieee80211_rx_status *rx_status = (void *) skb->cb;
3258        size_t baselen, len = skb->len;
3259        struct ieee802_11_elems elems;
3260
3261        ifmgd = &sdata->u.mgd;
3262
3263        sdata_assert_lock(sdata);
3264
3265        if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
3266                return; /* ignore ProbeResp to foreign address */
3267
3268        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
3269        if (baselen > len)
3270                return;
3271
3272        ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
3273                               false, &elems);
3274
3275        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3276
3277        if (ifmgd->associated &&
3278            ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3279                ieee80211_reset_ap_probe(sdata);
3280}
3281
3282/*
3283 * This is the canonical list of information elements we care about,
3284 * the filter code also gives us all changes to the Microsoft OUI
3285 * (00:50:F2) vendor IE which is used for WMM which we need to track,
3286 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
3287 * changes to requested client power.
3288 *
3289 * We implement beacon filtering in software since that means we can
3290 * avoid processing the frame here and in cfg80211, and userspace
3291 * will not be able to tell whether the hardware supports it or not.
3292 *
3293 * XXX: This list needs to be dynamic -- userspace needs to be able to
3294 *      add items it requires. It also needs to be able to tell us to
3295 *      look out for other vendor IEs.
3296 */
3297static const u64 care_about_ies =
3298        (1ULL << WLAN_EID_COUNTRY) |
3299        (1ULL << WLAN_EID_ERP_INFO) |
3300        (1ULL << WLAN_EID_CHANNEL_SWITCH) |
3301        (1ULL << WLAN_EID_PWR_CONSTRAINT) |
3302        (1ULL << WLAN_EID_HT_CAPABILITY) |
3303        (1ULL << WLAN_EID_HT_OPERATION) |
3304        (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3305
3306static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
3307                                     struct ieee80211_mgmt *mgmt, size_t len,
3308                                     struct ieee80211_rx_status *rx_status)
3309{
3310        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3311        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3312        size_t baselen;
3313        struct ieee802_11_elems elems;
3314        struct ieee80211_local *local = sdata->local;
3315        struct ieee80211_chanctx_conf *chanctx_conf;
3316        struct ieee80211_channel *chan;
3317        struct sta_info *sta;
3318        u32 changed = 0;
3319        bool erp_valid;
3320        u8 erp_value = 0;
3321        u32 ncrc;
3322        u8 *bssid;
3323        u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
3324
3325        sdata_assert_lock(sdata);
3326
3327        /* Process beacon from the current BSS */
3328        baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
3329        if (baselen > len)
3330                return;
3331
3332        rcu_read_lock();
3333        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3334        if (!chanctx_conf) {
3335                rcu_read_unlock();
3336                return;
3337        }
3338
3339        if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
3340                rcu_read_unlock();
3341                return;
3342        }
3343        chan = chanctx_conf->def.chan;
3344        rcu_read_unlock();
3345
3346        if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
3347            ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
3348                ieee802_11_parse_elems(mgmt->u.beacon.variable,
3349                                       len - baselen, false, &elems);
3350
3351                ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3352                if (elems.tim && !elems.parse_error) {
3353                        const struct ieee80211_tim_ie *tim_ie = elems.tim;
3354                        ifmgd->dtim_period = tim_ie->dtim_period;
3355                }
3356                ifmgd->have_beacon = true;
3357                ifmgd->assoc_data->need_beacon = false;
3358                if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
3359                        sdata->vif.bss_conf.sync_tsf =
3360                                le64_to_cpu(mgmt->u.beacon.timestamp);
3361                        sdata->vif.bss_conf.sync_device_ts =
3362                                rx_status->device_timestamp;
3363                        if (elems.tim)
3364                                sdata->vif.bss_conf.sync_dtim_count =
3365                                        elems.tim->dtim_count;
3366                        else
3367                                sdata->vif.bss_conf.sync_dtim_count = 0;
3368                }
3369                /* continue assoc process */
3370                ifmgd->assoc_data->timeout = jiffies;
3371                ifmgd->assoc_data->timeout_started = true;
3372                run_again(sdata, ifmgd->assoc_data->timeout);
3373                return;
3374        }
3375
3376        if (!ifmgd->associated ||
3377            !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3378                return;
3379        bssid = ifmgd->associated->bssid;
3380
3381        /* Track average RSSI from the Beacon frames of the current AP */
3382        if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
3383                ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3384                ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3385                ifmgd->last_cqm_event_signal = 0;
3386                ifmgd->count_beacon_signal = 1;
3387                ifmgd->last_ave_beacon_signal = 0;
3388        } else {
3389                ifmgd->count_beacon_signal++;
3390        }
3391
3392        ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);
3393
3394        if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
3395            ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3396                int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3397                int last_sig = ifmgd->last_ave_beacon_signal;
3398                struct ieee80211_event event = {
3399                        .type = RSSI_EVENT,
3400                };
3401
3402                /*
3403                 * if signal crosses either of the boundaries, invoke callback
3404                 * with appropriate parameters
3405                 */
3406                if (sig > ifmgd->rssi_max_thold &&
3407                    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
3408                        ifmgd->last_ave_beacon_signal = sig;
3409                        event.u.rssi.data = RSSI_EVENT_HIGH;
3410                        drv_event_callback(local, sdata, &event);
3411                } else if (sig < ifmgd->rssi_min_thold &&
3412                           (last_sig >= ifmgd->rssi_max_thold ||
3413                           last_sig == 0)) {
3414                        ifmgd->last_ave_beacon_signal = sig;
3415                        event.u.rssi.data = RSSI_EVENT_LOW;
3416                        drv_event_callback(local, sdata, &event);
3417                }
3418        }
3419
3420        if (bss_conf->cqm_rssi_thold &&
3421            ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3422            !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3423                int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3424                int last_event = ifmgd->last_cqm_event_signal;
3425                int thold = bss_conf->cqm_rssi_thold;
3426                int hyst = bss_conf->cqm_rssi_hyst;
3427
3428                if (sig < thold &&
3429                    (last_event == 0 || sig < last_event - hyst)) {
3430                        ifmgd->last_cqm_event_signal = sig;
3431                        ieee80211_cqm_rssi_notify(
3432                                &sdata->vif,
3433                                NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3434                                sig, GFP_KERNEL);
3435                } else if (sig > thold &&
3436                           (last_event == 0 || sig > last_event + hyst)) {
3437                        ifmgd->last_cqm_event_signal = sig;
3438                        ieee80211_cqm_rssi_notify(
3439                                &sdata->vif,
3440                                NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3441                                sig, GFP_KERNEL);
3442                }
3443        }
3444
3445        if (bss_conf->cqm_rssi_low &&
3446            ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3447                int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3448                int last_event = ifmgd->last_cqm_event_signal;
3449                int low = bss_conf->cqm_rssi_low;
3450                int high = bss_conf->cqm_rssi_high;
3451
3452                if (sig < low &&
3453                    (last_event == 0 || last_event >= low)) {
3454                        ifmgd->last_cqm_event_signal = sig;
3455                        ieee80211_cqm_rssi_notify(
3456                                &sdata->vif,
3457                                NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3458                                sig, GFP_KERNEL);
3459                } else if (sig > high &&
3460                           (last_event == 0 || last_event <= high)) {
3461                        ifmgd->last_cqm_event_signal = sig;
3462                        ieee80211_cqm_rssi_notify(
3463                                &sdata->vif,
3464                                NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3465                                sig, GFP_KERNEL);
3466                }
3467        }
3468
3469        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
3470                mlme_dbg_ratelimited(sdata,
3471                                     "cancelling AP probe due to a received beacon\n");
3472                ieee80211_reset_ap_probe(sdata);
3473        }
3474
3475        /*
3476         * Push the beacon loss detection into the future since
3477         * we are processing a beacon from the AP just now.
3478         */
3479        ieee80211_sta_reset_beacon_monitor(sdata);
3480
3481        ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
3482        ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3483                                          len - baselen, false, &elems,
3484                                          care_about_ies, ncrc);
3485
3486        if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
3487            ieee80211_check_tim(elems.tim, elems.tim_len, ifmgd->aid)) {
3488                if (local->hw.conf.dynamic_ps_timeout > 0) {
3489                        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
3490                                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
3491                                ieee80211_hw_config(local,
3492                                                    IEEE80211_CONF_CHANGE_PS);
3493                        }
3494                        ieee80211_send_nullfunc(local, sdata, false);
3495                } else if (!local->pspolling && sdata->u.mgd.powersave) {
3496                        local->pspolling = true;
3497
3498                        /*
3499                         * Here is assumed that the driver will be
3500                         * able to send ps-poll frame and receive a
3501                         * response even though power save mode is
3502                         * enabled, but some drivers might require
3503                         * to disable power save here. This needs
3504                         * to be investigated.
3505                         */
3506                        ieee80211_send_pspoll(local, sdata);
3507                }
3508        }
3509
3510        if (sdata->vif.p2p ||
3511            sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
3512                struct ieee80211_p2p_noa_attr noa = {};
3513                int ret;
3514
3515                ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
3516                                            len - baselen,
3517                                            IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3518                                            (u8 *) &noa, sizeof(noa));
3519                if (ret >= 2) {
3520                        if (sdata->u.mgd.p2p_noa_index != noa.index) {
3521                                /* valid noa_attr and index changed */
3522                                sdata->u.mgd.p2p_noa_index = noa.index;
3523                                memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
3524                                changed |= BSS_CHANGED_P2P_PS;
3525                                /*
3526                                 * make sure we update all information, the CRC
3527                                 * mechanism doesn't look at P2P attributes.
3528                                 */
3529                                ifmgd->beacon_crc_valid = false;
3530                        }
3531                } else if (sdata->u.mgd.p2p_noa_index != -1) {
3532                        /* noa_attr not found and we had valid noa_attr before */
3533                        sdata->u.mgd.p2p_noa_index = -1;
3534                        memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3535                        changed |= BSS_CHANGED_P2P_PS;
3536                        ifmgd->beacon_crc_valid = false;
3537                }
3538        }
3539
3540        if (ifmgd->csa_waiting_bcn)
3541                ieee80211_chswitch_post_beacon(sdata);
3542
3543        /*
3544         * Update beacon timing and dtim count on every beacon appearance. This
3545         * will allow the driver to use the most updated values. Do it before
3546         * comparing this one with last received beacon.
3547         * IMPORTANT: These parameters would possibly be out of sync by the time
3548         * the driver will use them. The synchronized view is currently
3549         * guaranteed only in certain callbacks.
3550         */
3551        if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
3552                sdata->vif.bss_conf.sync_tsf =
3553                        le64_to_cpu(mgmt->u.beacon.timestamp);
3554                sdata->vif.bss_conf.sync_device_ts =
3555                        rx_status->device_timestamp;
3556                if (elems.tim)
3557                        sdata->vif.bss_conf.sync_dtim_count =
3558                                elems.tim->dtim_count;
3559                else
3560                        sdata->vif.bss_conf.sync_dtim_count = 0;
3561        }
3562
3563        if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3564                return;
3565        ifmgd->beacon_crc = ncrc;
3566        ifmgd->beacon_crc_valid = true;
3567
3568        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3569
3570        ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
3571                                         rx_status->device_timestamp,
3572                                         &elems, true);
3573
3574        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
3575            ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3576                                     elems.wmm_param_len))
3577                changed |= BSS_CHANGED_QOS;
3578
3579        /*
3580         * If we haven't had a beacon before, tell the driver about the
3581         * DTIM period (and beacon timing if desired) now.
3582         */
3583        if (!ifmgd->have_beacon) {
3584                /* a few bogus AP send dtim_period = 0 or no TIM IE */
3585                if (elems.tim)
3586                        bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
3587                else
3588                        bss_conf->dtim_period = 1;
3589
3590                changed |= BSS_CHANGED_BEACON_INFO;
3591                ifmgd->have_beacon = true;
3592
3593                mutex_lock(&local->iflist_mtx);
3594                ieee80211_recalc_ps(local);
3595                mutex_unlock(&local->iflist_mtx);
3596
3597                ieee80211_recalc_ps_vif(sdata);
3598        }
3599
3600        if (elems.erp_info) {
3601                erp_valid = true;
3602                erp_value = elems.erp_info[0];
3603        } else {
3604                erp_valid = false;
3605        }
3606        changed |= ieee80211_handle_bss_capability(sdata,
3607                        le16_to_cpu(mgmt->u.beacon.capab_info),
3608                        erp_valid, erp_value);
3609
3610        mutex_lock(&local->sta_mtx);
3611        sta = sta_info_get(sdata, bssid);
3612
3613        if (ieee80211_config_bw(sdata, sta,
3614                                elems.ht_cap_elem, elems.ht_operation,
3615                                elems.vht_operation, bssid, &changed)) {
3616                mutex_unlock(&local->sta_mtx);
3617                sdata_info(sdata,
3618                           "failed to follow AP %pM bandwidth change, disconnect\n",
3619                           bssid);
3620                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3621                                       WLAN_REASON_DEAUTH_LEAVING,
3622                                       true, deauth_buf);
3623                ieee80211_report_disconnect(sdata, deauth_buf,
3624                                            sizeof(deauth_buf), true,
3625                                            WLAN_REASON_DEAUTH_LEAVING);
3626                return;
3627        }
3628
3629        if (sta && elems.opmode_notif)
3630                ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
3631                                            rx_status->band);
3632        mutex_unlock(&local->sta_mtx);
3633
3634        changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
3635                                               elems.country_elem,
3636                                               elems.country_elem_len,
3637                                               elems.pwr_constr_elem,
3638                                               elems.cisco_dtpc_elem);
3639
3640        ieee80211_bss_info_change_notify(sdata, changed);
3641}
3642
3643void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
3644                                  struct sk_buff *skb)
3645{
3646        struct ieee80211_rx_status *rx_status;
3647        struct ieee80211_mgmt *mgmt;
3648        u16 fc;
3649        struct ieee802_11_elems elems;
3650        int ies_len;
3651
3652        rx_status = (struct ieee80211_rx_status *) skb->cb;
3653        mgmt = (struct ieee80211_mgmt *) skb->data;
3654        fc = le16_to_cpu(mgmt->frame_control);
3655
3656        sdata_lock(sdata);
3657
3658        switch (fc & IEEE80211_FCTL_STYPE) {
3659        case IEEE80211_STYPE_BEACON:
3660                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
3661                break;
3662        case IEEE80211_STYPE_PROBE_RESP:
3663                ieee80211_rx_mgmt_probe_resp(sdata, skb);
3664                break;
3665        case IEEE80211_STYPE_AUTH:
3666                ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
3667                break;
3668        case IEEE80211_STYPE_DEAUTH:
3669                ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
3670                break;
3671        case IEEE80211_STYPE_DISASSOC:
3672                ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
3673                break;
3674        case IEEE80211_STYPE_ASSOC_RESP:
3675        case IEEE80211_STYPE_REASSOC_RESP:
3676                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
3677                break;
3678        case IEEE80211_STYPE_ACTION:
3679                if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3680                        ies_len = skb->len -
3681                                  offsetof(struct ieee80211_mgmt,
3682                                           u.action.u.chan_switch.variable);
3683
3684                        if (ies_len < 0)
3685                                break;
3686
3687                        ieee802_11_parse_elems(
3688                                mgmt->u.action.u.chan_switch.variable,
3689                                ies_len, true, &elems);
3690
3691                        if (elems.parse_error)
3692                                break;
3693
3694                        ieee80211_sta_process_chanswitch(sdata,
3695                                                 rx_status->mactime,
3696                                                 rx_status->device_timestamp,
3697                                                 &elems, false);
3698                } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
3699                        ies_len = skb->len -
3700                                  offsetof(struct ieee80211_mgmt,
3701                                           u.action.u.ext_chan_switch.variable);
3702
3703                        if (ies_len < 0)
3704                                break;
3705
3706                        ieee802_11_parse_elems(
3707                                mgmt->u.action.u.ext_chan_switch.variable,
3708                                ies_len, true, &elems);
3709
3710                        if (elems.parse_error)
3711                                break;
3712
3713                        /* for the handling code pretend this was also an IE */
3714                        elems.ext_chansw_ie =
3715                                &mgmt->u.action.u.ext_chan_switch.data;
3716
3717                        ieee80211_sta_process_chanswitch(sdata,
3718                                                 rx_status->mactime,
3719                                                 rx_status->device_timestamp,
3720                                                 &elems, false);
3721                }
3722                break;
3723        }
3724        sdata_unlock(sdata);
3725}
3726
3727static void ieee80211_sta_timer(unsigned long data)
3728{
3729        struct ieee80211_sub_if_data *sdata =
3730                (struct ieee80211_sub_if_data *) data;
3731
3732        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3733}
3734
3735static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3736                                          u8 *bssid, u8 reason, bool tx)
3737{
3738        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3739
3740        ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3741                               tx, frame_buf);
3742
3743        ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
3744                                    reason);
3745}
3746
3747static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
3748{
3749        struct ieee80211_local *local = sdata->local;
3750        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3751        struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3752        u32 tx_flags = 0;
3753        u16 trans = 1;
3754        u16 status = 0;
3755
3756        sdata_assert_lock(sdata);
3757
3758        if (WARN_ON_ONCE(!auth_data))
3759                return -EINVAL;
3760
3761        auth_data->tries++;
3762
3763        if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
3764                sdata_info(sdata, "authentication with %pM timed out\n",
3765                           auth_data->bss->bssid);
3766
3767                /*
3768                 * Most likely AP is not in the range so remove the
3769                 * bss struct for that AP.
3770                 */
3771                cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
3772
3773                return -ETIMEDOUT;
3774        }
3775
3776        drv_mgd_prepare_tx(local, sdata);
3777
3778        sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
3779                   auth_data->bss->bssid, auth_data->tries,
3780                   IEEE80211_AUTH_MAX_TRIES);
3781
3782        auth_data->expected_transaction = 2;
3783
3784        if (auth_data->algorithm == WLAN_AUTH_SAE) {
3785                trans = auth_data->sae_trans;
3786                status = auth_data->sae_status;
3787                auth_data->expected_transaction = trans;
3788        }
3789
3790        if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3791                tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3792                           IEEE80211_TX_INTFL_MLME_CONN_TX;
3793
3794        ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
3795                            auth_data->data, auth_data->data_len,
3796                            auth_data->bss->bssid,
3797                            auth_data->bss->bssid, NULL, 0, 0,
3798                            tx_flags);
3799
3800        if (tx_flags == 0) {
3801                auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3802                auth_data->timeout_started = true;
3803                run_again(sdata, auth_data->timeout);
3804        } else {
3805                auth_data->timeout =
3806                        round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
3807                auth_data->timeout_started = true;
3808                run_again(sdata, auth_data->timeout);
3809        }
3810
3811        return 0;
3812}
3813
3814static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
3815{
3816        struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3817        struct ieee80211_local *local = sdata->local;
3818
3819        sdata_assert_lock(sdata);
3820
3821        assoc_data->tries++;
3822        if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
3823                sdata_info(sdata, "association with %pM timed out\n",
3824                           assoc_data->bss->bssid);
3825
3826                /*
3827                 * Most likely AP is not in the range so remove the
3828                 * bss struct for that AP.
3829                 */
3830                cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);
3831
3832                return -ETIMEDOUT;
3833        }
3834
3835        sdata_info(sdata, "associate with %pM (try %d/%d)\n",
3836                   assoc_data->bss->bssid, assoc_data->tries,
3837                   IEEE80211_ASSOC_MAX_TRIES);
3838        ieee80211_send_assoc(sdata);
3839
3840        if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
3841                assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3842                assoc_data->timeout_started = true;
3843                run_again(sdata, assoc_data->timeout);
3844        } else {
3845                assoc_data->timeout =
3846                        round_jiffies_up(jiffies +
3847                                         IEEE80211_ASSOC_TIMEOUT_LONG);
3848                assoc_data->timeout_started = true;
3849                run_again(sdata, assoc_data->timeout);
3850        }
3851
3852        return 0;
3853}
3854
3855void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
3856                                  __le16 fc, bool acked)
3857{
3858        struct ieee80211_local *local = sdata->local;
3859
3860        sdata->u.mgd.status_fc = fc;
3861        sdata->u.mgd.status_acked = acked;
3862        sdata->u.mgd.status_received = true;
3863
3864        ieee80211_queue_work(&local->hw, &sdata->work);
3865}
3866
3867void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
3868{
3869        struct ieee80211_local *local = sdata->local;
3870        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3871
3872        sdata_lock(sdata);
3873
3874        if (ifmgd->status_received) {
3875                __le16 fc = ifmgd->status_fc;
3876                bool status_acked = ifmgd->status_acked;
3877
3878                ifmgd->status_received = false;
3879                if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
3880                        if (status_acked) {
3881                                ifmgd->auth_data->timeout =
3882                                        jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3883                                run_again(sdata, ifmgd->auth_data->timeout);
3884                        } else {
3885                                ifmgd->auth_data->timeout = jiffies - 1;
3886                        }
3887                        ifmgd->auth_data->timeout_started = true;
3888                } else if (ifmgd->assoc_data &&
3889                           (ieee80211_is_assoc_req(fc) ||
3890                            ieee80211_is_reassoc_req(fc))) {
3891                        if (status_acked) {
3892                                ifmgd->assoc_data->timeout =
3893                                        jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3894                                run_again(sdata, ifmgd->assoc_data->timeout);
3895                        } else {
3896                                ifmgd->assoc_data->timeout = jiffies - 1;
3897                        }
3898                        ifmgd->assoc_data->timeout_started = true;
3899                }
3900        }
3901
3902        if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
3903            time_after(jiffies, ifmgd->auth_data->timeout)) {
3904                if (ifmgd->auth_data->done) {
3905                        /*
3906                         * ok ... we waited for assoc but userspace didn't,
3907                         * so let's just kill the auth data
3908                         */
3909                        ieee80211_destroy_auth_data(sdata, false);
3910                } else if (ieee80211_auth(sdata)) {
3911                        u8 bssid[ETH_ALEN];
3912                        struct ieee80211_event event = {
3913                                .type = MLME_EVENT,
3914                                .u.mlme.data = AUTH_EVENT,
3915                                .u.mlme.status = MLME_TIMEOUT,
3916                        };
3917
3918                        memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
3919
3920                        ieee80211_destroy_auth_data(sdata, false);
3921
3922                        cfg80211_auth_timeout(sdata->dev, bssid);
3923                        drv_event_callback(sdata->local, sdata, &event);
3924                }
3925        } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3926                run_again(sdata, ifmgd->auth_data->timeout);
3927
3928        if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
3929            time_after(jiffies, ifmgd->assoc_data->timeout)) {
3930                if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
3931                    ieee80211_do_assoc(sdata)) {
3932                        struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
3933                        struct ieee80211_event event = {
3934                                .type = MLME_EVENT,
3935                                .u.mlme.data = ASSOC_EVENT,
3936                                .u.mlme.status = MLME_TIMEOUT,
3937                        };
3938
3939                        ieee80211_destroy_assoc_data(sdata, false, false);
3940                        cfg80211_assoc_timeout(sdata->dev, bss);
3941                        drv_event_callback(sdata->local, sdata, &event);
3942                }
3943        } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3944                run_again(sdata, ifmgd->assoc_data->timeout);
3945
3946        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
3947            ifmgd->associated) {
3948                u8 bssid[ETH_ALEN];
3949                int max_tries;
3950
3951                memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3952
3953                if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3954                        max_tries = max_nullfunc_tries;
3955                else
3956                        max_tries = max_probe_tries;
3957
3958                /* ACK received for nullfunc probing frame */
3959                if (!ifmgd->probe_send_count)
3960                        ieee80211_reset_ap_probe(sdata);
3961                else if (ifmgd->nullfunc_failed) {
3962                        if (ifmgd->probe_send_count < max_tries) {
3963                                mlme_dbg(sdata,
3964                                         "No ack for nullfunc frame to AP %pM, try %d/%i\n",
3965                                         bssid, ifmgd->probe_send_count,
3966                                         max_tries);
3967                                ieee80211_mgd_probe_ap_send(sdata);
3968                        } else {
3969                                mlme_dbg(sdata,
3970                                         "No ack for nullfunc frame to AP %pM, disconnecting.\n",
3971                                         bssid);
3972                                ieee80211_sta_connection_lost(sdata, bssid,
3973                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3974                                        false);
3975                        }
3976                } else if (time_is_after_jiffies(ifmgd->probe_timeout))
3977                        run_again(sdata, ifmgd->probe_timeout);
3978                else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
3979                        mlme_dbg(sdata,
3980                                 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
3981                                 bssid, probe_wait_ms);
3982                        ieee80211_sta_connection_lost(sdata, bssid,
3983                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3984                } else if (ifmgd->probe_send_count < max_tries) {
3985                        mlme_dbg(sdata,
3986                                 "No probe response from AP %pM after %dms, try %d/%i\n",
3987                                 bssid, probe_wait_ms,
3988                                 ifmgd->probe_send_count, max_tries);
3989                        ieee80211_mgd_probe_ap_send(sdata);
3990                } else {
3991                        /*
3992                         * We actually lost the connection ... or did we?
3993                         * Let's make sure!
3994                         */
3995                        mlme_dbg(sdata,
3996                                 "No probe response from AP %pM after %dms, disconnecting.\n",
3997                                 bssid, probe_wait_ms);
3998
3999                        ieee80211_sta_connection_lost(sdata, bssid,
4000                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
4001                }
4002        }
4003
4004        sdata_unlock(sdata);
4005}
4006
4007static void ieee80211_sta_bcn_mon_timer(unsigned long data)
4008{
4009        struct ieee80211_sub_if_data *sdata =
4010                (struct ieee80211_sub_if_data *) data;
4011        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4012
4013        if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
4014                return;
4015
4016        sdata->u.mgd.connection_loss = false;
4017        ieee80211_queue_work(&sdata->local->hw,
4018                             &sdata->u.mgd.beacon_connection_loss_work);
4019}
4020
4021static void ieee80211_sta_conn_mon_timer(unsigned long data)
4022{
4023        struct ieee80211_sub_if_data *sdata =
4024                (struct ieee80211_sub_if_data *) data;
4025        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4026        struct ieee80211_local *local = sdata->local;
4027
4028        if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
4029                return;
4030
4031        ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
4032}
4033
4034static void ieee80211_sta_monitor_work(struct work_struct *work)
4035{
4036        struct ieee80211_sub_if_data *sdata =
4037                container_of(work, struct ieee80211_sub_if_data,
4038                             u.mgd.monitor_work);
4039
4040        ieee80211_mgd_probe_ap(sdata, false);
4041}
4042
4043static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
4044{
4045        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
4046                __ieee80211_stop_poll(sdata);
4047
4048                /* let's probe the connection once */
4049                if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
4050                        ieee80211_queue_work(&sdata->local->hw,
4051                                             &sdata->u.mgd.monitor_work);
4052        }
4053}
4054
4055#ifdef CONFIG_PM
4056void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
4057{
4058        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4059        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4060
4061        sdata_lock(sdata);
4062
4063        if (ifmgd->auth_data || ifmgd->assoc_data) {
4064                const u8 *bssid = ifmgd->auth_data ?
4065                                ifmgd->auth_data->bss->bssid :
4066                                ifmgd->assoc_data->bss->bssid;
4067
4068                /*
4069                 * If we are trying to authenticate / associate while suspending,
4070                 * cfg80211 won't know and won't actually abort those attempts,
4071                 * thus we need to do that ourselves.
4072                 */
4073                ieee80211_send_deauth_disassoc(sdata, bssid,
4074                                               IEEE80211_STYPE_DEAUTH,
4075                                               WLAN_REASON_DEAUTH_LEAVING,
4076                                               false, frame_buf);
4077                if (ifmgd->assoc_data)
4078                        ieee80211_destroy_assoc_data(sdata, false, true);
4079                if (ifmgd->auth_data)
4080                        ieee80211_destroy_auth_data(sdata, false);
4081                cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4082                                      IEEE80211_DEAUTH_FRAME_LEN);
4083        }
4084
4085        /* This is a bit of a hack - we should find a better and more generic
4086         * solution to this. Normally when suspending, cfg80211 will in fact
4087         * deauthenticate. However, it doesn't (and cannot) stop an ongoing
4088         * auth (not so important) or assoc (this is the problem) process.
4089         *
4090         * As a consequence, it can happen that we are in the process of both
4091         * associating and suspending, and receive an association response
4092         * after cfg80211 has checked if it needs to disconnect, but before
4093         * we actually set the flag to drop incoming frames. This will then
4094         * cause the workqueue flush to process the association response in
4095         * the suspend, resulting in a successful association just before it
4096         * tries to remove the interface from the driver, which now though
4097         * has a channel context assigned ... this results in issues.
4098         *
4099         * To work around this (for now) simply deauth here again if we're
4100         * now connected.
4101         */
4102        if (ifmgd->associated && !sdata->local->wowlan) {
4103                u8 bssid[ETH_ALEN];
4104                struct cfg80211_deauth_request req = {
4105                        .reason_code = WLAN_REASON_DEAUTH_LEAVING,
4106                        .bssid = bssid,
4107                };
4108
4109                memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
4110                ieee80211_mgd_deauth(sdata, &req);
4111        }
4112
4113        sdata_unlock(sdata);
4114}
4115
4116void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
4117{
4118        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4119
4120        sdata_lock(sdata);
4121        if (!ifmgd->associated) {
4122                sdata_unlock(sdata);
4123                return;
4124        }
4125
4126        if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
4127                sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
4128                mlme_dbg(sdata, "driver requested disconnect after resume\n");
4129                ieee80211_sta_connection_lost(sdata,
4130                                              ifmgd->associated->bssid,
4131                                              WLAN_REASON_UNSPECIFIED,
4132                                              true);
4133                sdata_unlock(sdata);
4134                return;
4135        }
4136        sdata_unlock(sdata);
4137}
4138#endif
4139
4140/* interface setup */
4141void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4142{
4143        struct ieee80211_if_managed *ifmgd;
4144
4145        ifmgd = &sdata->u.mgd;
4146        INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4147        INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4148        INIT_WORK(&ifmgd->beacon_connection_loss_work,
4149                  ieee80211_beacon_connection_loss_work);
4150        INIT_WORK(&ifmgd->csa_connection_drop_work,
4151                  ieee80211_csa_connection_drop_work);
4152        INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4153        INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
4154                          ieee80211_tdls_peer_del_work);
4155        setup_timer(&ifmgd->timer, ieee80211_sta_timer,
4156                    (unsigned long) sdata);
4157        setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
4158                    (unsigned long) sdata);
4159        setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
4160                    (unsigned long) sdata);
4161        setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
4162                    (unsigned long) sdata);
4163        INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
4164                          ieee80211_sta_handle_tspec_ac_params_wk);
4165
4166        ifmgd->flags = 0;
4167        ifmgd->powersave = sdata->wdev.ps;
4168        ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
4169        ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
4170        ifmgd->p2p_noa_index = -1;
4171
4172        if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4173                ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
4174        else
4175                ifmgd->req_smps = IEEE80211_SMPS_OFF;
4176
4177        /* Setup TDLS data */
4178        spin_lock_init(&ifmgd->teardown_lock);
4179        ifmgd->teardown_skb = NULL;
4180        ifmgd->orig_teardown_skb = NULL;
4181}
4182
4183/* scan finished notification */
4184void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
4185{
4186        struct ieee80211_sub_if_data *sdata;
4187
4188        /* Restart STA timers */
4189        rcu_read_lock();
4190        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4191                if (ieee80211_sdata_running(sdata))
4192                        ieee80211_restart_sta_timer(sdata);
4193        }
4194        rcu_read_unlock();
4195}
4196
4197static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
4198                                     struct cfg80211_bss *cbss)
4199{
4200        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4201        const u8 *ht_cap_ie, *vht_cap_ie;
4202        const struct ieee80211_ht_cap *ht_cap;
4203        const struct ieee80211_vht_cap *vht_cap;
4204        u8 chains = 1;
4205
4206        if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
4207                return chains;
4208
4209        ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
4210        if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
4211                ht_cap = (void *)(ht_cap_ie + 2);
4212                chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
4213                /*
4214                 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
4215                 *       "Tx Unequal Modulation Supported" fields.
4216                 */
4217        }
4218
4219        if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
4220                return chains;
4221
4222        vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
4223        if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
4224                u8 nss;
4225                u16 tx_mcs_map;
4226
4227                vht_cap = (void *)(vht_cap_ie + 2);
4228                tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
4229                for (nss = 8; nss > 0; nss--) {
4230                        if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
4231                                        IEEE80211_VHT_MCS_NOT_SUPPORTED)
4232                                break;
4233                }
4234                /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
4235                chains = max(chains, nss);
4236        }
4237
4238        return chains;
4239}
4240
4241static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
4242                                  struct cfg80211_bss *cbss)
4243{
4244        struct ieee80211_local *local = sdata->local;
4245        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4246        const struct ieee80211_ht_cap *ht_cap = NULL;
4247        const struct ieee80211_ht_operation *ht_oper = NULL;
4248        const struct ieee80211_vht_operation *vht_oper = NULL;
4249        struct ieee80211_supported_band *sband;
4250        struct cfg80211_chan_def chandef;
4251        int ret;
4252        u32 i;
4253        bool have_80mhz;
4254
4255        sband = local->hw.wiphy->bands[cbss->channel->band];
4256
4257        ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
4258                          IEEE80211_STA_DISABLE_80P80MHZ |
4259                          IEEE80211_STA_DISABLE_160MHZ);
4260
4261        rcu_read_lock();
4262
4263        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
4264            sband->ht_cap.ht_supported) {
4265                const u8 *ht_oper_ie, *ht_cap_ie;
4266
4267                ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4268                if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
4269                        ht_oper = (void *)(ht_oper_ie + 2);
4270
4271                ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
4272                if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
4273                        ht_cap = (void *)(ht_cap_ie + 2);
4274
4275                if (!ht_cap) {
4276                        ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4277                        ht_oper = NULL;
4278                }
4279        }
4280
4281        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
4282            sband->vht_cap.vht_supported) {
4283                const u8 *vht_oper_ie, *vht_cap;
4284
4285                vht_oper_ie = ieee80211_bss_get_ie(cbss,
4286                                                   WLAN_EID_VHT_OPERATION);
4287                if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
4288                        vht_oper = (void *)(vht_oper_ie + 2);
4289                if (vht_oper && !ht_oper) {
4290                        vht_oper = NULL;
4291                        sdata_info(sdata,
4292                                   "AP advertised VHT without HT, disabling both\n");
4293                        ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4294                        ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4295                }
4296
4297                vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
4298                if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
4299                        ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4300                        vht_oper = NULL;
4301                }
4302        }
4303
4304        /* Allow VHT if at least one channel on the sband supports 80 MHz */
4305        have_80mhz = false;
4306        for (i = 0; i < sband->n_channels; i++) {
4307                if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
4308                                                IEEE80211_CHAN_NO_80MHZ))
4309                        continue;
4310
4311                have_80mhz = true;
4312                break;
4313        }
4314
4315        if (!have_80mhz)
4316                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4317
4318        ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
4319                                                     cbss->channel,
4320                                                     ht_cap, ht_oper, vht_oper,
4321                                                     &chandef, false);
4322
4323        sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
4324                                      local->rx_chains);
4325
4326        rcu_read_unlock();
4327
4328        /* will change later if needed */
4329        sdata->smps_mode = IEEE80211_SMPS_OFF;
4330
4331        mutex_lock(&local->mtx);
4332        /*
4333         * If this fails (possibly due to channel context sharing
4334         * on incompatible channels, e.g. 80+80 and 160 sharing the
4335         * same control channel) try to use a smaller bandwidth.
4336         */
4337        ret = ieee80211_vif_use_channel(sdata, &chandef,
4338                                        IEEE80211_CHANCTX_SHARED);
4339
4340        /* don't downgrade for 5 and 10 MHz channels, though. */
4341        if (chandef.width == NL80211_CHAN_WIDTH_5 ||
4342            chandef.width == NL80211_CHAN_WIDTH_10)
4343                goto out;
4344
4345        while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4346                ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4347                ret = ieee80211_vif_use_channel(sdata, &chandef,
4348                                                IEEE80211_CHANCTX_SHARED);
4349        }
4350 out:
4351        mutex_unlock(&local->mtx);
4352        return ret;
4353}
4354
4355static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
4356                                     struct cfg80211_bss *cbss, bool assoc,
4357                                     bool override)
4358{
4359        struct ieee80211_local *local = sdata->local;
4360        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4361        struct ieee80211_bss *bss = (void *)cbss->priv;
4362        struct sta_info *new_sta = NULL;
4363        struct ieee80211_supported_band *sband;
4364        bool have_sta = false;
4365        int err;
4366
4367        sband = local->hw.wiphy->bands[cbss->channel->band];
4368
4369        if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
4370                return -EINVAL;
4371
4372        /* If a reconfig is happening, bail out */
4373        if (local->in_reconfig)
4374                return -EBUSY;
4375
4376        if (assoc) {
4377                rcu_read_lock();
4378                have_sta = sta_info_get(sdata, cbss->bssid);
4379                rcu_read_unlock();
4380        }
4381
4382        if (!have_sta) {
4383                new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
4384                if (!new_sta)
4385                        return -ENOMEM;
4386        }
4387
4388        /*
4389         * Set up the information for the new channel before setting the
4390         * new channel. We can't - completely race-free - change the basic
4391         * rates bitmap and the channel (sband) that it refers to, but if
4392         * we set it up before we at least avoid calling into the driver's
4393         * bss_info_changed() method with invalid information (since we do
4394         * call that from changing the channel - only for IDLE and perhaps
4395         * some others, but ...).
4396         *
4397         * So to avoid that, just set up all the new information before the
4398         * channel, but tell the driver to apply it only afterwards, since
4399         * it might need the new channel for that.
4400         */
4401        if (new_sta) {
4402                u32 rates = 0, basic_rates = 0;
4403                bool have_higher_than_11mbit;
4404                int min_rate = INT_MAX, min_rate_index = -1;
4405                const struct cfg80211_bss_ies *ies;
4406                int shift = ieee80211_vif_get_shift(&sdata->vif);
4407
4408                ieee80211_get_rates(sband, bss->supp_rates,
4409                                    bss->supp_rates_len,
4410                                    &rates, &basic_rates,
4411                                    &have_higher_than_11mbit,
4412                                    &min_rate, &min_rate_index,
4413                                    shift);
4414
4415                /*
4416                 * This used to be a workaround for basic rates missing
4417                 * in the association response frame. Now that we no
4418                 * longer use the basic rates from there, it probably
4419                 * doesn't happen any more, but keep the workaround so
4420                 * in case some *other* APs are buggy in different ways
4421                 * we can connect -- with a warning.
4422                 */
4423                if (!basic_rates && min_rate_index >= 0) {
4424                        sdata_info(sdata,
4425                                   "No basic rates, using min rate instead\n");
4426                        basic_rates = BIT(min_rate_index);
4427                }
4428
4429                new_sta->sta.supp_rates[cbss->channel->band] = rates;
4430                sdata->vif.bss_conf.basic_rates = basic_rates;
4431
4432                /* cf. IEEE 802.11 9.2.12 */
4433                if (cbss->channel->band == NL80211_BAND_2GHZ &&
4434                    have_higher_than_11mbit)
4435                        sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
4436                else
4437                        sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
4438
4439                memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
4440
4441                /* set timing information */
4442                sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
4443                rcu_read_lock();
4444                ies = rcu_dereference(cbss->beacon_ies);
4445                if (ies) {
4446                        const u8 *tim_ie;
4447
4448                        sdata->vif.bss_conf.sync_tsf = ies->tsf;
4449                        sdata->vif.bss_conf.sync_device_ts =
4450                                bss->device_ts_beacon;
4451                        tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
4452                                                  ies->data, ies->len);
4453                        if (tim_ie && tim_ie[1] >= 2)
4454                                sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
4455                        else
4456                                sdata->vif.bss_conf.sync_dtim_count = 0;
4457                } else if (!ieee80211_hw_check(&sdata->local->hw,
4458                                               TIMING_BEACON_ONLY)) {
4459                        ies = rcu_dereference(cbss->proberesp_ies);
4460                        /* must be non-NULL since beacon IEs were NULL */
4461                        sdata->vif.bss_conf.sync_tsf = ies->tsf;
4462                        sdata->vif.bss_conf.sync_device_ts =
4463                                bss->device_ts_presp;
4464                        sdata->vif.bss_conf.sync_dtim_count = 0;
4465                } else {
4466                        sdata->vif.bss_conf.sync_tsf = 0;
4467                        sdata->vif.bss_conf.sync_device_ts = 0;
4468                        sdata->vif.bss_conf.sync_dtim_count = 0;
4469                }
4470                rcu_read_unlock();
4471        }
4472
4473        if (new_sta || override) {
4474                err = ieee80211_prep_channel(sdata, cbss);
4475                if (err) {
4476                        if (new_sta)
4477                                sta_info_free(local, new_sta);
4478                        return -EINVAL;
4479                }
4480        }
4481
4482        if (new_sta) {
4483                /*
4484                 * tell driver about BSSID, basic rates and timing
4485                 * this was set up above, before setting the channel
4486                 */
4487                ieee80211_bss_info_change_notify(sdata,
4488                        BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
4489                        BSS_CHANGED_BEACON_INT);
4490
4491                if (assoc)
4492                        sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
4493
4494                err = sta_info_insert(new_sta);
4495                new_sta = NULL;
4496                if (err) {
4497                        sdata_info(sdata,
4498                                   "failed to insert STA entry for the AP (error %d)\n",
4499                                   err);
4500                        return err;
4501                }
4502        } else
4503                WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4504
4505        /* Cancel scan to ensure that nothing interferes with connection */
4506        if (local->scanning)
4507                ieee80211_scan_cancel(local);
4508
4509        return 0;
4510}
4511
4512/* config hooks */
4513int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
4514                       struct cfg80211_auth_request *req)
4515{
4516        struct ieee80211_local *local = sdata->local;
4517        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4518        struct ieee80211_mgd_auth_data *auth_data;
4519        u16 auth_alg;
4520        int err;
4521
4522        /* prepare auth data structure */
4523
4524        switch (req->auth_type) {
4525        case NL80211_AUTHTYPE_OPEN_SYSTEM:
4526                auth_alg = WLAN_AUTH_OPEN;
4527                break;
4528        case NL80211_AUTHTYPE_SHARED_KEY:
4529                if (IS_ERR(local->wep_tx_tfm))
4530                        return -EOPNOTSUPP;
4531                auth_alg = WLAN_AUTH_SHARED_KEY;
4532                break;
4533        case NL80211_AUTHTYPE_FT:
4534                auth_alg = WLAN_AUTH_FT;
4535                break;
4536        case NL80211_AUTHTYPE_NETWORK_EAP:
4537                auth_alg = WLAN_AUTH_LEAP;
4538                break;
4539        case NL80211_AUTHTYPE_SAE:
4540                auth_alg = WLAN_AUTH_SAE;
4541                break;
4542        case NL80211_AUTHTYPE_FILS_SK:
4543                auth_alg = WLAN_AUTH_FILS_SK;
4544                break;
4545        case NL80211_AUTHTYPE_FILS_SK_PFS:
4546                auth_alg = WLAN_AUTH_FILS_SK_PFS;
4547                break;
4548        case NL80211_AUTHTYPE_FILS_PK:
4549                auth_alg = WLAN_AUTH_FILS_PK;
4550                break;
4551        default:
4552                return -EOPNOTSUPP;
4553        }
4554
4555        auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
4556                            req->ie_len, GFP_KERNEL);
4557        if (!auth_data)
4558                return -ENOMEM;
4559
4560        auth_data->bss = req->bss;
4561
4562        if (req->auth_data_len >= 4) {
4563                if (req->auth_type == NL80211_AUTHTYPE_SAE) {
4564                        __le16 *pos = (__le16 *) req->auth_data;
4565
4566                        auth_data->sae_trans = le16_to_cpu(pos[0]);
4567                        auth_data->sae_status = le16_to_cpu(pos[1]);
4568                }
4569                memcpy(auth_data->data, req->auth_data + 4,
4570                       req->auth_data_len - 4);
4571                auth_data->data_len += req->auth_data_len - 4;
4572        }
4573
4574        if (req->ie && req->ie_len) {
4575                memcpy(&auth_data->data[auth_data->data_len],
4576                       req->ie, req->ie_len);
4577                auth_data->data_len += req->ie_len;
4578        }
4579
4580        if (req->key && req->key_len) {
4581                auth_data->key_len = req->key_len;
4582                auth_data->key_idx = req->key_idx;
4583                memcpy(auth_data->key, req->key, req->key_len);
4584        }
4585
4586        auth_data->algorithm = auth_alg;
4587
4588        /* try to authenticate/probe */
4589
4590        if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
4591            ifmgd->assoc_data) {
4592                err = -EBUSY;
4593                goto err_free;
4594        }
4595
4596        if (ifmgd->auth_data)
4597                ieee80211_destroy_auth_data(sdata, false);
4598
4599        /* prep auth_data so we don't go into idle on disassoc */
4600        ifmgd->auth_data = auth_data;
4601
4602        if (ifmgd->associated) {
4603                u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4604
4605                sdata_info(sdata,
4606                           "disconnect from AP %pM for new auth to %pM\n",
4607                           ifmgd->associated->bssid, req->bss->bssid);
4608                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4609                                       WLAN_REASON_UNSPECIFIED,
4610                                       false, frame_buf);
4611
4612                ieee80211_report_disconnect(sdata, frame_buf,
4613                                            sizeof(frame_buf), true,
4614                                            WLAN_REASON_UNSPECIFIED);
4615        }
4616
4617        sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4618
4619        err = ieee80211_prep_connection(sdata, req->bss, false, false);
4620        if (err)
4621                goto err_clear;
4622
4623        err = ieee80211_auth(sdata);
4624        if (err) {
4625                sta_info_destroy_addr(sdata, req->bss->bssid);
4626                goto err_clear;
4627        }
4628
4629        /* hold our own reference */
4630        cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4631        return 0;
4632
4633 err_clear:
4634        eth_zero_addr(ifmgd->bssid);
4635        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4636        ifmgd->auth_data = NULL;
4637        mutex_lock(&sdata->local->mtx);
4638        ieee80211_vif_release_channel(sdata);
4639        mutex_unlock(&sdata->local->mtx);
4640 err_free:
4641        kfree(auth_data);
4642        return err;
4643}
4644
4645int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
4646                        struct cfg80211_assoc_request *req)
4647{
4648        struct ieee80211_local *local = sdata->local;
4649        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4650        struct ieee80211_bss *bss = (void *)req->bss->priv;
4651        struct ieee80211_mgd_assoc_data *assoc_data;
4652        const struct cfg80211_bss_ies *beacon_ies;
4653        struct ieee80211_supported_band *sband;
4654        const u8 *ssidie, *ht_ie, *vht_ie;
4655        int i, err;
4656        bool override = false;
4657
4658        assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
4659        if (!assoc_data)
4660                return -ENOMEM;
4661
4662        rcu_read_lock();
4663        ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
4664        if (!ssidie) {
4665                rcu_read_unlock();
4666                kfree(assoc_data);
4667                return -EINVAL;
4668        }
4669        memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
4670        assoc_data->ssid_len = ssidie[1];
4671        rcu_read_unlock();
4672
4673        if (ifmgd->associated) {
4674                u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4675
4676                sdata_info(sdata,
4677                           "disconnect from AP %pM for new assoc to %pM\n",
4678                           ifmgd->associated->bssid, req->bss->bssid);
4679                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4680                                       WLAN_REASON_UNSPECIFIED,
4681                                       false, frame_buf);
4682
4683                ieee80211_report_disconnect(sdata, frame_buf,
4684                                            sizeof(frame_buf), true,
4685                                            WLAN_REASON_UNSPECIFIED);
4686        }
4687
4688        if (ifmgd->auth_data && !ifmgd->auth_data->done) {
4689                err = -EBUSY;
4690                goto err_free;
4691        }
4692
4693        if (ifmgd->assoc_data) {
4694                err = -EBUSY;
4695                goto err_free;
4696        }
4697
4698        if (ifmgd->auth_data) {
4699                bool match;
4700
4701                /* keep sta info, bssid if matching */
4702                match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
4703                ieee80211_destroy_auth_data(sdata, match);
4704        }
4705
4706        /* prepare assoc data */
4707
4708        ifmgd->beacon_crc_valid = false;
4709
4710        assoc_data->wmm = bss->wmm_used &&
4711                          (local->hw.queues >= IEEE80211_NUM_ACS);
4712
4713        /*
4714         * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
4715         * We still associate in non-HT mode (11a/b/g) if any one of these
4716         * ciphers is configured as pairwise.
4717         * We can set this to true for non-11n hardware, that'll be checked
4718         * separately along with the peer capabilities.
4719         */
4720        for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4721                if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
4722                    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4723                    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4724                        ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4725                        ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4726                        netdev_info(sdata->dev,
4727                                    "disabling HT/VHT due to WEP/TKIP use\n");
4728                }
4729        }
4730
4731        /* Also disable HT if we don't support it or the AP doesn't use WMM */
4732        sband = local->hw.wiphy->bands[req->bss->channel->band];
4733        if (!sband->ht_cap.ht_supported ||
4734            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
4735            ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4736                ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4737                if (!bss->wmm_used &&
4738                    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4739                        netdev_info(sdata->dev,
4740                                    "disabling HT as WMM/QoS is not supported by the AP\n");
4741        }
4742
4743        /* disable VHT if we don't support it or the AP doesn't use WMM */
4744        if (!sband->vht_cap.vht_supported ||
4745            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
4746            ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4747                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4748                if (!bss->wmm_used &&
4749                    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4750                        netdev_info(sdata->dev,
4751                                    "disabling VHT as WMM/QoS is not supported by the AP\n");
4752        }
4753
4754        memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
4755        memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
4756               sizeof(ifmgd->ht_capa_mask));
4757
4758        memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
4759        memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
4760               sizeof(ifmgd->vht_capa_mask));
4761
4762        if (req->ie && req->ie_len) {
4763                memcpy(assoc_data->ie, req->ie, req->ie_len);
4764                assoc_data->ie_len = req->ie_len;
4765        }
4766
4767        if (req->fils_kek) {
4768                /* should already be checked in cfg80211 - so warn */
4769                if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
4770                        err = -EINVAL;
4771                        goto err_free;
4772                }
4773                memcpy(assoc_data->fils_kek, req->fils_kek,
4774                       req->fils_kek_len);
4775                assoc_data->fils_kek_len = req->fils_kek_len;
4776        }
4777
4778        if (req->fils_nonces)
4779                memcpy(assoc_data->fils_nonces, req->fils_nonces,
4780                       2 * FILS_NONCE_LEN);
4781
4782        assoc_data->bss = req->bss;
4783
4784        if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
4785                if (ifmgd->powersave)
4786                        sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
4787                else
4788                        sdata->smps_mode = IEEE80211_SMPS_OFF;
4789        } else
4790                sdata->smps_mode = ifmgd->req_smps;
4791
4792        assoc_data->capability = req->bss->capability;
4793        assoc_data->supp_rates = bss->supp_rates;
4794        assoc_data->supp_rates_len = bss->supp_rates_len;
4795
4796        rcu_read_lock();
4797        ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
4798        if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
4799                assoc_data->ap_ht_param =
4800                        ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
4801        else
4802                ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4803        vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
4804        if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
4805                memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
4806                       sizeof(struct ieee80211_vht_cap));
4807        else
4808                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4809        rcu_read_unlock();
4810
4811        if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
4812                 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
4813             "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
4814                sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
4815
4816        if (bss->wmm_used && bss->uapsd_supported &&
4817            (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
4818                assoc_data->uapsd = true;
4819                ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
4820        } else {
4821                assoc_data->uapsd = false;
4822                ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
4823        }
4824
4825        if (req->prev_bssid)
4826                memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4827
4828        if (req->use_mfp) {
4829                ifmgd->mfp = IEEE80211_MFP_REQUIRED;
4830                ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
4831        } else {
4832                ifmgd->mfp = IEEE80211_MFP_DISABLED;
4833                ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
4834        }
4835
4836        if (req->flags & ASSOC_REQ_USE_RRM)
4837                ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
4838        else
4839                ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
4840
4841        if (req->crypto.control_port)
4842                ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
4843        else
4844                ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
4845
4846        sdata->control_port_protocol = req->crypto.control_port_ethertype;
4847        sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4848        sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
4849                                                        sdata->vif.type);
4850
4851        /* kick off associate process */
4852
4853        ifmgd->assoc_data = assoc_data;
4854        ifmgd->dtim_period = 0;
4855        ifmgd->have_beacon = false;
4856
4857        /* override HT/VHT configuration only if the AP and we support it */
4858        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
4859                struct ieee80211_sta_ht_cap sta_ht_cap;
4860
4861                if (req->flags & ASSOC_REQ_DISABLE_HT)
4862                        override = true;
4863
4864                memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
4865                ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
4866
4867                /* check for 40 MHz disable override */
4868                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
4869                    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
4870                    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
4871                        override = true;
4872
4873                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
4874                    req->flags & ASSOC_REQ_DISABLE_VHT)
4875                        override = true;
4876        }
4877
4878        if (req->flags & ASSOC_REQ_DISABLE_HT) {
4879                ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4880                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4881        }
4882
4883        if (req->flags & ASSOC_REQ_DISABLE_VHT)
4884                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4885
4886        err = ieee80211_prep_connection(sdata, req->bss, true, override);
4887        if (err)
4888                goto err_clear;
4889
4890        rcu_read_lock();
4891        beacon_ies = rcu_dereference(req->bss->beacon_ies);
4892
4893        if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
4894            !beacon_ies) {
4895                /*
4896                 * Wait up to one beacon interval ...
4897                 * should this be more if we miss one?
4898                 */
4899                sdata_info(sdata, "waiting for beacon from %pM\n",
4900                           ifmgd->bssid);
4901                assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4902                assoc_data->timeout_started = true;
4903                assoc_data->need_beacon = true;
4904        } else if (beacon_ies) {
4905                const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
4906                                                    beacon_ies->data,
4907                                                    beacon_ies->len);
4908                u8 dtim_count = 0;
4909
4910                if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
4911                        const struct ieee80211_tim_ie *tim;
4912                        tim = (void *)(tim_ie + 2);
4913                        ifmgd->dtim_period = tim->dtim_period;
4914                        dtim_count = tim->dtim_count;
4915                }
4916                ifmgd->have_beacon = true;
4917                assoc_data->timeout = jiffies;
4918                assoc_data->timeout_started = true;
4919
4920                if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4921                        sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
4922                        sdata->vif.bss_conf.sync_device_ts =
4923                                bss->device_ts_beacon;
4924                        sdata->vif.bss_conf.sync_dtim_count = dtim_count;
4925                }
4926        } else {
4927                assoc_data->timeout = jiffies;
4928                assoc_data->timeout_started = true;
4929        }
4930        rcu_read_unlock();
4931
4932        run_again(sdata, assoc_data->timeout);
4933
4934        if (bss->corrupt_data) {
4935                char *corrupt_type = "data";
4936                if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
4937                        if (bss->corrupt_data &
4938                                        IEEE80211_BSS_CORRUPT_PROBE_RESP)
4939                                corrupt_type = "beacon and probe response";
4940                        else
4941                                corrupt_type = "beacon";
4942                } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
4943                        corrupt_type = "probe response";
4944                sdata_info(sdata, "associating with AP with corrupt %s\n",
4945                           corrupt_type);
4946        }
4947
4948        return 0;
4949 err_clear:
4950        eth_zero_addr(ifmgd->bssid);
4951        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4952        ifmgd->assoc_data = NULL;
4953 err_free:
4954        kfree(assoc_data);
4955        return err;
4956}
4957
4958int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4959                         struct cfg80211_deauth_request *req)
4960{
4961        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4962        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4963        bool tx = !req->local_state_change;
4964
4965        if (ifmgd->auth_data &&
4966            ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
4967                sdata_info(sdata,
4968                           "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
4969                           req->bssid, req->reason_code,
4970                           ieee80211_get_reason_code_string(req->reason_code));
4971
4972                drv_mgd_prepare_tx(sdata->local, sdata);
4973                ieee80211_send_deauth_disassoc(sdata, req->bssid,
4974                                               IEEE80211_STYPE_DEAUTH,
4975                                               req->reason_code, tx,
4976                                               frame_buf);
4977                ieee80211_destroy_auth_data(sdata, false);
4978                ieee80211_report_disconnect(sdata, frame_buf,
4979                                            sizeof(frame_buf), true,
4980                                            req->reason_code);
4981
4982                return 0;
4983        }
4984
4985        if (ifmgd->assoc_data &&
4986            ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) {
4987                sdata_info(sdata,
4988                           "aborting association with %pM by local choice (Reason: %u=%s)\n",
4989                           req->bssid, req->reason_code,
4990                           ieee80211_get_reason_code_string(req->reason_code));
4991
4992                drv_mgd_prepare_tx(sdata->local, sdata);
4993                ieee80211_send_deauth_disassoc(sdata, req->bssid,
4994                                               IEEE80211_STYPE_DEAUTH,
4995                                               req->reason_code, tx,
4996                                               frame_buf);
4997                ieee80211_destroy_assoc_data(sdata, false, true);
4998                ieee80211_report_disconnect(sdata, frame_buf,
4999                                            sizeof(frame_buf), true,
5000                                            req->reason_code);
5001                return 0;
5002        }
5003
5004        if (ifmgd->associated &&
5005            ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
5006                sdata_info(sdata,
5007                           "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
5008                           req->bssid, req->reason_code,
5009                           ieee80211_get_reason_code_string(req->reason_code));
5010
5011                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
5012                                       req->reason_code, tx, frame_buf);
5013                ieee80211_report_disconnect(sdata, frame_buf,
5014                                            sizeof(frame_buf), true,
5015                                            req->reason_code);
5016                return 0;
5017        }
5018
5019        return -ENOTCONN;
5020}
5021
5022int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
5023                           struct cfg80211_disassoc_request *req)
5024{
5025        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5026        u8 bssid[ETH_ALEN];
5027        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5028
5029        /*
5030         * cfg80211 should catch this ... but it's racy since
5031         * we can receive a disassoc frame, process it, hand it
5032         * to cfg80211 while that's in a locked section already
5033         * trying to tell us that the user wants to disconnect.
5034         */
5035        if (ifmgd->associated != req->bss)
5036                return -ENOLINK;
5037
5038        sdata_info(sdata,
5039                   "disassociating from %pM by local choice (Reason: %u=%s)\n",
5040                   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
5041
5042        memcpy(bssid, req->bss->bssid, ETH_ALEN);
5043        ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
5044                               req->reason_code, !req->local_state_change,
5045                               frame_buf);
5046
5047        ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
5048                                    req->reason_code);
5049
5050        return 0;
5051}
5052
5053void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
5054{
5055        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5056
5057        /*
5058         * Make sure some work items will not run after this,
5059         * they will not do anything but might not have been
5060         * cancelled when disconnecting.
5061         */
5062        cancel_work_sync(&ifmgd->monitor_work);
5063        cancel_work_sync(&ifmgd->beacon_connection_loss_work);
5064        cancel_work_sync(&ifmgd->request_smps_work);
5065        cancel_work_sync(&ifmgd->csa_connection_drop_work);
5066        cancel_work_sync(&ifmgd->chswitch_work);
5067        cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5068
5069        sdata_lock(sdata);
5070        if (ifmgd->assoc_data) {
5071                struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5072                ieee80211_destroy_assoc_data(sdata, false, false);
5073                cfg80211_assoc_timeout(sdata->dev, bss);
5074        }
5075        if (ifmgd->auth_data)
5076                ieee80211_destroy_auth_data(sdata, false);
5077        spin_lock_bh(&ifmgd->teardown_lock);
5078        if (ifmgd->teardown_skb) {
5079                kfree_skb(ifmgd->teardown_skb);
5080                ifmgd->teardown_skb = NULL;
5081                ifmgd->orig_teardown_skb = NULL;
5082        }
5083        spin_unlock_bh(&ifmgd->teardown_lock);
5084        del_timer_sync(&ifmgd->timer);
5085        sdata_unlock(sdata);
5086}
5087
5088void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
5089                               enum nl80211_cqm_rssi_threshold_event rssi_event,
5090                               s32 rssi_level,
5091                               gfp_t gfp)
5092{
5093        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
5094
5095        trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
5096
5097        cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
5098}
5099EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
5100
5101void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
5102{
5103        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
5104
5105        trace_api_cqm_beacon_loss_notify(sdata->local, sdata);
5106
5107        cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
5108}
5109EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);
5110