Merge tag 'mac80211-for-davem-2018-09-03' of git://git.kernel.org/pub/scm/linux/kerne...
[muen/linux.git] / net / mac80211 / mlme.c
1 /*
2  * BSS client mode implementation
3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4  * Copyright 2004, Instant802 Networks, Inc.
5  * Copyright 2005, Devicescape Software, Inc.
6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8  * Copyright 2013-2014  Intel Mobile Communications GmbH
9  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
10  * Copyright (C) 2018        Intel Corporation
11  *
12  * This program is free software; you can redistribute it and/or modify
13  * it under the terms of the GNU General Public License version 2 as
14  * published by the Free Software Foundation.
15  */
16
17 #include <linux/delay.h>
18 #include <linux/if_ether.h>
19 #include <linux/skbuff.h>
20 #include <linux/if_arp.h>
21 #include <linux/etherdevice.h>
22 #include <linux/moduleparam.h>
23 #include <linux/rtnetlink.h>
24 #include <linux/crc32.h>
25 #include <linux/slab.h>
26 #include <linux/export.h>
27 #include <net/mac80211.h>
28 #include <asm/unaligned.h>
29
30 #include "ieee80211_i.h"
31 #include "driver-ops.h"
32 #include "rate.h"
33 #include "led.h"
34 #include "fils_aead.h"
35
36 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
37 #define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
38 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
39 #define IEEE80211_AUTH_TIMEOUT_SAE      (HZ * 2)
40 #define IEEE80211_AUTH_MAX_TRIES        3
41 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
42 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
43 #define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
44 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
45 #define IEEE80211_ASSOC_MAX_TRIES       3
46
47 static int max_nullfunc_tries = 2;
48 module_param(max_nullfunc_tries, int, 0644);
49 MODULE_PARM_DESC(max_nullfunc_tries,
50                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
51
52 static int max_probe_tries = 5;
53 module_param(max_probe_tries, int, 0644);
54 MODULE_PARM_DESC(max_probe_tries,
55                  "Maximum probe tries before disconnecting (reason 4).");
56
57 /*
58  * Beacon loss timeout is calculated as N frames times the
59  * advertised beacon interval.  This may need to be somewhat
60  * higher than what hardware might detect to account for
61  * delays in the host processing frames. But since we also
62  * probe on beacon miss before declaring the connection lost
63  * default to what we want.
64  */
65 static int beacon_loss_count = 7;
66 module_param(beacon_loss_count, int, 0644);
67 MODULE_PARM_DESC(beacon_loss_count,
68                  "Number of beacon intervals before we decide beacon was lost.");
69
70 /*
71  * Time the connection can be idle before we probe
72  * it to see if we can still talk to the AP.
73  */
74 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
75 /*
76  * Time we wait for a probe response after sending
77  * a probe request because of beacon loss or for
78  * checking the connection still works.
79  */
80 static int probe_wait_ms = 500;
81 module_param(probe_wait_ms, int, 0644);
82 MODULE_PARM_DESC(probe_wait_ms,
83                  "Maximum time(ms) to wait for probe response"
84                  " before disconnecting (reason 4).");
85
86 /*
87  * How many Beacon frames need to have been used in average signal strength
88  * before starting to indicate signal change events.
89  */
90 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
91
92 /*
93  * We can have multiple work items (and connection probing)
94  * scheduling this timer, but we need to take care to only
95  * reschedule it when it should fire _earlier_ than it was
96  * asked for before, or if it's not pending right now. This
97  * function ensures that. Note that it then is required to
98  * run this function for all timeouts after the first one
99  * has happened -- the work that runs from this timer will
100  * do that.
101  */
102 static void run_again(struct ieee80211_sub_if_data *sdata,
103                       unsigned long timeout)
104 {
105         sdata_assert_lock(sdata);
106
107         if (!timer_pending(&sdata->u.mgd.timer) ||
108             time_before(timeout, sdata->u.mgd.timer.expires))
109                 mod_timer(&sdata->u.mgd.timer, timeout);
110 }
111
112 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
113 {
114         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
115                 return;
116
117         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
118                 return;
119
120         mod_timer(&sdata->u.mgd.bcn_mon_timer,
121                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
122 }
123
124 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
125 {
126         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
127
128         if (unlikely(!ifmgd->associated))
129                 return;
130
131         if (ifmgd->probe_send_count)
132                 ifmgd->probe_send_count = 0;
133
134         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
135                 return;
136
137         mod_timer(&ifmgd->conn_mon_timer,
138                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
139 }
140
141 static int ecw2cw(int ecw)
142 {
143         return (1 << ecw) - 1;
144 }
145
146 static u32
147 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
148                              struct ieee80211_supported_band *sband,
149                              struct ieee80211_channel *channel,
150                              const struct ieee80211_ht_operation *ht_oper,
151                              const struct ieee80211_vht_operation *vht_oper,
152                              const struct ieee80211_he_operation *he_oper,
153                              struct cfg80211_chan_def *chandef, bool tracking)
154 {
155         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
156         struct cfg80211_chan_def vht_chandef;
157         struct ieee80211_sta_ht_cap sta_ht_cap;
158         u32 ht_cfreq, ret;
159
160         memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
161         ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
162
163         chandef->chan = channel;
164         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
165         chandef->center_freq1 = channel->center_freq;
166         chandef->center_freq2 = 0;
167
168         if (!ht_oper || !sta_ht_cap.ht_supported) {
169                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
170                 goto out;
171         }
172
173         chandef->width = NL80211_CHAN_WIDTH_20;
174
175         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
176                                                   channel->band);
177         /* check that channel matches the right operating channel */
178         if (!tracking && channel->center_freq != ht_cfreq) {
179                 /*
180                  * It's possible that some APs are confused here;
181                  * Netgear WNDR3700 sometimes reports 4 higher than
182                  * the actual channel in association responses, but
183                  * since we look at probe response/beacon data here
184                  * it should be OK.
185                  */
186                 sdata_info(sdata,
187                            "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
188                            channel->center_freq, ht_cfreq,
189                            ht_oper->primary_chan, channel->band);
190                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
191                 goto out;
192         }
193
194         /* check 40 MHz support, if we have it */
195         if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
196                 ieee80211_chandef_ht_oper(ht_oper, chandef);
197         } else {
198                 /* 40 MHz (and 80 MHz) must be supported for VHT */
199                 ret = IEEE80211_STA_DISABLE_VHT;
200                 /* also mark 40 MHz disabled */
201                 ret |= IEEE80211_STA_DISABLE_40MHZ;
202                 goto out;
203         }
204
205         if (!vht_oper || !sband->vht_cap.vht_supported) {
206                 ret = IEEE80211_STA_DISABLE_VHT;
207                 goto out;
208         }
209
210         vht_chandef = *chandef;
211         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && he_oper &&
212             (le32_to_cpu(he_oper->he_oper_params) &
213              IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
214                 struct ieee80211_vht_operation he_oper_vht_cap;
215
216                 /*
217                  * Set only first 3 bytes (other 2 aren't used in
218                  * ieee80211_chandef_vht_oper() anyway)
219                  */
220                 memcpy(&he_oper_vht_cap, he_oper->optional, 3);
221                 he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);
222
223                 if (!ieee80211_chandef_vht_oper(&he_oper_vht_cap,
224                                                 &vht_chandef)) {
225                         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
226                                 sdata_info(sdata,
227                                            "HE AP VHT information is invalid, disable HE\n");
228                         ret = IEEE80211_STA_DISABLE_HE;
229                         goto out;
230                 }
231         } else if (!ieee80211_chandef_vht_oper(vht_oper, &vht_chandef)) {
232                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
233                         sdata_info(sdata,
234                                    "AP VHT information is invalid, disable VHT\n");
235                 ret = IEEE80211_STA_DISABLE_VHT;
236                 goto out;
237         }
238
239         if (!cfg80211_chandef_valid(&vht_chandef)) {
240                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
241                         sdata_info(sdata,
242                                    "AP VHT information is invalid, disable VHT\n");
243                 ret = IEEE80211_STA_DISABLE_VHT;
244                 goto out;
245         }
246
247         if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
248                 ret = 0;
249                 goto out;
250         }
251
252         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
253                 if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
254                         sdata_info(sdata,
255                                    "AP VHT information doesn't match HT, disable VHT\n");
256                 ret = IEEE80211_STA_DISABLE_VHT;
257                 goto out;
258         }
259
260         *chandef = vht_chandef;
261
262         ret = 0;
263
264 out:
265         /*
266          * When tracking the current AP, don't do any further checks if the
267          * new chandef is identical to the one we're currently using for the
268          * connection. This keeps us from playing ping-pong with regulatory,
269          * without it the following can happen (for example):
270          *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
271          *  - AP advertises regdom US
272          *  - CRDA loads regdom US with 80 MHz prohibited (old database)
273          *  - the code below detects an unsupported channel, downgrades, and
274          *    we disconnect from the AP in the caller
275          *  - disconnect causes CRDA to reload world regdomain and the game
276          *    starts anew.
277          * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
278          *
279          * It seems possible that there are still scenarios with CSA or real
280          * bandwidth changes where a this could happen, but those cases are
281          * less common and wouldn't completely prevent using the AP.
282          */
283         if (tracking &&
284             cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
285                 return ret;
286
287         /* don't print the message below for VHT mismatch if VHT is disabled */
288         if (ret & IEEE80211_STA_DISABLE_VHT)
289                 vht_chandef = *chandef;
290
291         /*
292          * Ignore the DISABLED flag when we're already connected and only
293          * tracking the APs beacon for bandwidth changes - otherwise we
294          * might get disconnected here if we connect to an AP, update our
295          * regulatory information based on the AP's country IE and the
296          * information we have is wrong/outdated and disables the channel
297          * that we're actually using for the connection to the AP.
298          */
299         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
300                                         tracking ? 0 :
301                                                    IEEE80211_CHAN_DISABLED)) {
302                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
303                         ret = IEEE80211_STA_DISABLE_HT |
304                               IEEE80211_STA_DISABLE_VHT;
305                         break;
306                 }
307
308                 ret |= ieee80211_chandef_downgrade(chandef);
309         }
310
311         if (chandef->width != vht_chandef.width && !tracking)
312                 sdata_info(sdata,
313                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
314
315         WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
316         return ret;
317 }
318
319 static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
320                                struct sta_info *sta,
321                                const struct ieee80211_ht_cap *ht_cap,
322                                const struct ieee80211_ht_operation *ht_oper,
323                                const struct ieee80211_vht_operation *vht_oper,
324                                const struct ieee80211_he_operation *he_oper,
325                                const u8 *bssid, u32 *changed)
326 {
327         struct ieee80211_local *local = sdata->local;
328         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
329         struct ieee80211_channel *chan = sdata->vif.bss_conf.chandef.chan;
330         struct ieee80211_supported_band *sband =
331                 local->hw.wiphy->bands[chan->band];
332         struct cfg80211_chan_def chandef;
333         u16 ht_opmode;
334         u32 flags;
335         enum ieee80211_sta_rx_bandwidth new_sta_bw;
336         int ret;
337
338         /* if HT was/is disabled, don't track any bandwidth changes */
339         if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
340                 return 0;
341
342         /* don't check VHT if we associated as non-VHT station */
343         if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
344                 vht_oper = NULL;
345
346         /* don't check HE if we associated as non-HE station */
347         if (ifmgd->flags & IEEE80211_STA_DISABLE_HE ||
348             !ieee80211_get_he_sta_cap(sband))
349                 he_oper = NULL;
350
351         if (WARN_ON_ONCE(!sta))
352                 return -EINVAL;
353
354         /*
355          * if bss configuration changed store the new one -
356          * this may be applicable even if channel is identical
357          */
358         ht_opmode = le16_to_cpu(ht_oper->operation_mode);
359         if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
360                 *changed |= BSS_CHANGED_HT;
361                 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
362         }
363
364         /* calculate new channel (type) based on HT/VHT/HE operation IEs */
365         flags = ieee80211_determine_chantype(sdata, sband, chan,
366                                              ht_oper, vht_oper, he_oper,
367                                              &chandef, true);
368
369         /*
370          * Downgrade the new channel if we associated with restricted
371          * capabilities. For example, if we associated as a 20 MHz STA
372          * to a 40 MHz AP (due to regulatory, capabilities or config
373          * reasons) then switching to a 40 MHz channel now won't do us
374          * any good -- we couldn't use it with the AP.
375          */
376         if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
377             chandef.width == NL80211_CHAN_WIDTH_80P80)
378                 flags |= ieee80211_chandef_downgrade(&chandef);
379         if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
380             chandef.width == NL80211_CHAN_WIDTH_160)
381                 flags |= ieee80211_chandef_downgrade(&chandef);
382         if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
383             chandef.width > NL80211_CHAN_WIDTH_20)
384                 flags |= ieee80211_chandef_downgrade(&chandef);
385
386         if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
387                 return 0;
388
389         sdata_info(sdata,
390                    "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
391                    ifmgd->bssid, chandef.chan->center_freq, chandef.width,
392                    chandef.center_freq1, chandef.center_freq2);
393
394         if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
395                                       IEEE80211_STA_DISABLE_VHT |
396                                       IEEE80211_STA_DISABLE_40MHZ |
397                                       IEEE80211_STA_DISABLE_80P80MHZ |
398                                       IEEE80211_STA_DISABLE_160MHZ)) ||
399             !cfg80211_chandef_valid(&chandef)) {
400                 sdata_info(sdata,
401                            "AP %pM changed bandwidth in a way we can't support - disconnect\n",
402                            ifmgd->bssid);
403                 return -EINVAL;
404         }
405
406         switch (chandef.width) {
407         case NL80211_CHAN_WIDTH_20_NOHT:
408         case NL80211_CHAN_WIDTH_20:
409                 new_sta_bw = IEEE80211_STA_RX_BW_20;
410                 break;
411         case NL80211_CHAN_WIDTH_40:
412                 new_sta_bw = IEEE80211_STA_RX_BW_40;
413                 break;
414         case NL80211_CHAN_WIDTH_80:
415                 new_sta_bw = IEEE80211_STA_RX_BW_80;
416                 break;
417         case NL80211_CHAN_WIDTH_80P80:
418         case NL80211_CHAN_WIDTH_160:
419                 new_sta_bw = IEEE80211_STA_RX_BW_160;
420                 break;
421         default:
422                 return -EINVAL;
423         }
424
425         if (new_sta_bw > sta->cur_max_bandwidth)
426                 new_sta_bw = sta->cur_max_bandwidth;
427
428         if (new_sta_bw < sta->sta.bandwidth) {
429                 sta->sta.bandwidth = new_sta_bw;
430                 rate_control_rate_update(local, sband, sta,
431                                          IEEE80211_RC_BW_CHANGED);
432         }
433
434         ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
435         if (ret) {
436                 sdata_info(sdata,
437                            "AP %pM changed bandwidth to incompatible one - disconnect\n",
438                            ifmgd->bssid);
439                 return ret;
440         }
441
442         if (new_sta_bw > sta->sta.bandwidth) {
443                 sta->sta.bandwidth = new_sta_bw;
444                 rate_control_rate_update(local, sband, sta,
445                                          IEEE80211_RC_BW_CHANGED);
446         }
447
448         return 0;
449 }
450
451 /* frame sending functions */
452
453 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
454                                 struct sk_buff *skb, u8 ap_ht_param,
455                                 struct ieee80211_supported_band *sband,
456                                 struct ieee80211_channel *channel,
457                                 enum ieee80211_smps_mode smps)
458 {
459         u8 *pos;
460         u32 flags = channel->flags;
461         u16 cap;
462         struct ieee80211_sta_ht_cap ht_cap;
463
464         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
465
466         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
467         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
468
469         /* determine capability flags */
470         cap = ht_cap.cap;
471
472         switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
473         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
474                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
475                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
476                         cap &= ~IEEE80211_HT_CAP_SGI_40;
477                 }
478                 break;
479         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
480                 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
481                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
482                         cap &= ~IEEE80211_HT_CAP_SGI_40;
483                 }
484                 break;
485         }
486
487         /*
488          * If 40 MHz was disabled associate as though we weren't
489          * capable of 40 MHz -- some broken APs will never fall
490          * back to trying to transmit in 20 MHz.
491          */
492         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
493                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
494                 cap &= ~IEEE80211_HT_CAP_SGI_40;
495         }
496
497         /* set SM PS mode properly */
498         cap &= ~IEEE80211_HT_CAP_SM_PS;
499         switch (smps) {
500         case IEEE80211_SMPS_AUTOMATIC:
501         case IEEE80211_SMPS_NUM_MODES:
502                 WARN_ON(1);
503                 /* fall through */
504         case IEEE80211_SMPS_OFF:
505                 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
506                         IEEE80211_HT_CAP_SM_PS_SHIFT;
507                 break;
508         case IEEE80211_SMPS_STATIC:
509                 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
510                         IEEE80211_HT_CAP_SM_PS_SHIFT;
511                 break;
512         case IEEE80211_SMPS_DYNAMIC:
513                 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
514                         IEEE80211_HT_CAP_SM_PS_SHIFT;
515                 break;
516         }
517
518         /* reserve and fill IE */
519         pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
520         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
521 }
522
523 /* This function determines vht capability flags for the association
524  * and builds the IE.
525  * Note - the function may set the owner of the MU-MIMO capability
526  */
527 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
528                                  struct sk_buff *skb,
529                                  struct ieee80211_supported_band *sband,
530                                  struct ieee80211_vht_cap *ap_vht_cap)
531 {
532         struct ieee80211_local *local = sdata->local;
533         u8 *pos;
534         u32 cap;
535         struct ieee80211_sta_vht_cap vht_cap;
536         u32 mask, ap_bf_sts, our_bf_sts;
537
538         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
539
540         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
541         ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
542
543         /* determine capability flags */
544         cap = vht_cap.cap;
545
546         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
547                 u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
548
549                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
550                 if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
551                     bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
552                         cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
553         }
554
555         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
556                 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
557                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
558         }
559
560         /*
561          * Some APs apparently get confused if our capabilities are better
562          * than theirs, so restrict what we advertise in the assoc request.
563          */
564         if (!(ap_vht_cap->vht_cap_info &
565                         cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
566                 cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
567                          IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
568         else if (!(ap_vht_cap->vht_cap_info &
569                         cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
570                 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
571
572         /*
573          * If some other vif is using the MU-MIMO capablity we cannot associate
574          * using MU-MIMO - this will lead to contradictions in the group-id
575          * mechanism.
576          * Ownership is defined since association request, in order to avoid
577          * simultaneous associations with MU-MIMO.
578          */
579         if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
580                 bool disable_mu_mimo = false;
581                 struct ieee80211_sub_if_data *other;
582
583                 list_for_each_entry_rcu(other, &local->interfaces, list) {
584                         if (other->vif.mu_mimo_owner) {
585                                 disable_mu_mimo = true;
586                                 break;
587                         }
588                 }
589                 if (disable_mu_mimo)
590                         cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
591                 else
592                         sdata->vif.mu_mimo_owner = true;
593         }
594
595         mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
596
597         ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
598         our_bf_sts = cap & mask;
599
600         if (ap_bf_sts < our_bf_sts) {
601                 cap &= ~mask;
602                 cap |= ap_bf_sts;
603         }
604
605         /* reserve and fill IE */
606         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
607         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
608 }
609
610 /* This function determines HE capability flags for the association
611  * and builds the IE.
612  */
613 static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
614                                 struct sk_buff *skb,
615                                 struct ieee80211_supported_band *sband)
616 {
617         u8 *pos;
618         const struct ieee80211_sta_he_cap *he_cap = NULL;
619         u8 he_cap_size;
620
621         he_cap = ieee80211_get_he_sta_cap(sband);
622         if (!he_cap)
623                 return;
624
625         /*
626          * TODO: the 1 added is because this temporarily is under the EXTENSION
627          * IE. Get rid of it when it moves.
628          */
629         he_cap_size =
630                 2 + 1 + sizeof(he_cap->he_cap_elem) +
631                 ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
632                 ieee80211_he_ppe_size(he_cap->ppe_thres[0],
633                                       he_cap->he_cap_elem.phy_cap_info);
634         pos = skb_put(skb, he_cap_size);
635         ieee80211_ie_build_he_cap(pos, he_cap, pos + he_cap_size);
636 }
637
638 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
639 {
640         struct ieee80211_local *local = sdata->local;
641         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
642         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
643         struct sk_buff *skb;
644         struct ieee80211_mgmt *mgmt;
645         u8 *pos, qos_info;
646         size_t offset = 0, noffset;
647         int i, count, rates_len, supp_rates_len, shift;
648         u16 capab;
649         struct ieee80211_supported_band *sband;
650         struct ieee80211_chanctx_conf *chanctx_conf;
651         struct ieee80211_channel *chan;
652         u32 rates = 0;
653
654         sdata_assert_lock(sdata);
655
656         rcu_read_lock();
657         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
658         if (WARN_ON(!chanctx_conf)) {
659                 rcu_read_unlock();
660                 return;
661         }
662         chan = chanctx_conf->def.chan;
663         rcu_read_unlock();
664         sband = local->hw.wiphy->bands[chan->band];
665         shift = ieee80211_vif_get_shift(&sdata->vif);
666
667         if (assoc_data->supp_rates_len) {
668                 /*
669                  * Get all rates supported by the device and the AP as
670                  * some APs don't like getting a superset of their rates
671                  * in the association request (e.g. D-Link DAP 1353 in
672                  * b-only mode)...
673                  */
674                 rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
675                                                      assoc_data->supp_rates,
676                                                      assoc_data->supp_rates_len,
677                                                      &rates);
678         } else {
679                 /*
680                  * In case AP not provide any supported rates information
681                  * before association, we send information element(s) with
682                  * all rates that we support.
683                  */
684                 rates_len = 0;
685                 for (i = 0; i < sband->n_bitrates; i++) {
686                         rates |= BIT(i);
687                         rates_len++;
688                 }
689         }
690
691         skb = alloc_skb(local->hw.extra_tx_headroom +
692                         sizeof(*mgmt) + /* bit too much but doesn't matter */
693                         2 + assoc_data->ssid_len + /* SSID */
694                         4 + rates_len + /* (extended) rates */
695                         4 + /* power capability */
696                         2 + 2 * sband->n_channels + /* supported channels */
697                         2 + sizeof(struct ieee80211_ht_cap) + /* HT */
698                         2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
699                         2 + 1 + sizeof(struct ieee80211_he_cap_elem) + /* HE */
700                                 sizeof(struct ieee80211_he_mcs_nss_supp) +
701                                 IEEE80211_HE_PPE_THRES_MAX_LEN +
702                         assoc_data->ie_len + /* extra IEs */
703                         (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
704                         9, /* WMM */
705                         GFP_KERNEL);
706         if (!skb)
707                 return;
708
709         skb_reserve(skb, local->hw.extra_tx_headroom);
710
711         capab = WLAN_CAPABILITY_ESS;
712
713         if (sband->band == NL80211_BAND_2GHZ) {
714                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
715                 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
716         }
717
718         if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
719                 capab |= WLAN_CAPABILITY_PRIVACY;
720
721         if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
722             ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
723                 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
724
725         if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
726                 capab |= WLAN_CAPABILITY_RADIO_MEASURE;
727
728         mgmt = skb_put_zero(skb, 24);
729         memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
730         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
731         memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
732
733         if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
734                 skb_put(skb, 10);
735                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
736                                                   IEEE80211_STYPE_REASSOC_REQ);
737                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
738                 mgmt->u.reassoc_req.listen_interval =
739                                 cpu_to_le16(local->hw.conf.listen_interval);
740                 memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
741                        ETH_ALEN);
742         } else {
743                 skb_put(skb, 4);
744                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
745                                                   IEEE80211_STYPE_ASSOC_REQ);
746                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
747                 mgmt->u.assoc_req.listen_interval =
748                                 cpu_to_le16(local->hw.conf.listen_interval);
749         }
750
751         /* SSID */
752         pos = skb_put(skb, 2 + assoc_data->ssid_len);
753         *pos++ = WLAN_EID_SSID;
754         *pos++ = assoc_data->ssid_len;
755         memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
756
757         /* add all rates which were marked to be used above */
758         supp_rates_len = rates_len;
759         if (supp_rates_len > 8)
760                 supp_rates_len = 8;
761
762         pos = skb_put(skb, supp_rates_len + 2);
763         *pos++ = WLAN_EID_SUPP_RATES;
764         *pos++ = supp_rates_len;
765
766         count = 0;
767         for (i = 0; i < sband->n_bitrates; i++) {
768                 if (BIT(i) & rates) {
769                         int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
770                                                 5 * (1 << shift));
771                         *pos++ = (u8) rate;
772                         if (++count == 8)
773                                 break;
774                 }
775         }
776
777         if (rates_len > count) {
778                 pos = skb_put(skb, rates_len - count + 2);
779                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
780                 *pos++ = rates_len - count;
781
782                 for (i++; i < sband->n_bitrates; i++) {
783                         if (BIT(i) & rates) {
784                                 int rate;
785                                 rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
786                                                     5 * (1 << shift));
787                                 *pos++ = (u8) rate;
788                         }
789                 }
790         }
791
792         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
793             capab & WLAN_CAPABILITY_RADIO_MEASURE) {
794                 pos = skb_put(skb, 4);
795                 *pos++ = WLAN_EID_PWR_CAPABILITY;
796                 *pos++ = 2;
797                 *pos++ = 0; /* min tx power */
798                  /* max tx power */
799                 *pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
800         }
801
802         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
803                 /* TODO: get this in reg domain format */
804                 pos = skb_put(skb, 2 * sband->n_channels + 2);
805                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
806                 *pos++ = 2 * sband->n_channels;
807                 for (i = 0; i < sband->n_channels; i++) {
808                         *pos++ = ieee80211_frequency_to_channel(
809                                         sband->channels[i].center_freq);
810                         *pos++ = 1; /* one channel in the subband*/
811                 }
812         }
813
814         /* if present, add any custom IEs that go before HT */
815         if (assoc_data->ie_len) {
816                 static const u8 before_ht[] = {
817                         WLAN_EID_SSID,
818                         WLAN_EID_SUPP_RATES,
819                         WLAN_EID_EXT_SUPP_RATES,
820                         WLAN_EID_PWR_CAPABILITY,
821                         WLAN_EID_SUPPORTED_CHANNELS,
822                         WLAN_EID_RSN,
823                         WLAN_EID_QOS_CAPA,
824                         WLAN_EID_RRM_ENABLED_CAPABILITIES,
825                         WLAN_EID_MOBILITY_DOMAIN,
826                         WLAN_EID_FAST_BSS_TRANSITION,   /* reassoc only */
827                         WLAN_EID_RIC_DATA,              /* reassoc only */
828                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
829                 };
830                 static const u8 after_ric[] = {
831                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
832                         WLAN_EID_HT_CAPABILITY,
833                         WLAN_EID_BSS_COEX_2040,
834                         /* luckily this is almost always there */
835                         WLAN_EID_EXT_CAPABILITY,
836                         WLAN_EID_QOS_TRAFFIC_CAPA,
837                         WLAN_EID_TIM_BCAST_REQ,
838                         WLAN_EID_INTERWORKING,
839                         /* 60 GHz (Multi-band, DMG, MMS) can't happen */
840                         WLAN_EID_VHT_CAPABILITY,
841                         WLAN_EID_OPMODE_NOTIF,
842                 };
843
844                 noffset = ieee80211_ie_split_ric(assoc_data->ie,
845                                                  assoc_data->ie_len,
846                                                  before_ht,
847                                                  ARRAY_SIZE(before_ht),
848                                                  after_ric,
849                                                  ARRAY_SIZE(after_ric),
850                                                  offset);
851                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
852                 offset = noffset;
853         }
854
855         if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
856                          !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
857                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
858
859         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
860                 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
861                                     sband, chan, sdata->smps_mode);
862
863         /* if present, add any custom IEs that go before VHT */
864         if (assoc_data->ie_len) {
865                 static const u8 before_vht[] = {
866                         /*
867                          * no need to list the ones split off before HT
868                          * or generated here
869                          */
870                         WLAN_EID_BSS_COEX_2040,
871                         WLAN_EID_EXT_CAPABILITY,
872                         WLAN_EID_QOS_TRAFFIC_CAPA,
873                         WLAN_EID_TIM_BCAST_REQ,
874                         WLAN_EID_INTERWORKING,
875                         /* 60 GHz (Multi-band, DMG, MMS) can't happen */
876                 };
877
878                 /* RIC already taken above, so no need to handle here anymore */
879                 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
880                                              before_vht, ARRAY_SIZE(before_vht),
881                                              offset);
882                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
883                 offset = noffset;
884         }
885
886         /* if present, add any custom IEs that go before HE */
887         if (assoc_data->ie_len) {
888                 static const u8 before_he[] = {
889                         /*
890                          * no need to list the ones split off before VHT
891                          * or generated here
892                          */
893                         WLAN_EID_OPMODE_NOTIF,
894                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
895                         /* 11ai elements */
896                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
897                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
898                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
899                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
900                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
901                         /* TODO: add 11ah/11aj/11ak elements */
902                 };
903
904                 /* RIC already taken above, so no need to handle here anymore */
905                 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
906                                              before_he, ARRAY_SIZE(before_he),
907                                              offset);
908                 pos = skb_put(skb, noffset - offset);
909                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
910                 offset = noffset;
911         }
912
913         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
914                 ieee80211_add_vht_ie(sdata, skb, sband,
915                                      &assoc_data->ap_vht_cap);
916
917         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
918                 ieee80211_add_he_ie(sdata, skb, sband);
919
920         /* if present, add any custom non-vendor IEs that go after HE */
921         if (assoc_data->ie_len) {
922                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
923                                                     assoc_data->ie_len,
924                                                     offset);
925                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
926                 offset = noffset;
927         }
928
929         if (assoc_data->wmm) {
930                 if (assoc_data->uapsd) {
931                         qos_info = ifmgd->uapsd_queues;
932                         qos_info |= (ifmgd->uapsd_max_sp_len <<
933                                      IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
934                 } else {
935                         qos_info = 0;
936                 }
937
938                 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
939         }
940
941         /* add any remaining custom (i.e. vendor specific here) IEs */
942         if (assoc_data->ie_len) {
943                 noffset = assoc_data->ie_len;
944                 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
945         }
946
947         if (assoc_data->fils_kek_len &&
948             fils_encrypt_assoc_req(skb, assoc_data) < 0) {
949                 dev_kfree_skb(skb);
950                 return;
951         }
952
953         drv_mgd_prepare_tx(local, sdata, 0);
954
955         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
956         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
957                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
958                                                 IEEE80211_TX_INTFL_MLME_CONN_TX;
959         ieee80211_tx_skb(sdata, skb);
960 }
961
962 void ieee80211_send_pspoll(struct ieee80211_local *local,
963                            struct ieee80211_sub_if_data *sdata)
964 {
965         struct ieee80211_pspoll *pspoll;
966         struct sk_buff *skb;
967
968         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
969         if (!skb)
970                 return;
971
972         pspoll = (struct ieee80211_pspoll *) skb->data;
973         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
974
975         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
976         ieee80211_tx_skb(sdata, skb);
977 }
978
979 void ieee80211_send_nullfunc(struct ieee80211_local *local,
980                              struct ieee80211_sub_if_data *sdata,
981                              bool powersave)
982 {
983         struct sk_buff *skb;
984         struct ieee80211_hdr_3addr *nullfunc;
985         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
986
987         /* Don't send NDPs when STA is connected HE */
988         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
989             !(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
990                 return;
991
992         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
993                 !ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
994         if (!skb)
995                 return;
996
997         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
998         if (powersave)
999                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1000
1001         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1002                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1003
1004         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1005                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1006
1007         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1008                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1009
1010         ieee80211_tx_skb(sdata, skb);
1011 }
1012
1013 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
1014                                           struct ieee80211_sub_if_data *sdata)
1015 {
1016         struct sk_buff *skb;
1017         struct ieee80211_hdr *nullfunc;
1018         __le16 fc;
1019
1020         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1021                 return;
1022
1023         /* Don't send NDPs when connected HE */
1024         if (!(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
1025                 return;
1026
1027         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1028         if (!skb)
1029                 return;
1030
1031         skb_reserve(skb, local->hw.extra_tx_headroom);
1032
1033         nullfunc = skb_put_zero(skb, 30);
1034         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
1035                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
1036         nullfunc->frame_control = fc;
1037         memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
1038         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1039         memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
1040         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
1041
1042         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1043         ieee80211_tx_skb(sdata, skb);
1044 }
1045
1046 /* spectrum management related things */
1047 static void ieee80211_chswitch_work(struct work_struct *work)
1048 {
1049         struct ieee80211_sub_if_data *sdata =
1050                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
1051         struct ieee80211_local *local = sdata->local;
1052         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1053         int ret;
1054
1055         if (!ieee80211_sdata_running(sdata))
1056                 return;
1057
1058         sdata_lock(sdata);
1059         mutex_lock(&local->mtx);
1060         mutex_lock(&local->chanctx_mtx);
1061
1062         if (!ifmgd->associated)
1063                 goto out;
1064
1065         if (!sdata->vif.csa_active)
1066                 goto out;
1067
1068         /*
1069          * using reservation isn't immediate as it may be deferred until later
1070          * with multi-vif. once reservation is complete it will re-schedule the
1071          * work with no reserved_chanctx so verify chandef to check if it
1072          * completed successfully
1073          */
1074
1075         if (sdata->reserved_chanctx) {
1076                 struct ieee80211_supported_band *sband = NULL;
1077                 struct sta_info *mgd_sta = NULL;
1078                 enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
1079
1080                 /*
1081                  * with multi-vif csa driver may call ieee80211_csa_finish()
1082                  * many times while waiting for other interfaces to use their
1083                  * reservations
1084                  */
1085                 if (sdata->reserved_ready)
1086                         goto out;
1087
1088                 if (sdata->vif.bss_conf.chandef.width !=
1089                     sdata->csa_chandef.width) {
1090                         /*
1091                          * For managed interface, we need to also update the AP
1092                          * station bandwidth and align the rate scale algorithm
1093                          * on the bandwidth change. Here we only consider the
1094                          * bandwidth of the new channel definition (as channel
1095                          * switch flow does not have the full HT/VHT/HE
1096                          * information), assuming that if additional changes are
1097                          * required they would be done as part of the processing
1098                          * of the next beacon from the AP.
1099                          */
1100                         switch (sdata->csa_chandef.width) {
1101                         case NL80211_CHAN_WIDTH_20_NOHT:
1102                         case NL80211_CHAN_WIDTH_20:
1103                         default:
1104                                 bw = IEEE80211_STA_RX_BW_20;
1105                                 break;
1106                         case NL80211_CHAN_WIDTH_40:
1107                                 bw = IEEE80211_STA_RX_BW_40;
1108                                 break;
1109                         case NL80211_CHAN_WIDTH_80:
1110                                 bw = IEEE80211_STA_RX_BW_80;
1111                                 break;
1112                         case NL80211_CHAN_WIDTH_80P80:
1113                         case NL80211_CHAN_WIDTH_160:
1114                                 bw = IEEE80211_STA_RX_BW_160;
1115                                 break;
1116                         }
1117
1118                         mgd_sta = sta_info_get(sdata, ifmgd->bssid);
1119                         sband =
1120                                 local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
1121                 }
1122
1123                 if (sdata->vif.bss_conf.chandef.width >
1124                     sdata->csa_chandef.width) {
1125                         mgd_sta->sta.bandwidth = bw;
1126                         rate_control_rate_update(local, sband, mgd_sta,
1127                                                  IEEE80211_RC_BW_CHANGED);
1128                 }
1129
1130                 ret = ieee80211_vif_use_reserved_context(sdata);
1131                 if (ret) {
1132                         sdata_info(sdata,
1133                                    "failed to use reserved channel context, disconnecting (err=%d)\n",
1134                                    ret);
1135                         ieee80211_queue_work(&sdata->local->hw,
1136                                              &ifmgd->csa_connection_drop_work);
1137                         goto out;
1138                 }
1139
1140                 if (sdata->vif.bss_conf.chandef.width <
1141                     sdata->csa_chandef.width) {
1142                         mgd_sta->sta.bandwidth = bw;
1143                         rate_control_rate_update(local, sband, mgd_sta,
1144                                                  IEEE80211_RC_BW_CHANGED);
1145                 }
1146
1147                 goto out;
1148         }
1149
1150         if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
1151                                         &sdata->csa_chandef)) {
1152                 sdata_info(sdata,
1153                            "failed to finalize channel switch, disconnecting\n");
1154                 ieee80211_queue_work(&sdata->local->hw,
1155                                      &ifmgd->csa_connection_drop_work);
1156                 goto out;
1157         }
1158
1159         /* XXX: shouldn't really modify cfg80211-owned data! */
1160         ifmgd->associated->channel = sdata->csa_chandef.chan;
1161
1162         ifmgd->csa_waiting_bcn = true;
1163
1164         ieee80211_sta_reset_beacon_monitor(sdata);
1165         ieee80211_sta_reset_conn_monitor(sdata);
1166
1167 out:
1168         mutex_unlock(&local->chanctx_mtx);
1169         mutex_unlock(&local->mtx);
1170         sdata_unlock(sdata);
1171 }
1172
1173 static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
1174 {
1175         struct ieee80211_local *local = sdata->local;
1176         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1177         int ret;
1178
1179         sdata_assert_lock(sdata);
1180
1181         WARN_ON(!sdata->vif.csa_active);
1182
1183         if (sdata->csa_block_tx) {
1184                 ieee80211_wake_vif_queues(local, sdata,
1185                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1186                 sdata->csa_block_tx = false;
1187         }
1188
1189         sdata->vif.csa_active = false;
1190         ifmgd->csa_waiting_bcn = false;
1191
1192         ret = drv_post_channel_switch(sdata);
1193         if (ret) {
1194                 sdata_info(sdata,
1195                            "driver post channel switch failed, disconnecting\n");
1196                 ieee80211_queue_work(&local->hw,
1197                                      &ifmgd->csa_connection_drop_work);
1198                 return;
1199         }
1200
1201         cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1202 }
1203
1204 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1205 {
1206         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1207         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1208
1209         trace_api_chswitch_done(sdata, success);
1210         if (!success) {
1211                 sdata_info(sdata,
1212                            "driver channel switch failed, disconnecting\n");
1213                 ieee80211_queue_work(&sdata->local->hw,
1214                                      &ifmgd->csa_connection_drop_work);
1215         } else {
1216                 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1217         }
1218 }
1219 EXPORT_SYMBOL(ieee80211_chswitch_done);
1220
1221 static void ieee80211_chswitch_timer(struct timer_list *t)
1222 {
1223         struct ieee80211_sub_if_data *sdata =
1224                 from_timer(sdata, t, u.mgd.chswitch_timer);
1225
1226         ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1227 }
1228
1229 static void
1230 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1231                                  u64 timestamp, u32 device_timestamp,
1232                                  struct ieee802_11_elems *elems,
1233                                  bool beacon)
1234 {
1235         struct ieee80211_local *local = sdata->local;
1236         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1237         struct cfg80211_bss *cbss = ifmgd->associated;
1238         struct ieee80211_chanctx_conf *conf;
1239         struct ieee80211_chanctx *chanctx;
1240         enum nl80211_band current_band;
1241         struct ieee80211_csa_ie csa_ie;
1242         struct ieee80211_channel_switch ch_switch;
1243         int res;
1244
1245         sdata_assert_lock(sdata);
1246
1247         if (!cbss)
1248                 return;
1249
1250         if (local->scanning)
1251                 return;
1252
1253         /* disregard subsequent announcements if we are already processing */
1254         if (sdata->vif.csa_active)
1255                 return;
1256
1257         current_band = cbss->channel->band;
1258         res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1259                                            ifmgd->flags,
1260                                            ifmgd->associated->bssid, &csa_ie);
1261         if (res < 0)
1262                 ieee80211_queue_work(&local->hw,
1263                                      &ifmgd->csa_connection_drop_work);
1264         if (res)
1265                 return;
1266
1267         if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1268                                      IEEE80211_CHAN_DISABLED)) {
1269                 sdata_info(sdata,
1270                            "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1271                            ifmgd->associated->bssid,
1272                            csa_ie.chandef.chan->center_freq,
1273                            csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1274                            csa_ie.chandef.center_freq2);
1275                 ieee80211_queue_work(&local->hw,
1276                                      &ifmgd->csa_connection_drop_work);
1277                 return;
1278         }
1279
1280         if (cfg80211_chandef_identical(&csa_ie.chandef,
1281                                        &sdata->vif.bss_conf.chandef)) {
1282                 if (ifmgd->csa_ignored_same_chan)
1283                         return;
1284                 sdata_info(sdata,
1285                            "AP %pM tries to chanswitch to same channel, ignore\n",
1286                            ifmgd->associated->bssid);
1287                 ifmgd->csa_ignored_same_chan = true;
1288                 return;
1289         }
1290
1291         /*
1292          * Drop all TDLS peers - either we disconnect or move to a different
1293          * channel from this point on. There's no telling what our peer will do.
1294          * The TDLS WIDER_BW scenario is also problematic, as peers might now
1295          * have an incompatible wider chandef.
1296          */
1297         ieee80211_teardown_tdls_peers(sdata);
1298
1299         mutex_lock(&local->mtx);
1300         mutex_lock(&local->chanctx_mtx);
1301         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
1302                                          lockdep_is_held(&local->chanctx_mtx));
1303         if (!conf) {
1304                 sdata_info(sdata,
1305                            "no channel context assigned to vif?, disconnecting\n");
1306                 goto drop_connection;
1307         }
1308
1309         chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1310
1311         if (local->use_chanctx &&
1312             !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1313                 sdata_info(sdata,
1314                            "driver doesn't support chan-switch with channel contexts\n");
1315                 goto drop_connection;
1316         }
1317
1318         ch_switch.timestamp = timestamp;
1319         ch_switch.device_timestamp = device_timestamp;
1320         ch_switch.block_tx = csa_ie.mode;
1321         ch_switch.chandef = csa_ie.chandef;
1322         ch_switch.count = csa_ie.count;
1323
1324         if (drv_pre_channel_switch(sdata, &ch_switch)) {
1325                 sdata_info(sdata,
1326                            "preparing for channel switch failed, disconnecting\n");
1327                 goto drop_connection;
1328         }
1329
1330         res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
1331                                             chanctx->mode, false);
1332         if (res) {
1333                 sdata_info(sdata,
1334                            "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1335                            res);
1336                 goto drop_connection;
1337         }
1338         mutex_unlock(&local->chanctx_mtx);
1339
1340         sdata->vif.csa_active = true;
1341         sdata->csa_chandef = csa_ie.chandef;
1342         sdata->csa_block_tx = csa_ie.mode;
1343         ifmgd->csa_ignored_same_chan = false;
1344
1345         if (sdata->csa_block_tx)
1346                 ieee80211_stop_vif_queues(local, sdata,
1347                                           IEEE80211_QUEUE_STOP_REASON_CSA);
1348         mutex_unlock(&local->mtx);
1349
1350         cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
1351                                           csa_ie.count);
1352
1353         if (local->ops->channel_switch) {
1354                 /* use driver's channel switch callback */
1355                 drv_channel_switch(local, sdata, &ch_switch);
1356                 return;
1357         }
1358
1359         /* channel switch handled in software */
1360         if (csa_ie.count <= 1)
1361                 ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1362         else
1363                 mod_timer(&ifmgd->chswitch_timer,
1364                           TU_TO_EXP_TIME((csa_ie.count - 1) *
1365                                          cbss->beacon_interval));
1366         return;
1367  drop_connection:
1368         /*
1369          * This is just so that the disconnect flow will know that
1370          * we were trying to switch channel and failed. In case the
1371          * mode is 1 (we are not allowed to Tx), we will know not to
1372          * send a deauthentication frame. Those two fields will be
1373          * reset when the disconnection worker runs.
1374          */
1375         sdata->vif.csa_active = true;
1376         sdata->csa_block_tx = csa_ie.mode;
1377
1378         ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
1379         mutex_unlock(&local->chanctx_mtx);
1380         mutex_unlock(&local->mtx);
1381 }
1382
1383 static bool
1384 ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
1385                                  struct ieee80211_channel *channel,
1386                                  const u8 *country_ie, u8 country_ie_len,
1387                                  const u8 *pwr_constr_elem,
1388                                  int *chan_pwr, int *pwr_reduction)
1389 {
1390         struct ieee80211_country_ie_triplet *triplet;
1391         int chan = ieee80211_frequency_to_channel(channel->center_freq);
1392         int i, chan_increment;
1393         bool have_chan_pwr = false;
1394
1395         /* Invalid IE */
1396         if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1397                 return false;
1398
1399         triplet = (void *)(country_ie + 3);
1400         country_ie_len -= 3;
1401
1402         switch (channel->band) {
1403         default:
1404                 WARN_ON_ONCE(1);
1405                 /* fall through */
1406         case NL80211_BAND_2GHZ:
1407         case NL80211_BAND_60GHZ:
1408                 chan_increment = 1;
1409                 break;
1410         case NL80211_BAND_5GHZ:
1411                 chan_increment = 4;
1412                 break;
1413         }
1414
1415         /* find channel */
1416         while (country_ie_len >= 3) {
1417                 u8 first_channel = triplet->chans.first_channel;
1418
1419                 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
1420                         goto next;
1421
1422                 for (i = 0; i < triplet->chans.num_channels; i++) {
1423                         if (first_channel + i * chan_increment == chan) {
1424                                 have_chan_pwr = true;
1425                                 *chan_pwr = triplet->chans.max_power;
1426                                 break;
1427                         }
1428                 }
1429                 if (have_chan_pwr)
1430                         break;
1431
1432  next:
1433                 triplet++;
1434                 country_ie_len -= 3;
1435         }
1436
1437         if (have_chan_pwr && pwr_constr_elem)
1438                 *pwr_reduction = *pwr_constr_elem;
1439         else
1440                 *pwr_reduction = 0;
1441
1442         return have_chan_pwr;
1443 }
1444
1445 static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
1446                                       struct ieee80211_channel *channel,
1447                                       const u8 *cisco_dtpc_ie,
1448                                       int *pwr_level)
1449 {
1450         /* From practical testing, the first data byte of the DTPC element
1451          * seems to contain the requested dBm level, and the CLI on Cisco
1452          * APs clearly state the range is -127 to 127 dBm, which indicates
1453          * a signed byte, although it seemingly never actually goes negative.
1454          * The other byte seems to always be zero.
1455          */
1456         *pwr_level = (__s8)cisco_dtpc_ie[4];
1457 }
1458
1459 static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
1460                                        struct ieee80211_channel *channel,
1461                                        struct ieee80211_mgmt *mgmt,
1462                                        const u8 *country_ie, u8 country_ie_len,
1463                                        const u8 *pwr_constr_ie,
1464                                        const u8 *cisco_dtpc_ie)
1465 {
1466         bool has_80211h_pwr = false, has_cisco_pwr = false;
1467         int chan_pwr = 0, pwr_reduction_80211h = 0;
1468         int pwr_level_cisco, pwr_level_80211h;
1469         int new_ap_level;
1470         __le16 capab = mgmt->u.probe_resp.capab_info;
1471
1472         if (country_ie &&
1473             (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
1474              capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1475                 has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
1476                         sdata, channel, country_ie, country_ie_len,
1477                         pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1478                 pwr_level_80211h =
1479                         max_t(int, 0, chan_pwr - pwr_reduction_80211h);
1480         }
1481
1482         if (cisco_dtpc_ie) {
1483                 ieee80211_find_cisco_dtpc(
1484                         sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
1485                 has_cisco_pwr = true;
1486         }
1487
1488         if (!has_80211h_pwr && !has_cisco_pwr)
1489                 return 0;
1490
1491         /* If we have both 802.11h and Cisco DTPC, apply both limits
1492          * by picking the smallest of the two power levels advertised.
1493          */
1494         if (has_80211h_pwr &&
1495             (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1496                 new_ap_level = pwr_level_80211h;
1497
1498                 if (sdata->ap_power_level == new_ap_level)
1499                         return 0;
1500
1501                 sdata_dbg(sdata,
1502                           "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
1503                           pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
1504                           sdata->u.mgd.bssid);
1505         } else {  /* has_cisco_pwr is always true here. */
1506                 new_ap_level = pwr_level_cisco;
1507
1508                 if (sdata->ap_power_level == new_ap_level)
1509                         return 0;
1510
1511                 sdata_dbg(sdata,
1512                           "Limiting TX power to %d dBm as advertised by %pM\n",
1513                           pwr_level_cisco, sdata->u.mgd.bssid);
1514         }
1515
1516         sdata->ap_power_level = new_ap_level;
1517         if (__ieee80211_recalc_txpower(sdata))
1518                 return BSS_CHANGED_TXPOWER;
1519         return 0;
1520 }
1521
1522 /* powersave */
1523 static void ieee80211_enable_ps(struct ieee80211_local *local,
1524                                 struct ieee80211_sub_if_data *sdata)
1525 {
1526         struct ieee80211_conf *conf = &local->hw.conf;
1527
1528         /*
1529          * If we are scanning right now then the parameters will
1530          * take effect when scan finishes.
1531          */
1532         if (local->scanning)
1533                 return;
1534
1535         if (conf->dynamic_ps_timeout > 0 &&
1536             !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1537                 mod_timer(&local->dynamic_ps_timer, jiffies +
1538                           msecs_to_jiffies(conf->dynamic_ps_timeout));
1539         } else {
1540                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1541                         ieee80211_send_nullfunc(local, sdata, true);
1542
1543                 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1544                     ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1545                         return;
1546
1547                 conf->flags |= IEEE80211_CONF_PS;
1548                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1549         }
1550 }
1551
1552 static void ieee80211_change_ps(struct ieee80211_local *local)
1553 {
1554         struct ieee80211_conf *conf = &local->hw.conf;
1555
1556         if (local->ps_sdata) {
1557                 ieee80211_enable_ps(local, local->ps_sdata);
1558         } else if (conf->flags & IEEE80211_CONF_PS) {
1559                 conf->flags &= ~IEEE80211_CONF_PS;
1560                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1561                 del_timer_sync(&local->dynamic_ps_timer);
1562                 cancel_work_sync(&local->dynamic_ps_enable_work);
1563         }
1564 }
1565
1566 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
1567 {
1568         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
1569         struct sta_info *sta = NULL;
1570         bool authorized = false;
1571
1572         if (!mgd->powersave)
1573                 return false;
1574
1575         if (mgd->broken_ap)
1576                 return false;
1577
1578         if (!mgd->associated)
1579                 return false;
1580
1581         if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1582                 return false;
1583
1584         if (!mgd->have_beacon)
1585                 return false;
1586
1587         rcu_read_lock();
1588         sta = sta_info_get(sdata, mgd->bssid);
1589         if (sta)
1590                 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1591         rcu_read_unlock();
1592
1593         return authorized;
1594 }
1595
1596 /* need to hold RTNL or interface lock */
1597 void ieee80211_recalc_ps(struct ieee80211_local *local)
1598 {
1599         struct ieee80211_sub_if_data *sdata, *found = NULL;
1600         int count = 0;
1601         int timeout;
1602
1603         if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1604                 local->ps_sdata = NULL;
1605                 return;
1606         }
1607
1608         list_for_each_entry(sdata, &local->interfaces, list) {
1609                 if (!ieee80211_sdata_running(sdata))
1610                         continue;
1611                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
1612                         /* If an AP vif is found, then disable PS
1613                          * by setting the count to zero thereby setting
1614                          * ps_sdata to NULL.
1615                          */
1616                         count = 0;
1617                         break;
1618                 }
1619                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1620                         continue;
1621                 found = sdata;
1622                 count++;
1623         }
1624
1625         if (count == 1 && ieee80211_powersave_allowed(found)) {
1626                 u8 dtimper = found->u.mgd.dtim_period;
1627
1628                 timeout = local->dynamic_ps_forced_timeout;
1629                 if (timeout < 0)
1630                         timeout = 100;
1631                 local->hw.conf.dynamic_ps_timeout = timeout;
1632
1633                 /* If the TIM IE is invalid, pretend the value is 1 */
1634                 if (!dtimper)
1635                         dtimper = 1;
1636
1637                 local->hw.conf.ps_dtim_period = dtimper;
1638                 local->ps_sdata = found;
1639         } else {
1640                 local->ps_sdata = NULL;
1641         }
1642
1643         ieee80211_change_ps(local);
1644 }
1645
1646 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
1647 {
1648         bool ps_allowed = ieee80211_powersave_allowed(sdata);
1649
1650         if (sdata->vif.bss_conf.ps != ps_allowed) {
1651                 sdata->vif.bss_conf.ps = ps_allowed;
1652                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
1653         }
1654 }
1655
1656 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
1657 {
1658         struct ieee80211_local *local =
1659                 container_of(work, struct ieee80211_local,
1660                              dynamic_ps_disable_work);
1661
1662         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1663                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1664                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1665         }
1666
1667         ieee80211_wake_queues_by_reason(&local->hw,
1668                                         IEEE80211_MAX_QUEUE_MAP,
1669                                         IEEE80211_QUEUE_STOP_REASON_PS,
1670                                         false);
1671 }
1672
1673 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
1674 {
1675         struct ieee80211_local *local =
1676                 container_of(work, struct ieee80211_local,
1677                              dynamic_ps_enable_work);
1678         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1679         struct ieee80211_if_managed *ifmgd;
1680         unsigned long flags;
1681         int q;
1682
1683         /* can only happen when PS was just disabled anyway */
1684         if (!sdata)
1685                 return;
1686
1687         ifmgd = &sdata->u.mgd;
1688
1689         if (local->hw.conf.flags & IEEE80211_CONF_PS)
1690                 return;
1691
1692         if (local->hw.conf.dynamic_ps_timeout > 0) {
1693                 /* don't enter PS if TX frames are pending */
1694                 if (drv_tx_frames_pending(local)) {
1695                         mod_timer(&local->dynamic_ps_timer, jiffies +
1696                                   msecs_to_jiffies(
1697                                   local->hw.conf.dynamic_ps_timeout));
1698                         return;
1699                 }
1700
1701                 /*
1702                  * transmission can be stopped by others which leads to
1703                  * dynamic_ps_timer expiry. Postpone the ps timer if it
1704                  * is not the actual idle state.
1705                  */
1706                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1707                 for (q = 0; q < local->hw.queues; q++) {
1708                         if (local->queue_stop_reasons[q]) {
1709                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1710                                                        flags);
1711                                 mod_timer(&local->dynamic_ps_timer, jiffies +
1712                                           msecs_to_jiffies(
1713                                           local->hw.conf.dynamic_ps_timeout));
1714                                 return;
1715                         }
1716                 }
1717                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1718         }
1719
1720         if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1721             !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1722                 if (drv_tx_frames_pending(local)) {
1723                         mod_timer(&local->dynamic_ps_timer, jiffies +
1724                                   msecs_to_jiffies(
1725                                   local->hw.conf.dynamic_ps_timeout));
1726                 } else {
1727                         ieee80211_send_nullfunc(local, sdata, true);
1728                         /* Flush to get the tx status of nullfunc frame */
1729                         ieee80211_flush_queues(local, sdata, false);
1730                 }
1731         }
1732
1733         if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
1734               ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1735             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1736                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
1737                 local->hw.conf.flags |= IEEE80211_CONF_PS;
1738                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1739         }
1740 }
1741
1742 void ieee80211_dynamic_ps_timer(struct timer_list *t)
1743 {
1744         struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
1745
1746         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1747 }
1748
1749 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
1750 {
1751         struct delayed_work *delayed_work = to_delayed_work(work);
1752         struct ieee80211_sub_if_data *sdata =
1753                 container_of(delayed_work, struct ieee80211_sub_if_data,
1754                              dfs_cac_timer_work);
1755         struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1756
1757         mutex_lock(&sdata->local->mtx);
1758         if (sdata->wdev.cac_started) {
1759                 ieee80211_vif_release_channel(sdata);
1760                 cfg80211_cac_event(sdata->dev, &chandef,
1761                                    NL80211_RADAR_CAC_FINISHED,
1762                                    GFP_KERNEL);
1763         }
1764         mutex_unlock(&sdata->local->mtx);
1765 }
1766
1767 static bool
1768 __ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
1769 {
1770         struct ieee80211_local *local = sdata->local;
1771         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1772         bool ret = false;
1773         int ac;
1774
1775         if (local->hw.queues < IEEE80211_NUM_ACS)
1776                 return false;
1777
1778         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1779                 struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
1780                 int non_acm_ac;
1781                 unsigned long now = jiffies;
1782
1783                 if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
1784                     tx_tspec->admitted_time &&
1785                     time_after(now, tx_tspec->time_slice_start + HZ)) {
1786                         tx_tspec->consumed_tx_time = 0;
1787                         tx_tspec->time_slice_start = now;
1788
1789                         if (tx_tspec->downgraded)
1790                                 tx_tspec->action =
1791                                         TX_TSPEC_ACTION_STOP_DOWNGRADE;
1792                 }
1793
1794                 switch (tx_tspec->action) {
1795                 case TX_TSPEC_ACTION_STOP_DOWNGRADE:
1796                         /* take the original parameters */
1797                         if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
1798                                 sdata_err(sdata,
1799                                           "failed to set TX queue parameters for queue %d\n",
1800                                           ac);
1801                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
1802                         tx_tspec->downgraded = false;
1803                         ret = true;
1804                         break;
1805                 case TX_TSPEC_ACTION_DOWNGRADE:
1806                         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
1807                                 tx_tspec->action = TX_TSPEC_ACTION_NONE;
1808                                 ret = true;
1809                                 break;
1810                         }
1811                         /* downgrade next lower non-ACM AC */
1812                         for (non_acm_ac = ac + 1;
1813                              non_acm_ac < IEEE80211_NUM_ACS;
1814                              non_acm_ac++)
1815                                 if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
1816                                         break;
1817                         /* Usually the loop will result in using BK even if it
1818                          * requires admission control, but such a configuration
1819                          * makes no sense and we have to transmit somehow - the
1820                          * AC selection does the same thing.
1821                          * If we started out trying to downgrade from BK, then
1822                          * the extra condition here might be needed.
1823                          */
1824                         if (non_acm_ac >= IEEE80211_NUM_ACS)
1825                                 non_acm_ac = IEEE80211_AC_BK;
1826                         if (drv_conf_tx(local, sdata, ac,
1827                                         &sdata->tx_conf[non_acm_ac]))
1828                                 sdata_err(sdata,
1829                                           "failed to set TX queue parameters for queue %d\n",
1830                                           ac);
1831                         tx_tspec->action = TX_TSPEC_ACTION_NONE;
1832                         ret = true;
1833                         schedule_delayed_work(&ifmgd->tx_tspec_wk,
1834                                 tx_tspec->time_slice_start + HZ - now + 1);
1835                         break;
1836                 case TX_TSPEC_ACTION_NONE:
1837                         /* nothing now */
1838                         break;
1839                 }
1840         }
1841
1842         return ret;
1843 }
1844
1845 void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
1846 {
1847         if (__ieee80211_sta_handle_tspec_ac_params(sdata))
1848                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
1849 }
1850
1851 static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
1852 {
1853         struct ieee80211_sub_if_data *sdata;
1854
1855         sdata = container_of(work, struct ieee80211_sub_if_data,
1856                              u.mgd.tx_tspec_wk.work);
1857         ieee80211_sta_handle_tspec_ac_params(sdata);
1858 }
1859
1860 /* MLME */
1861 static bool
1862 ieee80211_sta_wmm_params(struct ieee80211_local *local,
1863                          struct ieee80211_sub_if_data *sdata,
1864                          const u8 *wmm_param, size_t wmm_param_len,
1865                          const struct ieee80211_mu_edca_param_set *mu_edca)
1866 {
1867         struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1868         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1869         size_t left;
1870         int count, ac;
1871         const u8 *pos;
1872         u8 uapsd_queues = 0;
1873
1874         if (!local->ops->conf_tx)
1875                 return false;
1876
1877         if (local->hw.queues < IEEE80211_NUM_ACS)
1878                 return false;
1879
1880         if (!wmm_param)
1881                 return false;
1882
1883         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1884                 return false;
1885
1886         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1887                 uapsd_queues = ifmgd->uapsd_queues;
1888
1889         count = wmm_param[6] & 0x0f;
1890         if (count == ifmgd->wmm_last_param_set)
1891                 return false;
1892         ifmgd->wmm_last_param_set = count;
1893
1894         pos = wmm_param + 8;
1895         left = wmm_param_len - 8;
1896
1897         memset(&params, 0, sizeof(params));
1898
1899         sdata->wmm_acm = 0;
1900         for (; left >= 4; left -= 4, pos += 4) {
1901                 int aci = (pos[0] >> 5) & 0x03;
1902                 int acm = (pos[0] >> 4) & 0x01;
1903                 bool uapsd = false;
1904
1905                 switch (aci) {
1906                 case 1: /* AC_BK */
1907                         ac = IEEE80211_AC_BK;
1908                         if (acm)
1909                                 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
1910                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
1911                                 uapsd = true;
1912                         params[ac].mu_edca = !!mu_edca;
1913                         if (mu_edca)
1914                                 params[ac].mu_edca_param_rec = mu_edca->ac_bk;
1915                         break;
1916                 case 2: /* AC_VI */
1917                         ac = IEEE80211_AC_VI;
1918                         if (acm)
1919                                 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
1920                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
1921                                 uapsd = true;
1922                         params[ac].mu_edca = !!mu_edca;
1923                         if (mu_edca)
1924                                 params[ac].mu_edca_param_rec = mu_edca->ac_vi;
1925                         break;
1926                 case 3: /* AC_VO */
1927                         ac = IEEE80211_AC_VO;
1928                         if (acm)
1929                                 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
1930                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
1931                                 uapsd = true;
1932                         params[ac].mu_edca = !!mu_edca;
1933                         if (mu_edca)
1934                                 params[ac].mu_edca_param_rec = mu_edca->ac_vo;
1935                         break;
1936                 case 0: /* AC_BE */
1937                 default:
1938                         ac = IEEE80211_AC_BE;
1939                         if (acm)
1940                                 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
1941                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
1942                                 uapsd = true;
1943                         params[ac].mu_edca = !!mu_edca;
1944                         if (mu_edca)
1945                                 params[ac].mu_edca_param_rec = mu_edca->ac_be;
1946                         break;
1947                 }
1948
1949                 params[ac].aifs = pos[0] & 0x0f;
1950
1951                 if (params[ac].aifs < 2) {
1952                         sdata_info(sdata,
1953                                    "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
1954                                    params[ac].aifs, aci);
1955                         params[ac].aifs = 2;
1956                 }
1957                 params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
1958                 params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
1959                 params[ac].txop = get_unaligned_le16(pos + 2);
1960                 params[ac].acm = acm;
1961                 params[ac].uapsd = uapsd;
1962
1963                 if (params[ac].cw_min == 0 ||
1964                     params[ac].cw_min > params[ac].cw_max) {
1965                         sdata_info(sdata,
1966                                    "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
1967                                    params[ac].cw_min, params[ac].cw_max, aci);
1968                         return false;
1969                 }
1970                 ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
1971         }
1972
1973         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1974                 mlme_dbg(sdata,
1975                          "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
1976                          ac, params[ac].acm,
1977                          params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
1978                          params[ac].txop, params[ac].uapsd,
1979                          ifmgd->tx_tspec[ac].downgraded);
1980                 sdata->tx_conf[ac] = params[ac];
1981                 if (!ifmgd->tx_tspec[ac].downgraded &&
1982                     drv_conf_tx(local, sdata, ac, &params[ac]))
1983                         sdata_err(sdata,
1984                                   "failed to set TX queue parameters for AC %d\n",
1985                                   ac);
1986         }
1987
1988         /* enable WMM or activate new settings */
1989         sdata->vif.bss_conf.qos = true;
1990         return true;
1991 }
1992
1993 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1994 {
1995         lockdep_assert_held(&sdata->local->mtx);
1996
1997         sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1998         ieee80211_run_deferred_scan(sdata->local);
1999 }
2000
2001 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2002 {
2003         mutex_lock(&sdata->local->mtx);
2004         __ieee80211_stop_poll(sdata);
2005         mutex_unlock(&sdata->local->mtx);
2006 }
2007
2008 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
2009                                            u16 capab, bool erp_valid, u8 erp)
2010 {
2011         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2012         struct ieee80211_supported_band *sband;
2013         u32 changed = 0;
2014         bool use_protection;
2015         bool use_short_preamble;
2016         bool use_short_slot;
2017
2018         sband = ieee80211_get_sband(sdata);
2019         if (!sband)
2020                 return changed;
2021
2022         if (erp_valid) {
2023                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
2024                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
2025         } else {
2026                 use_protection = false;
2027                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
2028         }
2029
2030         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2031         if (sband->band == NL80211_BAND_5GHZ)
2032                 use_short_slot = true;
2033
2034         if (use_protection != bss_conf->use_cts_prot) {
2035                 bss_conf->use_cts_prot = use_protection;
2036                 changed |= BSS_CHANGED_ERP_CTS_PROT;
2037         }
2038
2039         if (use_short_preamble != bss_conf->use_short_preamble) {
2040                 bss_conf->use_short_preamble = use_short_preamble;
2041                 changed |= BSS_CHANGED_ERP_PREAMBLE;
2042         }
2043
2044         if (use_short_slot != bss_conf->use_short_slot) {
2045                 bss_conf->use_short_slot = use_short_slot;
2046                 changed |= BSS_CHANGED_ERP_SLOT;
2047         }
2048
2049         return changed;
2050 }
2051
2052 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2053                                      struct cfg80211_bss *cbss,
2054                                      u32 bss_info_changed)
2055 {
2056         struct ieee80211_bss *bss = (void *)cbss->priv;
2057         struct ieee80211_local *local = sdata->local;
2058         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2059
2060         bss_info_changed |= BSS_CHANGED_ASSOC;
2061         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
2062                 bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
2063
2064         sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
2065                 beacon_loss_count * bss_conf->beacon_int));
2066
2067         sdata->u.mgd.associated = cbss;
2068         memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2069
2070         ieee80211_check_rate_mask(sdata);
2071
2072         sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
2073
2074         if (sdata->vif.p2p ||
2075             sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2076                 const struct cfg80211_bss_ies *ies;
2077
2078                 rcu_read_lock();
2079                 ies = rcu_dereference(cbss->ies);
2080                 if (ies) {
2081                         int ret;
2082
2083                         ret = cfg80211_get_p2p_attr(
2084                                         ies->data, ies->len,
2085                                         IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
2086                                         (u8 *) &bss_conf->p2p_noa_attr,
2087                                         sizeof(bss_conf->p2p_noa_attr));
2088                         if (ret >= 2) {
2089                                 sdata->u.mgd.p2p_noa_index =
2090                                         bss_conf->p2p_noa_attr.index;
2091                                 bss_info_changed |= BSS_CHANGED_P2P_PS;
2092                         }
2093                 }
2094                 rcu_read_unlock();
2095         }
2096
2097         /* just to be sure */
2098         ieee80211_stop_poll(sdata);
2099
2100         ieee80211_led_assoc(local, 1);
2101
2102         if (sdata->u.mgd.have_beacon) {
2103                 /*
2104                  * If the AP is buggy we may get here with no DTIM period
2105                  * known, so assume it's 1 which is the only safe assumption
2106                  * in that case, although if the TIM IE is broken powersave
2107                  * probably just won't work at all.
2108                  */
2109                 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
2110                 bss_conf->beacon_rate = bss->beacon_rate;
2111                 bss_info_changed |= BSS_CHANGED_BEACON_INFO;
2112         } else {
2113                 bss_conf->beacon_rate = NULL;
2114                 bss_conf->dtim_period = 0;
2115         }
2116
2117         bss_conf->assoc = 1;
2118
2119         /* Tell the driver to monitor connection quality (if supported) */
2120         if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2121             bss_conf->cqm_rssi_thold)
2122                 bss_info_changed |= BSS_CHANGED_CQM;
2123
2124         /* Enable ARP filtering */
2125         if (bss_conf->arp_addr_cnt)
2126                 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
2127
2128         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
2129
2130         mutex_lock(&local->iflist_mtx);
2131         ieee80211_recalc_ps(local);
2132         mutex_unlock(&local->iflist_mtx);
2133
2134         ieee80211_recalc_smps(sdata);
2135         ieee80211_recalc_ps_vif(sdata);
2136
2137         netif_carrier_on(sdata->dev);
2138 }
2139
2140 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2141                                    u16 stype, u16 reason, bool tx,
2142                                    u8 *frame_buf)
2143 {
2144         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2145         struct ieee80211_local *local = sdata->local;
2146         u32 changed = 0;
2147
2148         sdata_assert_lock(sdata);
2149
2150         if (WARN_ON_ONCE(tx && !frame_buf))
2151                 return;
2152
2153         if (WARN_ON(!ifmgd->associated))
2154                 return;
2155
2156         ieee80211_stop_poll(sdata);
2157
2158         ifmgd->associated = NULL;
2159         netif_carrier_off(sdata->dev);
2160
2161         /*
2162          * if we want to get out of ps before disassoc (why?) we have
2163          * to do it before sending disassoc, as otherwise the null-packet
2164          * won't be valid.
2165          */
2166         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2167                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2168                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2169         }
2170         local->ps_sdata = NULL;
2171
2172         /* disable per-vif ps */
2173         ieee80211_recalc_ps_vif(sdata);
2174
2175         /* make sure ongoing transmission finishes */
2176         synchronize_net();
2177
2178         /*
2179          * drop any frame before deauth/disassoc, this can be data or
2180          * management frame. Since we are disconnecting, we should not
2181          * insist sending these frames which can take time and delay
2182          * the disconnection and possible the roaming.
2183          */
2184         if (tx)
2185                 ieee80211_flush_queues(local, sdata, true);
2186
2187         /* deauthenticate/disassociate now */
2188         if (tx || frame_buf) {
2189                 /*
2190                  * In multi channel scenarios guarantee that the virtual
2191                  * interface is granted immediate airtime to transmit the
2192                  * deauthentication frame by calling mgd_prepare_tx, if the
2193                  * driver requested so.
2194                  */
2195                 if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
2196                     !ifmgd->have_beacon)
2197                         drv_mgd_prepare_tx(sdata->local, sdata, 0);
2198
2199                 ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
2200                                                reason, tx, frame_buf);
2201         }
2202
2203         /* flush out frame - make sure the deauth was actually sent */
2204         if (tx)
2205                 ieee80211_flush_queues(local, sdata, false);
2206
2207         /* clear bssid only after building the needed mgmt frames */
2208         eth_zero_addr(ifmgd->bssid);
2209
2210         /* remove AP and TDLS peers */
2211         sta_info_flush(sdata);
2212
2213         /* finally reset all BSS / config parameters */
2214         changed |= ieee80211_reset_erp_info(sdata);
2215
2216         ieee80211_led_assoc(local, 0);
2217         changed |= BSS_CHANGED_ASSOC;
2218         sdata->vif.bss_conf.assoc = false;
2219
2220         ifmgd->p2p_noa_index = -1;
2221         memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
2222                sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2223
2224         /* on the next assoc, re-program HT/VHT parameters */
2225         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
2226         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2227         memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
2228         memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2229
2230         /* reset MU-MIMO ownership and group data */
2231         memset(sdata->vif.bss_conf.mu_group.membership, 0,
2232                sizeof(sdata->vif.bss_conf.mu_group.membership));
2233         memset(sdata->vif.bss_conf.mu_group.position, 0,
2234                sizeof(sdata->vif.bss_conf.mu_group.position));
2235         changed |= BSS_CHANGED_MU_GROUPS;
2236         sdata->vif.mu_mimo_owner = false;
2237
2238         sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2239
2240         del_timer_sync(&local->dynamic_ps_timer);
2241         cancel_work_sync(&local->dynamic_ps_enable_work);
2242
2243         /* Disable ARP filtering */
2244         if (sdata->vif.bss_conf.arp_addr_cnt)
2245                 changed |= BSS_CHANGED_ARP_FILTER;
2246
2247         sdata->vif.bss_conf.qos = false;
2248         changed |= BSS_CHANGED_QOS;
2249
2250         /* The BSSID (not really interesting) and HT changed */
2251         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
2252         ieee80211_bss_info_change_notify(sdata, changed);
2253
2254         /* disassociated - set to defaults now */
2255         ieee80211_set_wmm_default(sdata, false, false);
2256
2257         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
2258         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
2259         del_timer_sync(&sdata->u.mgd.timer);
2260         del_timer_sync(&sdata->u.mgd.chswitch_timer);
2261
2262         sdata->vif.bss_conf.dtim_period = 0;
2263         sdata->vif.bss_conf.beacon_rate = NULL;
2264
2265         ifmgd->have_beacon = false;
2266
2267         ifmgd->flags = 0;
2268         mutex_lock(&local->mtx);
2269         ieee80211_vif_release_channel(sdata);
2270
2271         sdata->vif.csa_active = false;
2272         ifmgd->csa_waiting_bcn = false;
2273         ifmgd->csa_ignored_same_chan = false;
2274         if (sdata->csa_block_tx) {
2275                 ieee80211_wake_vif_queues(local, sdata,
2276                                           IEEE80211_QUEUE_STOP_REASON_CSA);
2277                 sdata->csa_block_tx = false;
2278         }
2279         mutex_unlock(&local->mtx);
2280
2281         /* existing TX TSPEC sessions no longer exist */
2282         memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
2283         cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
2284
2285         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2286 }
2287
2288 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
2289                              struct ieee80211_hdr *hdr)
2290 {
2291         /*
2292          * We can postpone the mgd.timer whenever receiving unicast frames
2293          * from AP because we know that the connection is working both ways
2294          * at that time. But multicast frames (and hence also beacons) must
2295          * be ignored here, because we need to trigger the timer during
2296          * data idle periods for sending the periodic probe request to the
2297          * AP we're connected to.
2298          */
2299         if (is_multicast_ether_addr(hdr->addr1))
2300                 return;
2301
2302         ieee80211_sta_reset_conn_monitor(sdata);
2303 }
2304
2305 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
2306 {
2307         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2308         struct ieee80211_local *local = sdata->local;
2309
2310         mutex_lock(&local->mtx);
2311         if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
2312                 goto out;
2313
2314         __ieee80211_stop_poll(sdata);
2315
2316         mutex_lock(&local->iflist_mtx);
2317         ieee80211_recalc_ps(local);
2318         mutex_unlock(&local->iflist_mtx);
2319
2320         if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2321                 goto out;
2322
2323         /*
2324          * We've received a probe response, but are not sure whether
2325          * we have or will be receiving any beacons or data, so let's
2326          * schedule the timers again, just in case.
2327          */
2328         ieee80211_sta_reset_beacon_monitor(sdata);
2329
2330         mod_timer(&ifmgd->conn_mon_timer,
2331                   round_jiffies_up(jiffies +
2332                                    IEEE80211_CONNECTION_IDLE_TIME));
2333 out:
2334         mutex_unlock(&local->mtx);
2335 }
2336
2337 static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
2338                                            struct ieee80211_hdr *hdr,
2339                                            u16 tx_time)
2340 {
2341         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2342         u16 tid = ieee80211_get_tid(hdr);
2343         int ac = ieee80211_ac_from_tid(tid);
2344         struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
2345         unsigned long now = jiffies;
2346
2347         if (likely(!tx_tspec->admitted_time))
2348                 return;
2349
2350         if (time_after(now, tx_tspec->time_slice_start + HZ)) {
2351                 tx_tspec->consumed_tx_time = 0;
2352                 tx_tspec->time_slice_start = now;
2353
2354                 if (tx_tspec->downgraded) {
2355                         tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
2356                         schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
2357                 }
2358         }
2359
2360         if (tx_tspec->downgraded)
2361                 return;
2362
2363         tx_tspec->consumed_tx_time += tx_time;
2364
2365         if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
2366                 tx_tspec->downgraded = true;
2367                 tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
2368                 schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
2369         }
2370 }
2371
2372 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2373                              struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2374 {
2375         ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
2376
2377         if (!ieee80211_is_data(hdr->frame_control))
2378             return;
2379
2380         if (ieee80211_is_nullfunc(hdr->frame_control) &&
2381             sdata->u.mgd.probe_send_count > 0) {
2382                 if (ack)
2383                         ieee80211_sta_reset_conn_monitor(sdata);
2384                 else
2385                         sdata->u.mgd.nullfunc_failed = true;
2386                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2387                 return;
2388         }
2389
2390         if (ack)
2391                 ieee80211_sta_reset_conn_monitor(sdata);
2392 }
2393
2394 static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
2395                                           const u8 *src, const u8 *dst,
2396                                           const u8 *ssid, size_t ssid_len,
2397                                           struct ieee80211_channel *channel)
2398 {
2399         struct sk_buff *skb;
2400
2401         skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
2402                                         ssid, ssid_len, NULL, 0,
2403                                         IEEE80211_PROBE_FLAG_DIRECTED);
2404         if (skb)
2405                 ieee80211_tx_skb(sdata, skb);
2406 }
2407
2408 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
2409 {
2410         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2411         const u8 *ssid;
2412         u8 *dst = ifmgd->associated->bssid;
2413         u8 unicast_limit = max(1, max_probe_tries - 3);
2414         struct sta_info *sta;
2415
2416         /*
2417          * Try sending broadcast probe requests for the last three
2418          * probe requests after the first ones failed since some
2419          * buggy APs only support broadcast probe requests.
2420          */
2421         if (ifmgd->probe_send_count >= unicast_limit)
2422                 dst = NULL;
2423
2424         /*
2425          * When the hardware reports an accurate Tx ACK status, it's
2426          * better to send a nullfunc frame instead of a probe request,
2427          * as it will kick us off the AP quickly if we aren't associated
2428          * anymore. The timeout will be reset if the frame is ACKed by
2429          * the AP.
2430          */
2431         ifmgd->probe_send_count++;
2432
2433         if (dst) {
2434                 mutex_lock(&sdata->local->sta_mtx);
2435                 sta = sta_info_get(sdata, dst);
2436                 if (!WARN_ON(!sta))
2437                         ieee80211_check_fast_rx(sta);
2438                 mutex_unlock(&sdata->local->sta_mtx);
2439         }
2440
2441         if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2442                 ifmgd->nullfunc_failed = false;
2443                 ieee80211_send_nullfunc(sdata->local, sdata, false);
2444         } else {
2445                 int ssid_len;
2446
2447                 rcu_read_lock();
2448                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2449                 if (WARN_ON_ONCE(ssid == NULL))
2450                         ssid_len = 0;
2451                 else
2452                         ssid_len = ssid[1];
2453
2454                 ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
2455                                               ssid + 2, ssid_len,
2456                                               ifmgd->associated->channel);
2457                 rcu_read_unlock();
2458         }
2459
2460         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2461         run_again(sdata, ifmgd->probe_timeout);
2462 }
2463
2464 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
2465                                    bool beacon)
2466 {
2467         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2468         bool already = false;
2469
2470         if (!ieee80211_sdata_running(sdata))
2471                 return;
2472
2473         sdata_lock(sdata);
2474
2475         if (!ifmgd->associated)
2476                 goto out;
2477
2478         mutex_lock(&sdata->local->mtx);
2479
2480         if (sdata->local->tmp_channel || sdata->local->scanning) {
2481                 mutex_unlock(&sdata->local->mtx);
2482                 goto out;
2483         }
2484
2485         if (beacon) {
2486                 mlme_dbg_ratelimited(sdata,
2487                                      "detected beacon loss from AP (missed %d beacons) - probing\n",
2488                                      beacon_loss_count);
2489
2490                 ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2491         }
2492
2493         /*
2494          * The driver/our work has already reported this event or the
2495          * connection monitoring has kicked in and we have already sent
2496          * a probe request. Or maybe the AP died and the driver keeps
2497          * reporting until we disassociate...
2498          *
2499          * In either case we have to ignore the current call to this
2500          * function (except for setting the correct probe reason bit)
2501          * because otherwise we would reset the timer every time and
2502          * never check whether we received a probe response!
2503          */
2504         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
2505                 already = true;
2506
2507         ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
2508
2509         mutex_unlock(&sdata->local->mtx);
2510
2511         if (already)
2512                 goto out;
2513
2514         mutex_lock(&sdata->local->iflist_mtx);
2515         ieee80211_recalc_ps(sdata->local);
2516         mutex_unlock(&sdata->local->iflist_mtx);
2517
2518         ifmgd->probe_send_count = 0;
2519         ieee80211_mgd_probe_ap_send(sdata);
2520  out:
2521         sdata_unlock(sdata);
2522 }
2523
2524 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
2525                                           struct ieee80211_vif *vif)
2526 {
2527         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2528         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2529         struct cfg80211_bss *cbss;
2530         struct sk_buff *skb;
2531         const u8 *ssid;
2532         int ssid_len;
2533
2534         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2535                 return NULL;
2536
2537         sdata_assert_lock(sdata);
2538
2539         if (ifmgd->associated)
2540                 cbss = ifmgd->associated;
2541         else if (ifmgd->auth_data)
2542                 cbss = ifmgd->auth_data->bss;
2543         else if (ifmgd->assoc_data)
2544                 cbss = ifmgd->assoc_data->bss;
2545         else
2546                 return NULL;
2547
2548         rcu_read_lock();
2549         ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2550         if (WARN_ON_ONCE(ssid == NULL))
2551                 ssid_len = 0;
2552         else
2553                 ssid_len = ssid[1];
2554
2555         skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
2556                                         (u32) -1, cbss->channel,
2557                                         ssid + 2, ssid_len,
2558                                         NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
2559         rcu_read_unlock();
2560
2561         return skb;
2562 }
2563 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
2564
2565 static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
2566                                         const u8 *buf, size_t len, bool tx,
2567                                         u16 reason)
2568 {
2569         struct ieee80211_event event = {
2570                 .type = MLME_EVENT,
2571                 .u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
2572                 .u.mlme.reason = reason,
2573         };
2574
2575         if (tx)
2576                 cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
2577         else
2578                 cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
2579
2580         drv_event_callback(sdata->local, sdata, &event);
2581 }
2582
2583 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2584 {
2585         struct ieee80211_local *local = sdata->local;
2586         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2587         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2588         bool tx;
2589
2590         sdata_lock(sdata);
2591         if (!ifmgd->associated) {
2592                 sdata_unlock(sdata);
2593                 return;
2594         }
2595
2596         tx = !sdata->csa_block_tx;
2597
2598         /* AP is probably out of range (or not reachable for another reason) so
2599          * remove the bss struct for that AP.
2600          */
2601         cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);
2602
2603         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
2604                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2605                                tx, frame_buf);
2606         mutex_lock(&local->mtx);
2607         sdata->vif.csa_active = false;
2608         ifmgd->csa_waiting_bcn = false;
2609         if (sdata->csa_block_tx) {
2610                 ieee80211_wake_vif_queues(local, sdata,
2611                                           IEEE80211_QUEUE_STOP_REASON_CSA);
2612                 sdata->csa_block_tx = false;
2613         }
2614         mutex_unlock(&local->mtx);
2615
2616         ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
2617                                     WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
2618
2619         sdata_unlock(sdata);
2620 }
2621
2622 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
2623 {
2624         struct ieee80211_sub_if_data *sdata =
2625                 container_of(work, struct ieee80211_sub_if_data,
2626                              u.mgd.beacon_connection_loss_work);
2627         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2628
2629         if (ifmgd->associated)
2630                 ifmgd->beacon_loss_count++;
2631
2632         if (ifmgd->connection_loss) {
2633                 sdata_info(sdata, "Connection to AP %pM lost\n",
2634                            ifmgd->bssid);
2635                 __ieee80211_disconnect(sdata);
2636         } else {
2637                 ieee80211_mgd_probe_ap(sdata, true);
2638         }
2639 }
2640
2641 static void ieee80211_csa_connection_drop_work(struct work_struct *work)
2642 {
2643         struct ieee80211_sub_if_data *sdata =
2644                 container_of(work, struct ieee80211_sub_if_data,
2645                              u.mgd.csa_connection_drop_work);
2646
2647         __ieee80211_disconnect(sdata);
2648 }
2649
2650 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
2651 {
2652         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2653         struct ieee80211_hw *hw = &sdata->local->hw;
2654
2655         trace_api_beacon_loss(sdata);
2656
2657         sdata->u.mgd.connection_loss = false;
2658         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2659 }
2660 EXPORT_SYMBOL(ieee80211_beacon_loss);
2661
2662 void ieee80211_connection_loss(struct ieee80211_vif *vif)
2663 {
2664         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2665         struct ieee80211_hw *hw = &sdata->local->hw;
2666
2667         trace_api_connection_loss(sdata);
2668
2669         sdata->u.mgd.connection_loss = true;
2670         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2671 }
2672 EXPORT_SYMBOL(ieee80211_connection_loss);
2673
2674
2675 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
2676                                         bool assoc)
2677 {
2678         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2679
2680         sdata_assert_lock(sdata);
2681
2682         if (!assoc) {
2683                 /*
2684                  * we are not authenticated yet, the only timer that could be
2685                  * running is the timeout for the authentication response which
2686                  * which is not relevant anymore.
2687                  */
2688                 del_timer_sync(&sdata->u.mgd.timer);
2689                 sta_info_destroy_addr(sdata, auth_data->bss->bssid);
2690
2691                 eth_zero_addr(sdata->u.mgd.bssid);
2692                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2693                 sdata->u.mgd.flags = 0;
2694                 mutex_lock(&sdata->local->mtx);
2695                 ieee80211_vif_release_channel(sdata);
2696                 mutex_unlock(&sdata->local->mtx);
2697         }
2698
2699         cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
2700         kfree(auth_data);
2701         sdata->u.mgd.auth_data = NULL;
2702 }
2703
2704 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2705                                          bool assoc, bool abandon)
2706 {
2707         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2708
2709         sdata_assert_lock(sdata);
2710
2711         if (!assoc) {
2712                 /*
2713                  * we are not associated yet, the only timer that could be
2714                  * running is the timeout for the association response which
2715                  * which is not relevant anymore.
2716                  */
2717                 del_timer_sync(&sdata->u.mgd.timer);
2718                 sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
2719
2720                 eth_zero_addr(sdata->u.mgd.bssid);
2721                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2722                 sdata->u.mgd.flags = 0;
2723                 sdata->vif.mu_mimo_owner = false;
2724
2725                 mutex_lock(&sdata->local->mtx);
2726                 ieee80211_vif_release_channel(sdata);
2727                 mutex_unlock(&sdata->local->mtx);
2728
2729                 if (abandon)
2730                         cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
2731         }
2732
2733         kfree(assoc_data);
2734         sdata->u.mgd.assoc_data = NULL;
2735 }
2736
2737 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
2738                                      struct ieee80211_mgmt *mgmt, size_t len)
2739 {
2740         struct ieee80211_local *local = sdata->local;
2741         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2742         u8 *pos;
2743         struct ieee802_11_elems elems;
2744         u32 tx_flags = 0;
2745
2746         pos = mgmt->u.auth.variable;
2747         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2748         if (!elems.challenge)
2749                 return;
2750         auth_data->expected_transaction = 4;
2751         drv_mgd_prepare_tx(sdata->local, sdata, 0);
2752         if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2753                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2754                            IEEE80211_TX_INTFL_MLME_CONN_TX;
2755         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
2756                             elems.challenge - 2, elems.challenge_len + 2,
2757                             auth_data->bss->bssid, auth_data->bss->bssid,
2758                             auth_data->key, auth_data->key_len,
2759                             auth_data->key_idx, tx_flags);
2760 }
2761
2762 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
2763                                    struct ieee80211_mgmt *mgmt, size_t len)
2764 {
2765         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2766         u8 bssid[ETH_ALEN];
2767         u16 auth_alg, auth_transaction, status_code;
2768         struct sta_info *sta;
2769         struct ieee80211_event event = {
2770                 .type = MLME_EVENT,
2771                 .u.mlme.data = AUTH_EVENT,
2772         };
2773
2774         sdata_assert_lock(sdata);
2775
2776         if (len < 24 + 6)
2777                 return;
2778
2779         if (!ifmgd->auth_data || ifmgd->auth_data->done)
2780                 return;
2781
2782         memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
2783
2784         if (!ether_addr_equal(bssid, mgmt->bssid))
2785                 return;
2786
2787         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
2788         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
2789         status_code = le16_to_cpu(mgmt->u.auth.status_code);
2790
2791         if (auth_alg != ifmgd->auth_data->algorithm ||
2792             auth_transaction != ifmgd->auth_data->expected_transaction) {
2793                 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
2794                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
2795                            auth_transaction,
2796                            ifmgd->auth_data->expected_transaction);
2797                 return;
2798         }
2799
2800         if (status_code != WLAN_STATUS_SUCCESS) {
2801                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
2802                            mgmt->sa, status_code);
2803                 ieee80211_destroy_auth_data(sdata, false);
2804                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2805                 event.u.mlme.status = MLME_DENIED;
2806                 event.u.mlme.reason = status_code;
2807                 drv_event_callback(sdata->local, sdata, &event);
2808                 return;
2809         }
2810
2811         switch (ifmgd->auth_data->algorithm) {
2812         case WLAN_AUTH_OPEN:
2813         case WLAN_AUTH_LEAP:
2814         case WLAN_AUTH_FT:
2815         case WLAN_AUTH_SAE:
2816         case WLAN_AUTH_FILS_SK:
2817         case WLAN_AUTH_FILS_SK_PFS:
2818         case WLAN_AUTH_FILS_PK:
2819                 break;
2820         case WLAN_AUTH_SHARED_KEY:
2821                 if (ifmgd->auth_data->expected_transaction != 4) {
2822                         ieee80211_auth_challenge(sdata, mgmt, len);
2823                         /* need another frame */
2824                         return;
2825                 }
2826                 break;
2827         default:
2828                 WARN_ONCE(1, "invalid auth alg %d",
2829                           ifmgd->auth_data->algorithm);
2830                 return;
2831         }
2832
2833         event.u.mlme.status = MLME_SUCCESS;
2834         drv_event_callback(sdata->local, sdata, &event);
2835         sdata_info(sdata, "authenticated\n");
2836         ifmgd->auth_data->done = true;
2837         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2838         ifmgd->auth_data->timeout_started = true;
2839         run_again(sdata, ifmgd->auth_data->timeout);
2840
2841         if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
2842             ifmgd->auth_data->expected_transaction != 2) {
2843                 /*
2844                  * Report auth frame to user space for processing since another
2845                  * round of Authentication frames is still needed.
2846                  */
2847                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2848                 return;
2849         }
2850
2851         /* move station state to auth */
2852         mutex_lock(&sdata->local->sta_mtx);
2853         sta = sta_info_get(sdata, bssid);
2854         if (!sta) {
2855                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2856                 goto out_err;
2857         }
2858         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
2859                 sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2860                 goto out_err;
2861         }
2862         mutex_unlock(&sdata->local->sta_mtx);
2863
2864         cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2865         return;
2866  out_err:
2867         mutex_unlock(&sdata->local->sta_mtx);
2868         /* ignore frame -- wait for timeout */
2869 }
2870
2871 #define case_WLAN(type) \
2872         case WLAN_REASON_##type: return #type
2873
2874 static const char *ieee80211_get_reason_code_string(u16 reason_code)
2875 {
2876         switch (reason_code) {
2877         case_WLAN(UNSPECIFIED);
2878         case_WLAN(PREV_AUTH_NOT_VALID);
2879         case_WLAN(DEAUTH_LEAVING);
2880         case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
2881         case_WLAN(DISASSOC_AP_BUSY);
2882         case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
2883         case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
2884         case_WLAN(DISASSOC_STA_HAS_LEFT);
2885         case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
2886         case_WLAN(DISASSOC_BAD_POWER);
2887         case_WLAN(DISASSOC_BAD_SUPP_CHAN);
2888         case_WLAN(INVALID_IE);
2889         case_WLAN(MIC_FAILURE);
2890         case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
2891         case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
2892         case_WLAN(IE_DIFFERENT);
2893         case_WLAN(INVALID_GROUP_CIPHER);
2894         case_WLAN(INVALID_PAIRWISE_CIPHER);
2895         case_WLAN(INVALID_AKMP);
2896         case_WLAN(UNSUPP_RSN_VERSION);
2897         case_WLAN(INVALID_RSN_IE_CAP);
2898         case_WLAN(IEEE8021X_FAILED);
2899         case_WLAN(CIPHER_SUITE_REJECTED);
2900         case_WLAN(DISASSOC_UNSPECIFIED_QOS);
2901         case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
2902         case_WLAN(DISASSOC_LOW_ACK);
2903         case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
2904         case_WLAN(QSTA_LEAVE_QBSS);
2905         case_WLAN(QSTA_NOT_USE);
2906         case_WLAN(QSTA_REQUIRE_SETUP);
2907         case_WLAN(QSTA_TIMEOUT);
2908         case_WLAN(QSTA_CIPHER_NOT_SUPP);
2909         case_WLAN(MESH_PEER_CANCELED);
2910         case_WLAN(MESH_MAX_PEERS);
2911         case_WLAN(MESH_CONFIG);
2912         case_WLAN(MESH_CLOSE);
2913         case_WLAN(MESH_MAX_RETRIES);
2914         case_WLAN(MESH_CONFIRM_TIMEOUT);
2915         case_WLAN(MESH_INVALID_GTK);
2916         case_WLAN(MESH_INCONSISTENT_PARAM);
2917         case_WLAN(MESH_INVALID_SECURITY);
2918         case_WLAN(MESH_PATH_ERROR);
2919         case_WLAN(MESH_PATH_NOFORWARD);
2920         case_WLAN(MESH_PATH_DEST_UNREACHABLE);
2921         case_WLAN(MAC_EXISTS_IN_MBSS);
2922         case_WLAN(MESH_CHAN_REGULATORY);
2923         case_WLAN(MESH_CHAN);
2924         default: return "<unknown>";
2925         }
2926 }
2927
2928 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
2929                                      struct ieee80211_mgmt *mgmt, size_t len)
2930 {
2931         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2932         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2933
2934         sdata_assert_lock(sdata);
2935
2936         if (len < 24 + 2)
2937                 return;
2938
2939         if (ifmgd->associated &&
2940             ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
2941                 const u8 *bssid = ifmgd->associated->bssid;
2942
2943                 sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
2944                            bssid, reason_code,
2945                            ieee80211_get_reason_code_string(reason_code));
2946
2947                 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2948
2949                 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
2950                                             reason_code);
2951                 return;
2952         }
2953
2954         if (ifmgd->assoc_data &&
2955             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
2956                 const u8 *bssid = ifmgd->assoc_data->bss->bssid;
2957
2958                 sdata_info(sdata,
2959                            "deauthenticated from %pM while associating (Reason: %u=%s)\n",
2960                            bssid, reason_code,
2961                            ieee80211_get_reason_code_string(reason_code));
2962
2963                 ieee80211_destroy_assoc_data(sdata, false, true);
2964
2965                 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2966                 return;
2967         }
2968 }
2969
2970
2971 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
2972                                        struct ieee80211_mgmt *mgmt, size_t len)
2973 {
2974         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2975         u16 reason_code;
2976
2977         sdata_assert_lock(sdata);
2978
2979         if (len < 24 + 2)
2980                 return;
2981
2982         if (!ifmgd->associated ||
2983             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2984                 return;
2985
2986         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
2987
2988         sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
2989                    mgmt->sa, reason_code,
2990                    ieee80211_get_reason_code_string(reason_code));
2991
2992         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2993
2994         ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
2995 }
2996
2997 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
2998                                 u8 *supp_rates, unsigned int supp_rates_len,
2999                                 u32 *rates, u32 *basic_rates,
3000                                 bool *have_higher_than_11mbit,
3001                                 int *min_rate, int *min_rate_index,
3002                                 int shift)
3003 {
3004         int i, j;
3005
3006         for (i = 0; i < supp_rates_len; i++) {
3007                 int rate = supp_rates[i] & 0x7f;
3008                 bool is_basic = !!(supp_rates[i] & 0x80);
3009
3010                 if ((rate * 5 * (1 << shift)) > 110)
3011                         *have_higher_than_11mbit = true;
3012
3013                 /*
3014                  * Skip HT and VHT BSS membership selectors since they're not
3015                  * rates.
3016                  *
3017                  * Note: Even though the membership selector and the basic
3018                  *       rate flag share the same bit, they are not exactly
3019                  *       the same.
3020                  */
3021                 if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3022                     supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY))
3023                         continue;
3024
3025                 for (j = 0; j < sband->n_bitrates; j++) {
3026                         struct ieee80211_rate *br;
3027                         int brate;
3028
3029                         br = &sband->bitrates[j];
3030
3031                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
3032                         if (brate == rate) {
3033                                 *rates |= BIT(j);
3034                                 if (is_basic)
3035                                         *basic_rates |= BIT(j);
3036                                 if ((rate * 5) < *min_rate) {
3037                                         *min_rate = rate * 5;
3038                                         *min_rate_index = j;
3039                                 }
3040                                 break;
3041                         }
3042                 }
3043         }
3044 }
3045
3046 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
3047                                     struct cfg80211_bss *cbss,
3048                                     struct ieee80211_mgmt *mgmt, size_t len)
3049 {
3050         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3051         struct ieee80211_local *local = sdata->local;
3052         struct ieee80211_supported_band *sband;
3053         struct sta_info *sta;
3054         u8 *pos;
3055         u16 capab_info, aid;
3056         struct ieee802_11_elems elems;
3057         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3058         const struct cfg80211_bss_ies *bss_ies = NULL;
3059         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
3060         u32 changed = 0;
3061         int err;
3062         bool ret;
3063
3064         /* AssocResp and ReassocResp have identical structure */
3065
3066         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
3067         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3068
3069         /*
3070          * The 5 MSB of the AID field are reserved
3071          * (802.11-2016 9.4.1.8 AID field)
3072          */
3073         aid &= 0x7ff;
3074
3075         ifmgd->broken_ap = false;
3076
3077         if (aid == 0 || aid > IEEE80211_MAX_AID) {
3078                 sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
3079                            aid);
3080                 aid = 0;
3081                 ifmgd->broken_ap = true;
3082         }
3083
3084         pos = mgmt->u.assoc_resp.variable;
3085         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
3086
3087         if (!elems.supp_rates) {
3088                 sdata_info(sdata, "no SuppRates element in AssocResp\n");
3089                 return false;
3090         }
3091
3092         ifmgd->aid = aid;
3093         ifmgd->tdls_chan_switch_prohibited =
3094                 elems.ext_capab && elems.ext_capab_len >= 5 &&
3095                 (elems.ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
3096
3097         /*
3098          * Some APs are erroneously not including some information in their
3099          * (re)association response frames. Try to recover by using the data
3100          * from the beacon or probe response. This seems to afflict mobile
3101          * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
3102          * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
3103          */
3104         if ((assoc_data->wmm && !elems.wmm_param) ||
3105             (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3106              (!elems.ht_cap_elem || !elems.ht_operation)) ||
3107             (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3108              (!elems.vht_cap_elem || !elems.vht_operation))) {
3109                 const struct cfg80211_bss_ies *ies;
3110                 struct ieee802_11_elems bss_elems;
3111
3112                 rcu_read_lock();
3113                 ies = rcu_dereference(cbss->ies);
3114                 if (ies)
3115                         bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
3116                                           GFP_ATOMIC);
3117                 rcu_read_unlock();
3118                 if (!bss_ies)
3119                         return false;
3120
3121                 ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
3122                                        false, &bss_elems);
3123                 if (assoc_data->wmm &&
3124                     !elems.wmm_param && bss_elems.wmm_param) {
3125                         elems.wmm_param = bss_elems.wmm_param;
3126                         sdata_info(sdata,
3127                                    "AP bug: WMM param missing from AssocResp\n");
3128                 }
3129
3130                 /*
3131                  * Also check if we requested HT/VHT, otherwise the AP doesn't
3132                  * have to include the IEs in the (re)association response.
3133                  */
3134                 if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
3135                     !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3136                         elems.ht_cap_elem = bss_elems.ht_cap_elem;
3137                         sdata_info(sdata,
3138                                    "AP bug: HT capability missing from AssocResp\n");
3139                 }
3140                 if (!elems.ht_operation && bss_elems.ht_operation &&
3141                     !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3142                         elems.ht_operation = bss_elems.ht_operation;
3143                         sdata_info(sdata,
3144                                    "AP bug: HT operation missing from AssocResp\n");
3145                 }
3146                 if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
3147                     !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3148                         elems.vht_cap_elem = bss_elems.vht_cap_elem;
3149                         sdata_info(sdata,
3150                                    "AP bug: VHT capa missing from AssocResp\n");
3151                 }
3152                 if (!elems.vht_operation && bss_elems.vht_operation &&
3153                     !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3154                         elems.vht_operation = bss_elems.vht_operation;
3155                         sdata_info(sdata,
3156                                    "AP bug: VHT operation missing from AssocResp\n");
3157                 }
3158         }
3159
3160         /*
3161          * We previously checked these in the beacon/probe response, so
3162          * they should be present here. This is just a safety net.
3163          */
3164         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3165             (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
3166                 sdata_info(sdata,
3167                            "HT AP is missing WMM params or HT capability/operation\n");
3168                 ret = false;
3169                 goto out;
3170         }
3171
3172         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3173             (!elems.vht_cap_elem || !elems.vht_operation)) {
3174                 sdata_info(sdata,
3175                            "VHT AP is missing VHT capability/operation\n");
3176                 ret = false;
3177                 goto out;
3178         }
3179
3180         mutex_lock(&sdata->local->sta_mtx);
3181         /*
3182          * station info was already allocated and inserted before
3183          * the association and should be available to us
3184          */
3185         sta = sta_info_get(sdata, cbss->bssid);
3186         if (WARN_ON(!sta)) {
3187                 mutex_unlock(&sdata->local->sta_mtx);
3188                 ret = false;
3189                 goto out;
3190         }
3191
3192         sband = ieee80211_get_sband(sdata);
3193         if (!sband) {
3194                 mutex_unlock(&sdata->local->sta_mtx);
3195                 ret = false;
3196                 goto out;
3197         }
3198
3199         /*
3200          * If AP doesn't support HT, or it doesn't have HE mandatory IEs, mark
3201          * HE as disabled. If on the 5GHz band, make sure it supports VHT.
3202          */
3203         if (ifmgd->flags & IEEE80211_STA_DISABLE_HT ||
3204             (sband->band == NL80211_BAND_5GHZ &&
3205              ifmgd->flags & IEEE80211_STA_DISABLE_VHT) ||
3206             (!elems.he_cap && !elems.he_operation))
3207                 ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
3208
3209         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3210             (!elems.he_cap || !elems.he_operation)) {
3211                 mutex_unlock(&sdata->local->sta_mtx);
3212                 sdata_info(sdata,
3213                            "HE AP is missing HE capability/operation\n");
3214                 ret = false;
3215                 goto out;
3216         }
3217
3218         /* Set up internal HT/VHT capabilities */
3219         if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
3220                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3221                                                   elems.ht_cap_elem, sta);
3222
3223         if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
3224                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3225                                                     elems.vht_cap_elem, sta);
3226
3227         if (elems.he_operation && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3228             elems.he_cap) {
3229                 ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
3230                                                   elems.he_cap,
3231                                                   elems.he_cap_len,
3232                                                   sta);
3233
3234                 bss_conf->he_support = sta->sta.he_cap.has_he;
3235         } else {
3236                 bss_conf->he_support = false;
3237         }
3238
3239         if (bss_conf->he_support) {
3240                 u32 he_oper_params =
3241                         le32_to_cpu(elems.he_operation->he_oper_params);
3242
3243                 bss_conf->bss_color = he_oper_params &
3244                                       IEEE80211_HE_OPERATION_BSS_COLOR_MASK;
3245                 bss_conf->htc_trig_based_pkt_ext =
3246                         (he_oper_params &
3247                          IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK) <<
3248                         IEEE80211_HE_OPERATION_DFLT_PE_DURATION_OFFSET;
3249                 bss_conf->frame_time_rts_th =
3250                         (he_oper_params &
3251                          IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK) <<
3252                         IEEE80211_HE_OPERATION_RTS_THRESHOLD_OFFSET;
3253
3254                 bss_conf->multi_sta_back_32bit =
3255                         sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
3256                         IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP;
3257
3258                 bss_conf->ack_enabled =
3259                         sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
3260                         IEEE80211_HE_MAC_CAP2_ACK_EN;
3261
3262                 bss_conf->uora_exists = !!elems.uora_element;
3263                 if (elems.uora_element)
3264                         bss_conf->uora_ocw_range = elems.uora_element[0];
3265
3266                 /* TODO: OPEN: what happens if BSS color disable is set? */
3267         }
3268
3269         /*
3270          * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
3271          * in their association response, so ignore that data for our own
3272          * configuration. If it changed since the last beacon, we'll get the
3273          * next beacon and update then.
3274          */
3275
3276         /*
3277          * If an operating mode notification IE is present, override the
3278          * NSS calculation (that would be done in rate_control_rate_init())