projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge tag 'pci-v6.16-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
[linux-2.6-block.git] / net / mac80211 / mlme.c
CommitLineData
aa75cc02 1// SPDX-License-Identifier: GPL-2.0-only
f0706e82
JB		 2/*
3 * BSS client mode implementation
5394af4d 4 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
f0706e82
JB		 5 * Copyright 2004, Instant802 Networks, Inc.
6 * Copyright 2005, Devicescape Software, Inc.
7 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
d98ad83e 9 * Copyright 2013-2014 Intel Mobile Communications GmbH
e38a017b 10 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
8c60179b 11 * Copyright (C) 2018 - 2025 Intel Corporation
f0706e82
JB		 12 */
13
5b323edb 14#include <linux/delay.h>
5fdb3735 15#include <linux/fips.h>
f0706e82
JB		 16#include <linux/if_ether.h>
17#include <linux/skbuff.h>
f0706e82 18#include <linux/if_arp.h>
f0706e82 19#include <linux/etherdevice.h>
d9b93842 20#include <linux/moduleparam.h>
d0709a65 21#include <linux/rtnetlink.h>
d91f36db 22#include <linux/crc32.h>
5a0e3ad6 23#include <linux/slab.h>
bc3b2d7f 24#include <linux/export.h>
f0706e82 25#include <net/mac80211.h>
5f60d5f6 26#include <linux/unaligned.h>
60f8b39c 27
f0706e82 28#include "ieee80211_i.h"
24487981 29#include "driver-ops.h"
2c8dccc7
JB		 30#include "rate.h"
31#include "led.h"
39404fee 32#include "fils_aead.h"
f0706e82 33
41eba076
MK		 34#include <kunit/static_stub.h>
35
1672c0e3 36#define IEEE80211_AUTH_TIMEOUT (HZ / 5)
cb236d2d 37#define IEEE80211_AUTH_TIMEOUT_LONG (HZ / 2)
1672c0e3 38#define IEEE80211_AUTH_TIMEOUT_SHORT (HZ / 10)
407879b6 39#define IEEE80211_AUTH_TIMEOUT_SAE (HZ * 2)
1672c0e3
JB		 40#define IEEE80211_AUTH_MAX_TRIES 3
41#define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5)
94d9864c 42#define IEEE80211_AUTH_WAIT_SAE_RETRY (HZ * 2)
1672c0e3 43#define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
cb236d2d 44#define IEEE80211_ASSOC_TIMEOUT_LONG (HZ / 2)
1672c0e3
JB		 45#define IEEE80211_ASSOC_TIMEOUT_SHORT (HZ / 10)
46#define IEEE80211_ASSOC_MAX_TRIES 3
66e67e41 47
b1a23f8a
AB		 48#define IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS msecs_to_jiffies(100)
49#define IEEE80211_ADV_TTLM_ST_UNDERFLOW 0xff00
50
f7660b3f
AB		 51#define IEEE80211_NEG_TTLM_REQ_TIMEOUT (HZ / 5)
52
180205bd
BG		 53static int max_nullfunc_tries = 2;
54module_param(max_nullfunc_tries, int, 0644);
55MODULE_PARM_DESC(max_nullfunc_tries,
56 "Maximum nullfunc tx tries before disconnecting (reason 4).");
57
58static int max_probe_tries = 5;
59module_param(max_probe_tries, int, 0644);
60MODULE_PARM_DESC(max_probe_tries,
61 "Maximum probe tries before disconnecting (reason 4).");
b291ba11
JB		 62
63/*
7ccc8bd7
FF		 64 * Beacon loss timeout is calculated as N frames times the
65 * advertised beacon interval. This may need to be somewhat
66 * higher than what hardware might detect to account for
67 * delays in the host processing frames. But since we also
68 * probe on beacon miss before declaring the connection lost
69 * default to what we want.
b291ba11 70 */
59c1ec2b
BG		 71static int beacon_loss_count = 7;
72module_param(beacon_loss_count, int, 0644);
73MODULE_PARM_DESC(beacon_loss_count,
74 "Number of beacon intervals before we decide beacon was lost.");
7ccc8bd7 75
b291ba11
JB		 76/*
77 * Time the connection can be idle before we probe
78 * it to see if we can still talk to the AP.
79 */
d1c5091f 80#define IEEE80211_CONNECTION_IDLE_TIME (30 * HZ)
b291ba11
JB		 81/*
82 * Time we wait for a probe response after sending
83 * a probe request because of beacon loss or for
84 * checking the connection still works.
85 */
180205bd
BG		 86static int probe_wait_ms = 500;
87module_param(probe_wait_ms, int, 0644);
88MODULE_PARM_DESC(probe_wait_ms,
89 "Maximum time(ms) to wait for probe response"
90 " before disconnecting (reason 4).");
f0706e82 91
391a200a
JM		 92/*
93 * How many Beacon frames need to have been used in average signal strength
94 * before starting to indicate signal change events.
95 */
96#define IEEE80211_SIGNAL_AVE_MIN_COUNT 4
97
ca386f31
JB		 98/*
99 * We can have multiple work items (and connection probing)
100 * scheduling this timer, but we need to take care to only
101 * reschedule it when it should fire _earlier_ than it was
102 * asked for before, or if it's not pending right now. This
103 * function ensures that. Note that it then is required to
104 * run this function for all timeouts after the first one
105 * has happened -- the work that runs from this timer will
106 * do that.
107 */
8d61ffa5
JB		 108static void run_again(struct ieee80211_sub_if_data *sdata,
109 unsigned long timeout)
ca386f31 110{
076fc877 111 lockdep_assert_wiphy(sdata->local->hw.wiphy);
ca386f31 112
8d61ffa5
JB		 113 if (!timer_pending(&sdata->u.mgd.timer) ||
114 time_before(timeout, sdata->u.mgd.timer.expires))
115 mod_timer(&sdata->u.mgd.timer, timeout);
ca386f31
JB		 116}
117
d3a910a8 118void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
b291ba11 119{
c1288b12 120 if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
b291ba11
JB		 121 return;
122
30686bf7 123 if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
7eeff74c
JB		 124 return;
125
b291ba11 126 mod_timer(&sdata->u.mgd.bcn_mon_timer,
7ccc8bd7 127 round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
b291ba11
JB		 128}
129
be099e82
LR		 130void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
131{
0c699c3a
LR		 132 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
133
b100e5d6 134 if (unlikely(!ifmgd->associated))
8628172f
SG		 135 return;
136
b100e5d6
JB		 137 if (ifmgd->probe_send_count)
138 ifmgd->probe_send_count = 0;
448cd2e2 139
30686bf7 140 if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
be099e82
LR		 141 return;
142
b100e5d6 143 mod_timer(&ifmgd->conn_mon_timer,
be099e82
LR		 144 round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
145}
146
5484e237 147static int ecw2cw(int ecw)
60f8b39c 148{
5484e237 149 return (1 << ecw) - 1;
60f8b39c
JB		 150}
151
310c8387
JB		 152static enum ieee80211_conn_mode
153ieee80211_determine_ap_chan(struct ieee80211_sub_if_data *sdata,
154 struct ieee80211_channel *channel,
155 u32 vht_cap_info,
156 const struct ieee802_11_elems *elems,
157 bool ignore_ht_channel_mismatch,
158 const struct ieee80211_conn_settings *conn,
159 struct cfg80211_chan_def *chandef)
6565ec9b 160{
310c8387
JB		 161 const struct ieee80211_ht_operation *ht_oper = elems->ht_operation;
162 const struct ieee80211_vht_operation *vht_oper = elems->vht_operation;
163 const struct ieee80211_he_operation *he_oper = elems->he_operation;
164 const struct ieee80211_eht_operation *eht_oper = elems->eht_operation;
165 struct ieee80211_supported_band *sband =
166 sdata->local->hw.wiphy->bands[channel->band];
6565ec9b 167 struct cfg80211_chan_def vht_chandef;
310c8387 168 bool no_vht = false;
ba323e29 169 u32 ht_cfreq;
6565ec9b 170
3ad4fce6
JB		 171 if (ieee80211_hw_check(&sdata->local->hw, STRICT))
172 ignore_ht_channel_mismatch = false;
173
310c8387
JB		 174 *chandef = (struct cfg80211_chan_def) {
175 .chan = channel,
176 .width = NL80211_CHAN_WIDTH_20_NOHT,
177 .center_freq1 = channel->center_freq,
178 .freq1_offset = channel->freq_offset,
179 };
6565ec9b 180
310c8387
JB		 181 /* get special S1G case out of the way */
182 if (sband->band == NL80211_BAND_S1GHZ) {
183 if (!ieee80211_chandef_s1g_oper(elems->s1g_oper, chandef)) {
75f87eae
TP		 184 sdata_info(sdata,
185 "Missing S1G Operation Element? Trying operating == primary\n");
186 chandef->width = ieee80211_s1g_channel_width(channel);
187 }
57fa5e85 188
310c8387 189 return IEEE80211_CONN_MODE_S1G;
1d00ce80
TP		 190 }
191
310c8387
JB		 192 /* get special 6 GHz case out of the way */
193 if (sband->band == NL80211_BAND_6GHZ) {
194 enum ieee80211_conn_mode mode = IEEE80211_CONN_MODE_EHT;
75f87eae 195
310c8387
JB		 196 /* this is an error */
197 if (conn->mode < IEEE80211_CONN_MODE_HE)
198 return IEEE80211_CONN_MODE_LEGACY;
199
200 if (!elems->he_6ghz_capa || !elems->he_cap) {
201 sdata_info(sdata,
202 "HE 6 GHz AP is missing HE/HE 6 GHz band capability\n");
203 return IEEE80211_CONN_MODE_LEGACY;
204 }
205
206 if (!eht_oper || !elems->eht_cap) {
207 eht_oper = NULL;
208 mode = IEEE80211_CONN_MODE_HE;
209 }
210
2d9698dd 211 if (!ieee80211_chandef_he_6ghz_oper(sdata->local, he_oper,
310c8387
JB		 212 eht_oper, chandef)) {
213 sdata_info(sdata, "bad HE/EHT 6 GHz operation\n");
214 return IEEE80211_CONN_MODE_LEGACY;
215 }
216
217 return mode;
6565ec9b
JB		 218 }
219
310c8387
JB		 220 /* now we have the progression HT, VHT, ... */
221 if (conn->mode < IEEE80211_CONN_MODE_HT)
222 return IEEE80211_CONN_MODE_LEGACY;
223
224 if (!ht_oper || !elems->ht_cap_elem)
225 return IEEE80211_CONN_MODE_LEGACY;
226
6565ec9b
JB		 227 chandef->width = NL80211_CHAN_WIDTH_20;
228
229 ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
230 channel->band);
231 /* check that channel matches the right operating channel */
310c8387 232 if (!ignore_ht_channel_mismatch && channel->center_freq != ht_cfreq) {
6565ec9b
JB		 233 /*
234 * It's possible that some APs are confused here;
235 * Netgear WNDR3700 sometimes reports 4 higher than
236 * the actual channel in association responses, but
237 * since we look at probe response/beacon data here
238 * it should be OK.
239 */
5cdaed1e
JB		 240 sdata_info(sdata,
241 "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
242 channel->center_freq, ht_cfreq,
243 ht_oper->primary_chan, channel->band);
310c8387 244 return IEEE80211_CONN_MODE_LEGACY;
6565ec9b
JB		 245 }
246
310c8387 247 ieee80211_chandef_ht_oper(ht_oper, chandef);
6565ec9b 248
310c8387
JB		 249 if (conn->mode < IEEE80211_CONN_MODE_VHT)
250 return IEEE80211_CONN_MODE_HT;
6565ec9b 251
8ac3c704 252 vht_chandef = *chandef;
310c8387
JB		 253
254 /*
255 * having he_cap/he_oper parsed out implies we're at
256 * least operating as HE STA
257 */
258 if (elems->he_cap && he_oper &&
259 he_oper->he_oper_params & cpu_to_le32(IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
41cbb0f5
LC		 260 struct ieee80211_vht_operation he_oper_vht_cap;
261
262 /*
263 * Set only first 3 bytes (other 2 aren't used in
264 * ieee80211_chandef_vht_oper() anyway)
265 */
266 memcpy(&he_oper_vht_cap, he_oper->optional, 3);
267 he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);
268
2a333a0d 269 if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
7eb26df2 270 &he_oper_vht_cap, ht_oper,
41cbb0f5 271 &vht_chandef)) {
310c8387
JB		 272 sdata_info(sdata,
273 "HE AP VHT information is invalid, disabling HE\n");
274 /* this will cause us to re-parse as VHT STA */
275 return IEEE80211_CONN_MODE_VHT;
41cbb0f5 276 }
310c8387
JB		 277 } else if (!vht_oper || !elems->vht_cap_elem) {
278 if (sband->band == NL80211_BAND_5GHZ) {
279 sdata_info(sdata,
280 "VHT information is missing, disabling VHT\n");
281 return IEEE80211_CONN_MODE_HT;
282 }
283 no_vht = true;
284 } else if (sband->band == NL80211_BAND_2GHZ) {
285 no_vht = true;
2a333a0d
JB		 286 } else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
287 vht_cap_info,
288 vht_oper, ht_oper,
289 &vht_chandef)) {
310c8387
JB		 290 sdata_info(sdata,
291 "AP VHT information is invalid, disabling VHT\n");
292 return IEEE80211_CONN_MODE_HT;
6565ec9b
JB		 293 }
294
310c8387
JB		 295 if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
296 sdata_info(sdata,
297 "AP VHT information doesn't match HT, disabling VHT\n");
298 return IEEE80211_CONN_MODE_HT;
6565ec9b
JB		 299 }
300
310c8387 301 *chandef = vht_chandef;
6565ec9b 302
310c8387
JB		 303 /* stick to current max mode if we or the AP don't have HE */
304 if (conn->mode < IEEE80211_CONN_MODE_HE ||
305 !elems->he_operation || !elems->he_cap) {
306 if (no_vht)
307 return IEEE80211_CONN_MODE_HT;
308 return IEEE80211_CONN_MODE_VHT;
6565ec9b
JB		 309 }
310
310c8387
JB		 311 /* stick to HE if we or the AP don't have EHT */
312 if (conn->mode < IEEE80211_CONN_MODE_EHT ||
313 !eht_oper || !elems->eht_cap)
314 return IEEE80211_CONN_MODE_HE;
6565ec9b 315
1e0b3b0b
IP		 316 /*
317 * handle the case that the EHT operation indicates that it holds EHT
318 * operation information (in case that the channel width differs from
319 * the channel width reported in HT/VHT/HE).
320 */
310c8387 321 if (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) {
1e0b3b0b
IP		 322 struct cfg80211_chan_def eht_chandef = *chandef;
323
b3239498 324 ieee80211_chandef_eht_oper((const void *)eht_oper->optional,
2d9698dd 325 &eht_chandef);
1e0b3b0b 326
b82730bf
JB		 327 eht_chandef.punctured =
328 ieee80211_eht_oper_dis_subchan_bitmap(eht_oper);
329
1e0b3b0b 330 if (!cfg80211_chandef_valid(&eht_chandef)) {
310c8387
JB		 331 sdata_info(sdata,
332 "AP EHT information is invalid, disabling EHT\n");
333 return IEEE80211_CONN_MODE_HE;
1e0b3b0b
IP		 334 }
335
336 if (!cfg80211_chandef_compatible(chandef, &eht_chandef)) {
310c8387
JB		 337 sdata_info(sdata,
338 "AP EHT information doesn't match HT/VHT/HE, disabling EHT\n");
339 return IEEE80211_CONN_MODE_HE;
1e0b3b0b
IP		 340 }
341
342 *chandef = eht_chandef;
343 }
344
310c8387 345 return IEEE80211_CONN_MODE_EHT;
6565ec9b
JB		 346}
347
574faa0e
BB		 348static bool
349ieee80211_verify_sta_ht_mcs_support(struct ieee80211_sub_if_data *sdata,
350 struct ieee80211_supported_band *sband,
351 const struct ieee80211_ht_operation *ht_op)
352{
353 struct ieee80211_sta_ht_cap sta_ht_cap;
354 int i;
355
356 if (sband->band == NL80211_BAND_6GHZ)
357 return true;
358
359 if (!ht_op)
360 return false;
361
362 memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
363 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
364
365 /*
366 * P802.11REVme/D7.0 - 6.5.4.2.4
367 * ...
368 * If the MLME of an HT STA receives an MLME-JOIN.request primitive
369 * with the SelectedBSS parameter containing a Basic HT-MCS Set field
370 * in the HT Operation parameter that contains any unsupported MCSs,
371 * the MLME response in the resulting MLME-JOIN.confirm primitive shall
372 * contain a ResultCode parameter that is not set to the value SUCCESS.
373 * ...
374 */
375
376 /* Simply check that all basic rates are in the STA RX mask */
377 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
378 if ((ht_op->basic_set[i] & sta_ht_cap.mcs.rx_mask[i]) !=
379 ht_op->basic_set[i])
380 return false;
381 }
382
383 return true;
384}
385
386static bool
387ieee80211_verify_sta_vht_mcs_support(struct ieee80211_sub_if_data *sdata,
388 int link_id,
389 struct ieee80211_supported_band *sband,
390 const struct ieee80211_vht_operation *vht_op)
391{
392 struct ieee80211_sta_vht_cap sta_vht_cap;
393 u16 ap_min_req_set, sta_rx_mcs_map, sta_tx_mcs_map;
394 int nss;
395
396 if (sband->band != NL80211_BAND_5GHZ)
397 return true;
398
399 if (!vht_op)
400 return false;
401
402 memcpy(&sta_vht_cap, &sband->vht_cap, sizeof(sta_vht_cap));
403 ieee80211_apply_vhtcap_overrides(sdata, &sta_vht_cap);
404
405 ap_min_req_set = le16_to_cpu(vht_op->basic_mcs_set);
406 sta_rx_mcs_map = le16_to_cpu(sta_vht_cap.vht_mcs.rx_mcs_map);
407 sta_tx_mcs_map = le16_to_cpu(sta_vht_cap.vht_mcs.tx_mcs_map);
408
409 /*
410 * Many APs are incorrectly advertising an all-zero value here,
411 * which really means MCS 0-7 are required for 1-8 streams, but
412 * they don't really mean it that way.
413 * Some other APs are incorrectly advertising 3 spatial streams
414 * with MCS 0-7 are required, but don't really mean it that way
415 * and we'll connect only with HT, rather than even HE.
416 * As a result, unfortunately the VHT basic MCS/NSS set cannot
417 * be used at all, so check it only in strict mode.
418 */
419 if (!ieee80211_hw_check(&sdata->local->hw, STRICT))
420 return true;
421
422 /*
423 * P802.11REVme/D7.0 - 6.5.4.2.4
424 * ...
425 * If the MLME of a VHT STA receives an MLME-JOIN.request primitive
426 * with a SelectedBSS parameter containing a Basic VHT-MCS And NSS Set
427 * field in the VHT Operation parameter that contains any unsupported
428 * <VHT-MCS, NSS> tuple, the MLME response in the resulting
429 * MLME-JOIN.confirm primitive shall contain a ResultCode parameter
430 * that is not set to the value SUCCESS.
431 * ...
432 */
433 for (nss = 8; nss > 0; nss--) {
434 u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
435 u8 sta_rx_val;
436 u8 sta_tx_val;
437
438 if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
439 continue;
440
441 sta_rx_val = (sta_rx_mcs_map >> (2 * (nss - 1))) & 3;
442 sta_tx_val = (sta_tx_mcs_map >> (2 * (nss - 1))) & 3;
443
444 if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
445 sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
446 sta_rx_val < ap_op_val || sta_tx_val < ap_op_val) {
447 link_id_info(sdata, link_id,
448 "Missing mandatory rates for %d Nss, rx %d, tx %d oper %d, disable VHT\n",
449 nss, sta_rx_val, sta_tx_val, ap_op_val);
450 return false;
451 }
452 }
453
454 return true;
455}
456
310c8387
JB		 457static bool
458ieee80211_verify_peer_he_mcs_support(struct ieee80211_sub_if_data *sdata,
2e3de34f 459 int link_id,
310c8387
JB		 460 const struct ieee80211_he_cap_elem *he_cap,
461 const struct ieee80211_he_operation *he_op)
d5522e03 462{
310c8387
JB		 463 struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
464 u16 mcs_80_map_tx, mcs_80_map_rx;
465 u16 ap_min_req_set;
466 int nss;
1128958d 467
310c8387
JB		 468 if (!he_cap)
469 return false;
30eb1dc2 470
310c8387
JB		 471 /* mcs_nss is right after he_cap info */
472 he_mcs_nss_supp = (void *)(he_cap + 1);
5dca295d 473
310c8387
JB		 474 mcs_80_map_tx = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
475 mcs_80_map_rx = le16_to_cpu(he_mcs_nss_supp->rx_mcs_80);
41cbb0f5 476
310c8387
JB		 477 /* P802.11-REVme/D0.3
478 * 27.1.1 Introduction to the HE PHY
479 * ...
480 * An HE STA shall support the following features:
481 * ...
482 * Single spatial stream HE-MCSs 0 to 7 (transmit and receive) in all
483 * supported channel widths for HE SU PPDUs
017b45bb 484 */
310c8387
JB		 485 if ((mcs_80_map_tx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED ||
486 (mcs_80_map_rx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED) {
2e3de34f
BB		 487 link_id_info(sdata, link_id,
488 "Missing mandatory rates for 1 Nss, rx 0x%x, tx 0x%x, disable HE\n",
489 mcs_80_map_tx, mcs_80_map_rx);
310c8387 490 return false;
017b45bb
AA		 491 }
492
310c8387
JB		 493 if (!he_op)
494 return true;
2a333a0d 495
310c8387 496 ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
30eb1dc2
JB		 497
498 /*
310c8387
JB		 499 * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
500 * zeroes, which is nonsense, and completely inconsistent with itself
501 * (it doesn't have 8 streams). Accept the settings in this case anyway.
30eb1dc2 502 */
3ad4fce6 503 if (!ieee80211_hw_check(&sdata->local->hw, STRICT) && !ap_min_req_set)
310c8387 504 return true;
30eb1dc2 505
310c8387
JB		 506 /* make sure the AP is consistent with itself
507 *
508 * P802.11-REVme/D0.3
509 * 26.17.1 Basic HE BSS operation
510 *
511 * A STA that is operating in an HE BSS shall be able to receive and
512 * transmit at each of the <HE-MCS, NSS> tuple values indicated by the
513 * Basic HE-MCS And NSS Set field of the HE Operation parameter of the
514 * MLME-START.request primitive and shall be able to receive at each of
515 * the <HE-MCS, NSS> tuple values indicated by the Supported HE-MCS and
516 * NSS Set field in the HE Capabilities parameter of the MLMESTART.request
517 * primitive
518 */
519 for (nss = 8; nss > 0; nss--) {
520 u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
521 u8 ap_rx_val;
522 u8 ap_tx_val;
30eb1dc2 523
310c8387
JB		 524 if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
525 continue;
d6c37509 526
310c8387
JB		 527 ap_rx_val = (mcs_80_map_rx >> (2 * (nss - 1))) & 3;
528 ap_tx_val = (mcs_80_map_tx >> (2 * (nss - 1))) & 3;
529
530 if (ap_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
531 ap_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
532 ap_rx_val < ap_op_val || ap_tx_val < ap_op_val) {
2e3de34f
BB		 533 link_id_info(sdata, link_id,
534 "Invalid rates for %d Nss, rx %d, tx %d oper %d, disable HE\n",
535 nss, ap_rx_val, ap_tx_val, ap_op_val);
310c8387
JB		 536 return false;
537 }
30eb1dc2 538 }
7cc44ed4 539
310c8387 540 return true;
d5522e03
JB		 541}
542
310c8387
JB		 543static bool
544ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
545 struct ieee80211_supported_band *sband,
546 const struct ieee80211_he_operation *he_op)
66e67e41 547{
310c8387
JB		 548 const struct ieee80211_sta_he_cap *sta_he_cap =
549 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
550 u16 ap_min_req_set;
551 int i;
66e67e41 552
310c8387
JB		 553 if (!sta_he_cap || !he_op)
554 return false;
66e67e41 555
310c8387 556 ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
66e67e41 557
24398e39 558 /*
310c8387
JB		 559 * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
560 * zeroes, which is nonsense, and completely inconsistent with itself
561 * (it doesn't have 8 streams). Accept the settings in this case anyway.
24398e39 562 */
3ad4fce6 563 if (!ieee80211_hw_check(&sdata->local->hw, STRICT) && !ap_min_req_set)
310c8387 564 return true;
24398e39 565
310c8387
JB		 566 /* Need to go over for 80MHz, 160MHz and for 80+80 */
567 for (i = 0; i < 3; i++) {
568 const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
569 &sta_he_cap->he_mcs_nss_supp;
570 u16 sta_mcs_map_rx =
571 le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
572 u16 sta_mcs_map_tx =
573 le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
574 u8 nss;
575 bool verified = true;
576
577 /*
578 * For each band there is a maximum of 8 spatial streams
579 * possible. Each of the sta_mcs_map_* is a 16-bit struct built
580 * of 2 bits per NSS (1-8), with the values defined in enum
581 * ieee80211_he_mcs_support. Need to make sure STA TX and RX
582 * capabilities aren't less than the AP's minimum requirements
583 * for this HE BSS per SS.
584 * It is enough to find one such band that meets the reqs.
585 */
586 for (nss = 8; nss > 0; nss--) {
587 u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
588 u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
589 u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
590
591 if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
592 continue;
593
594 /*
595 * Make sure the HE AP doesn't require MCSs that aren't
596 * supported by the client as required by spec
597 *
598 * P802.11-REVme/D0.3
599 * 26.17.1 Basic HE BSS operation
600 *
601 * An HE STA shall not attempt to join * (MLME-JOIN.request primitive)
602 * a BSS, unless it supports (i.e., is able to both transmit and
603 * receive using) all of the <HE-MCS, NSS> tuples in the basic
604 * HE-MCS and NSS set.
605 */
606 if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
607 sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
608 (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
609 verified = false;
610 break;
611 }
612 }
613
614 if (verified)
615 return true;
616 }
617
618 /* If here, STA doesn't meet AP's HE min requirements */
619 return false;
620}
621
622static u8
623ieee80211_get_eht_cap_mcs_nss(const struct ieee80211_sta_he_cap *sta_he_cap,
624 const struct ieee80211_sta_eht_cap *sta_eht_cap,
625 unsigned int idx, int bw)
626{
627 u8 he_phy_cap0 = sta_he_cap->he_cap_elem.phy_cap_info[0];
628 u8 eht_phy_cap0 = sta_eht_cap->eht_cap_elem.phy_cap_info[0];
629
630 /* handle us being a 20 MHz-only EHT STA - with four values
631 * for MCS 0-7, 8-9, 10-11, 12-13.
632 */
633 if (!(he_phy_cap0 & IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK_ALL))
634 return sta_eht_cap->eht_mcs_nss_supp.only_20mhz.rx_tx_max_nss[idx];
635
636 /* the others have MCS 0-9 together, rather than separately from 0-7 */
637 if (idx > 0)
638 idx--;
639
640 switch (bw) {
641 case 0:
642 return sta_eht_cap->eht_mcs_nss_supp.bw._80.rx_tx_max_nss[idx];
643 case 1:
644 if (!(he_phy_cap0 &
645 (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
646 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)))
647 return 0xff; /* pass check */
648 return sta_eht_cap->eht_mcs_nss_supp.bw._160.rx_tx_max_nss[idx];
649 case 2:
650 if (!(eht_phy_cap0 & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ))
651 return 0xff; /* pass check */
652 return sta_eht_cap->eht_mcs_nss_supp.bw._320.rx_tx_max_nss[idx];
653 }
654
655 WARN_ON(1);
656 return 0;
657}
658
659static bool
660ieee80211_verify_sta_eht_mcs_support(struct ieee80211_sub_if_data *sdata,
661 struct ieee80211_supported_band *sband,
662 const struct ieee80211_eht_operation *eht_op)
663{
664 const struct ieee80211_sta_he_cap *sta_he_cap =
665 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
666 const struct ieee80211_sta_eht_cap *sta_eht_cap =
667 ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
668 const struct ieee80211_eht_mcs_nss_supp_20mhz_only *req;
669 unsigned int i;
670
671 if (!sta_he_cap || !sta_eht_cap || !eht_op)
672 return false;
673
674 req = &eht_op->basic_mcs_nss;
675
676 for (i = 0; i < ARRAY_SIZE(req->rx_tx_max_nss); i++) {
677 u8 req_rx_nss, req_tx_nss;
678 unsigned int bw;
679
680 req_rx_nss = u8_get_bits(req->rx_tx_max_nss[i],
681 IEEE80211_EHT_MCS_NSS_RX);
682 req_tx_nss = u8_get_bits(req->rx_tx_max_nss[i],
683 IEEE80211_EHT_MCS_NSS_TX);
684
685 for (bw = 0; bw < 3; bw++) {
686 u8 have, have_rx_nss, have_tx_nss;
687
688 have = ieee80211_get_eht_cap_mcs_nss(sta_he_cap,
689 sta_eht_cap,
690 i, bw);
691 have_rx_nss = u8_get_bits(have,
692 IEEE80211_EHT_MCS_NSS_RX);
693 have_tx_nss = u8_get_bits(have,
694 IEEE80211_EHT_MCS_NSS_TX);
695
696 if (req_rx_nss > have_rx_nss ||
697 req_tx_nss > have_tx_nss)
698 return false;
699 }
700 }
701
702 return true;
703}
704
8ee0b202
BB		 705static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
706 const u8 *supp_rates,
707 unsigned int supp_rates_len,
708d06b3
BB		 708 const u8 *ext_supp_rates,
709 unsigned int ext_supp_rates_len,
8ee0b202
BB		 710 u32 *rates, u32 *basic_rates,
711 unsigned long *unknown_rates_selectors,
712 bool *have_higher_than_11mbit,
713 int *min_rate, int *min_rate_index)
714{
715 int i, j;
716
708d06b3
BB		 717 for (i = 0; i < supp_rates_len + ext_supp_rates_len; i++) {
718 u8 supp_rate = i < supp_rates_len ?
719 supp_rates[i] :
720 ext_supp_rates[i - supp_rates_len];
721 int rate = supp_rate & 0x7f;
722 bool is_basic = !!(supp_rate & 0x80);
8ee0b202
BB		 723
724 if ((rate * 5) > 110 && have_higher_than_11mbit)
725 *have_higher_than_11mbit = true;
726
727 /*
728 * Skip membership selectors since they're not rates.
729 *
730 * Note: Even though the membership selector and the basic
731 * rate flag share the same bit, they are not exactly
732 * the same.
733 */
734 if (is_basic && rate >= BSS_MEMBERSHIP_SELECTOR_MIN) {
735 if (unknown_rates_selectors)
736 set_bit(rate, unknown_rates_selectors);
737 continue;
738 }
739
740 for (j = 0; j < sband->n_bitrates; j++) {
741 struct ieee80211_rate *br;
742 int brate;
743
744 br = &sband->bitrates[j];
745
746 brate = DIV_ROUND_UP(br->bitrate, 5);
747 if (brate == rate) {
748 if (rates)
749 *rates |= BIT(j);
750 if (is_basic && basic_rates)
751 *basic_rates |= BIT(j);
752 if (min_rate && (rate * 5) < *min_rate) {
753 *min_rate = rate * 5;
754 if (min_rate_index)
755 *min_rate_index = j;
756 }
757 break;
758 }
759 }
760
761 /* Handle an unknown entry as if it is an unknown selector */
762 if (is_basic && unknown_rates_selectors && j == sband->n_bitrates)
763 set_bit(rate, unknown_rates_selectors);
764 }
765}
766
b82730bf
JB		 767static bool ieee80211_chandef_usable(struct ieee80211_sub_if_data *sdata,
768 const struct cfg80211_chan_def *chandef,
769 u32 prohibited_flags)
770{
771 if (!cfg80211_chandef_usable(sdata->local->hw.wiphy,
772 chandef, prohibited_flags))
773 return false;
774
775 if (chandef->punctured &&
776 ieee80211_hw_check(&sdata->local->hw, DISALLOW_PUNCTURING))
777 return false;
778
6943e003
JB		 779 if (chandef->punctured && chandef->chan->band == NL80211_BAND_5GHZ &&
780 ieee80211_hw_check(&sdata->local->hw, DISALLOW_PUNCTURING_5GHZ))
781 return false;
782
b82730bf
JB		 783 return true;
784}
785
39dc8b8e
JB		 786static int ieee80211_chandef_num_subchans(const struct cfg80211_chan_def *c)
787{
788 if (c->width == NL80211_CHAN_WIDTH_80P80)
789 return 4 + 4;
790
34670beb 791 return cfg80211_chandef_get_width(c) / 20;
39dc8b8e
JB		 792}
793
794static int ieee80211_chandef_num_widths(const struct cfg80211_chan_def *c)
795{
796 switch (c->width) {
797 case NL80211_CHAN_WIDTH_20:
798 case NL80211_CHAN_WIDTH_20_NOHT:
799 return 1;
800 case NL80211_CHAN_WIDTH_40:
801 return 2;
802 case NL80211_CHAN_WIDTH_80P80:
803 case NL80211_CHAN_WIDTH_80:
804 return 3;
805 case NL80211_CHAN_WIDTH_160:
806 return 4;
807 case NL80211_CHAN_WIDTH_320:
808 return 5;
809 default:
810 WARN_ON(1);
811 return 0;
812 }
813}
814
815VISIBLE_IF_MAC80211_KUNIT int
816ieee80211_calc_chandef_subchan_offset(const struct cfg80211_chan_def *ap,
817 u8 n_partial_subchans)
818{
819 int n = ieee80211_chandef_num_subchans(ap);
820 struct cfg80211_chan_def tmp = *ap;
821 int offset = 0;
822
823 /*
824 * Given a chandef (in this context, it's the AP's) and a number
825 * of subchannels that we want to look at ('n_partial_subchans'),
826 * calculate the offset in number of subchannels between the full
827 * and the subset with the desired width.
828 */
829
830 /* same number of subchannels means no offset, obviously */
831 if (n == n_partial_subchans)
832 return 0;
833
834 /* don't WARN - misconfigured APs could cause this if their N > width */
835 if (n < n_partial_subchans)
836 return 0;
837
838 while (ieee80211_chandef_num_subchans(&tmp) > n_partial_subchans) {
839 u32 prev = tmp.center_freq1;
840
841 ieee80211_chandef_downgrade(&tmp, NULL);
842
843 /*
844 * if center_freq moved up, half the original channels
845 * are gone now but were below, so increase offset
846 */
847 if (prev < tmp.center_freq1)
848 offset += ieee80211_chandef_num_subchans(&tmp);
849 }
850
851 /*
852 * 80+80 with secondary 80 below primary - four subchannels for it
853 * (we cannot downgrade *to* 80+80, so no need to consider 'tmp')
854 */
855 if (ap->width == NL80211_CHAN_WIDTH_80P80 &&
856 ap->center_freq2 < ap->center_freq1)
857 offset += 4;
858
859 return offset;
860}
861EXPORT_SYMBOL_IF_MAC80211_KUNIT(ieee80211_calc_chandef_subchan_offset);
862
863VISIBLE_IF_MAC80211_KUNIT void
864ieee80211_rearrange_tpe_psd(struct ieee80211_parsed_tpe_psd *psd,
865 const struct cfg80211_chan_def *ap,
866 const struct cfg80211_chan_def *used)
867{
868 u8 needed = ieee80211_chandef_num_subchans(used);
869 u8 have = ieee80211_chandef_num_subchans(ap);
870 u8 tmp[IEEE80211_TPE_PSD_ENTRIES_320MHZ];
871 u8 offset;
872
873 if (!psd->valid)
874 return;
875
876 /* if N is zero, all defaults were used, no point in rearranging */
877 if (!psd->n)
878 goto out;
879
880 BUILD_BUG_ON(sizeof(tmp) != sizeof(psd->power));
881
882 /*
883 * This assumes that 'N' is consistent with the HE channel, as
884 * it should be (otherwise the AP is broken).
885 *
886 * In psd->power we have values in the order 0..N, 0..K, where
887 * N+K should cover the entire channel per 'ap', but even if it
888 * doesn't then we've pre-filled 'unlimited' as defaults.
889 *
890 * But this is all the wrong order, we want to have them in the
891 * order of the 'used' channel.
892 *
893 * So for example, we could have a 320 MHz EHT AP, which has the
894 * HE channel as 80 MHz (e.g. due to puncturing, which doesn't
895 * seem to be considered for the TPE), as follows:
896 *
897 * EHT 320: | | | | | | | | | | | | | | | | |
898 * HE 80: | | | | |
899 * used 160: | | | | | | | | |
900 *
901 * N entries: |--|--|--|--|
902 * K entries: |--|--|--|--|--|--|--|--| |--|--|--|--|
903 * power idx: 4 5 6 7 8 9 10 11 0 1 2 3 12 13 14 15
904 * full chan: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
905 * used chan: 0 1 2 3 4 5 6 7
906 *
907 * The idx in the power array ('power idx') is like this since it
908 * comes directly from the element's N and K entries in their
909 * element order, and those are this way for HE compatibility.
910 *
911 * Rearrange them as desired here, first by putting them into the
912 * 'full chan' order, and then selecting the necessary subset for
913 * the 'used chan'.
914 */
915
916 /* first reorder according to AP channel */
917 offset = ieee80211_calc_chandef_subchan_offset(ap, psd->n);
918 for (int i = 0; i < have; i++) {
919 if (i < offset)
920 tmp[i] = psd->power[i + psd->n];
921 else if (i < offset + psd->n)
922 tmp[i] = psd->power[i - offset];
923 else
924 tmp[i] = psd->power[i];
925 }
926
927 /*
928 * and then select the subset for the used channel
929 * (set everything to defaults first in case a driver is confused)
930 */
931 memset(psd->power, IEEE80211_TPE_PSD_NO_LIMIT, sizeof(psd->power));
932 offset = ieee80211_calc_chandef_subchan_offset(ap, needed);
933 for (int i = 0; i < needed; i++)
934 psd->power[i] = tmp[offset + i];
935
936out:
937 /* limit, but don't lie if there are defaults in the data */
938 if (needed < psd->count)
939 psd->count = needed;
940}
941EXPORT_SYMBOL_IF_MAC80211_KUNIT(ieee80211_rearrange_tpe_psd);
942
943static void ieee80211_rearrange_tpe(struct ieee80211_parsed_tpe *tpe,
944 const struct cfg80211_chan_def *ap,
945 const struct cfg80211_chan_def *used)
946{
947 /* ignore this completely for narrow/invalid channels */
948 if (!ieee80211_chandef_num_subchans(ap) ||
949 !ieee80211_chandef_num_subchans(used)) {
950 ieee80211_clear_tpe(tpe);
951 return;
952 }
953
954 for (int i = 0; i < 2; i++) {
955 int needed_pwr_count;
956
957 ieee80211_rearrange_tpe_psd(&tpe->psd_local[i], ap, used);
958 ieee80211_rearrange_tpe_psd(&tpe->psd_reg_client[i], ap, used);
959
960 /* limit this to the widths we actually need */
961 needed_pwr_count = ieee80211_chandef_num_widths(used);
962 if (needed_pwr_count < tpe->max_local[i].count)
963 tpe->max_local[i].count = needed_pwr_count;
964 if (needed_pwr_count < tpe->max_reg_client[i].count)
965 tpe->max_reg_client[i].count = needed_pwr_count;
966 }
967}
968
9f472520
JB		 969/*
970 * The AP part of the channel request is used to distinguish settings
971 * to the device used for wider bandwidth OFDMA. This is used in the
972 * channel context code to assign two channel contexts even if they're
973 * both for the same channel, if the AP bandwidths are incompatible.
974 * If not EHT (or driver override) then ap.chan == NULL indicates that
975 * there's no wider BW OFDMA used.
976 */
977static void ieee80211_set_chanreq_ap(struct ieee80211_sub_if_data *sdata,
978 struct ieee80211_chan_req *chanreq,
979 struct ieee80211_conn_settings *conn,
980 struct cfg80211_chan_def *ap_chandef)
981{
982 chanreq->ap.chan = NULL;
983
984 if (conn->mode < IEEE80211_CONN_MODE_EHT)
985 return;
986 if (sdata->vif.driver_flags & IEEE80211_VIF_IGNORE_OFDMA_WIDER_BW)
987 return;
988
989 chanreq->ap = *ap_chandef;
990}
991
b46524b5 992VISIBLE_IF_MAC80211_KUNIT struct ieee802_11_elems *
310c8387
JB		 993ieee80211_determine_chan_mode(struct ieee80211_sub_if_data *sdata,
994 struct ieee80211_conn_settings *conn,
995 struct cfg80211_bss *cbss, int link_id,
39dc8b8e 996 struct ieee80211_chan_req *chanreq,
8ee0b202
BB		 997 struct cfg80211_chan_def *ap_chandef,
998 unsigned long *userspace_selectors)
310c8387 999{
310c8387
JB		 1000 const struct cfg80211_bss_ies *ies = rcu_dereference(cbss->ies);
1001 struct ieee80211_bss *bss = (void *)cbss->priv;
1002 struct ieee80211_channel *channel = cbss->channel;
1003 struct ieee80211_elems_parse_params parse_params = {
1004 .link_id = -1,
1005 .from_ap = true,
1006 .start = ies->data,
1007 .len = ies->len,
310c8387
JB		 1008 };
1009 struct ieee802_11_elems *elems;
1010 struct ieee80211_supported_band *sband;
310c8387 1011 enum ieee80211_conn_mode ap_mode;
8ee0b202
BB		 1012 unsigned long unknown_rates_selectors[BITS_TO_LONGS(128)] = {};
1013 unsigned long sta_selectors[BITS_TO_LONGS(128)] = {};
310c8387
JB		 1014 int ret;
1015
1016again:
645acc6f 1017 parse_params.mode = conn->mode;
310c8387
JB		 1018 elems = ieee802_11_parse_elems_full(&parse_params);
1019 if (!elems)
1020 return ERR_PTR(-ENOMEM);
1021
1022 ap_mode = ieee80211_determine_ap_chan(sdata, channel, bss->vht_cap_info,
39dc8b8e 1023 elems, false, conn, ap_chandef);
310c8387 1024
310c8387
JB		 1025 /* this should be impossible since parsing depends on our mode */
1026 if (WARN_ON(ap_mode > conn->mode)) {
1027 ret = -EINVAL;
1028 goto free;
1029 }
1030
2fb5dfe1
JB		 1031 if (conn->mode != ap_mode) {
1032 conn->mode = ap_mode;
1033 kfree(elems);
1034 goto again;
1035 }
1036
1037 mlme_link_id_dbg(sdata, link_id, "determined AP %pM to be %s\n",
1038 cbss->bssid, ieee80211_conn_mode_str(ap_mode));
1039
310c8387
JB		 1040 sband = sdata->local->hw.wiphy->bands[channel->band];
1041
8ee0b202 1042 ieee80211_get_rates(sband, elems->supp_rates, elems->supp_rates_len,
708d06b3 1043 elems->ext_supp_rates, elems->ext_supp_rates_len,
8ee0b202
BB		 1044 NULL, NULL, unknown_rates_selectors, NULL, NULL,
1045 NULL);
1046
310c8387
JB		 1047 switch (channel->band) {
1048 case NL80211_BAND_S1GHZ:
1049 if (WARN_ON(ap_mode != IEEE80211_CONN_MODE_S1G)) {
1050 ret = -EINVAL;
1051 goto free;
1052 }
1053 return elems;
1054 case NL80211_BAND_6GHZ:
1055 if (ap_mode < IEEE80211_CONN_MODE_HE) {
2e3de34f
BB		 1056 link_id_info(sdata, link_id,
1057 "Rejecting non-HE 6/7 GHz connection");
310c8387
JB		 1058 ret = -EINVAL;
1059 goto free;
1060 }
1061 break;
1062 default:
1063 if (WARN_ON(ap_mode == IEEE80211_CONN_MODE_S1G)) {
1064 ret = -EINVAL;
1065 goto free;
1066 }
1067 }
1068
1069 switch (ap_mode) {
1070 case IEEE80211_CONN_MODE_S1G:
1071 WARN_ON(1);
1072 ret = -EINVAL;
1073 goto free;
1074 case IEEE80211_CONN_MODE_LEGACY:
1075 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
1076 break;
1077 case IEEE80211_CONN_MODE_HT:
1078 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
1079 conn->bw_limit,
1080 IEEE80211_CONN_BW_LIMIT_40);
1081 break;
1082 case IEEE80211_CONN_MODE_VHT:
1083 case IEEE80211_CONN_MODE_HE:
1084 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
1085 conn->bw_limit,
1086 IEEE80211_CONN_BW_LIMIT_160);
1087 break;
1088 case IEEE80211_CONN_MODE_EHT:
1089 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
1090 conn->bw_limit,
1091 IEEE80211_CONN_BW_LIMIT_320);
1092 break;
1093 }
1094
39dc8b8e 1095 chanreq->oper = *ap_chandef;
310c8387 1096
8ee0b202
BB		 1097 bitmap_copy(sta_selectors, userspace_selectors, 128);
1098 if (conn->mode >= IEEE80211_CONN_MODE_HT)
1099 set_bit(BSS_MEMBERSHIP_SELECTOR_HT_PHY, sta_selectors);
1100 if (conn->mode >= IEEE80211_CONN_MODE_VHT)
1101 set_bit(BSS_MEMBERSHIP_SELECTOR_VHT_PHY, sta_selectors);
1102 if (conn->mode >= IEEE80211_CONN_MODE_HE)
1103 set_bit(BSS_MEMBERSHIP_SELECTOR_HE_PHY, sta_selectors);
1104 if (conn->mode >= IEEE80211_CONN_MODE_EHT)
1105 set_bit(BSS_MEMBERSHIP_SELECTOR_EHT_PHY, sta_selectors);
1106
1107 /*
1108 * We do not support EPD or GLK so never add them.
1109 * SAE_H2E is handled through userspace_selectors.
1110 */
1111
1112 /* Check if we support all required features */
1113 if (!bitmap_subset(unknown_rates_selectors, sta_selectors, 128)) {
1114 link_id_info(sdata, link_id,
1115 "required basic rate or BSS membership selectors not supported or disabled, rejecting connection\n");
1116 ret = -EINVAL;
1117 goto free;
1118 }
1119
9f472520 1120 ieee80211_set_chanreq_ap(sdata, chanreq, conn, ap_chandef);
761748f0 1121
b82730bf
JB		 1122 while (!ieee80211_chandef_usable(sdata, &chanreq->oper,
1123 IEEE80211_CHAN_DISABLED)) {
761748f0 1124 if (WARN_ON(chanreq->oper.width == NL80211_CHAN_WIDTH_20_NOHT)) {
310c8387
JB		 1125 ret = -EINVAL;
1126 goto free;
1127 }
1128
761748f0 1129 ieee80211_chanreq_downgrade(chanreq, conn);
310c8387
JB		 1130 }
1131
1132 if (conn->mode >= IEEE80211_CONN_MODE_HE &&
761748f0 1133 !cfg80211_chandef_usable(sdata->wdev.wiphy, &chanreq->oper,
310c8387
JB		 1134 IEEE80211_CHAN_NO_HE)) {
1135 conn->mode = IEEE80211_CONN_MODE_VHT;
1136 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
1137 conn->bw_limit,
1138 IEEE80211_CONN_BW_LIMIT_160);
1139 }
1140
1141 if (conn->mode >= IEEE80211_CONN_MODE_EHT &&
761748f0 1142 !cfg80211_chandef_usable(sdata->wdev.wiphy, &chanreq->oper,
310c8387
JB		 1143 IEEE80211_CHAN_NO_EHT)) {
1144 conn->mode = IEEE80211_CONN_MODE_HE;
1145 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
1146 conn->bw_limit,
1147 IEEE80211_CONN_BW_LIMIT_160);
1148 }
1149
39dc8b8e 1150 if (chanreq->oper.width != ap_chandef->width || ap_mode != conn->mode)
2e3de34f
BB		 1151 link_id_info(sdata, link_id,
1152 "regulatory prevented using AP config, downgraded\n");
310c8387 1153
574faa0e
BB		 1154 if (conn->mode >= IEEE80211_CONN_MODE_HT &&
1155 !ieee80211_verify_sta_ht_mcs_support(sdata, sband,
1156 elems->ht_operation)) {
1157 conn->mode = IEEE80211_CONN_MODE_LEGACY;
1158 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
1159 link_id_info(sdata, link_id,
1160 "required MCSes not supported, disabling HT\n");
1161 }
1162
1163 if (conn->mode >= IEEE80211_CONN_MODE_VHT &&
1164 !ieee80211_verify_sta_vht_mcs_support(sdata, link_id, sband,
1165 elems->vht_operation)) {
1166 conn->mode = IEEE80211_CONN_MODE_HT;
1167 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
1168 conn->bw_limit,
1169 IEEE80211_CONN_BW_LIMIT_40);
1170 link_id_info(sdata, link_id,
1171 "required MCSes not supported, disabling VHT\n");
1172 }
1173
310c8387 1174 if (conn->mode >= IEEE80211_CONN_MODE_HE &&
2e3de34f
BB		 1175 (!ieee80211_verify_peer_he_mcs_support(sdata, link_id,
1176 (void *)elems->he_cap,
310c8387
JB		 1177 elems->he_operation) ||
1178 !ieee80211_verify_sta_he_mcs_support(sdata, sband,
1179 elems->he_operation))) {
1180 conn->mode = IEEE80211_CONN_MODE_VHT;
2e3de34f
BB		 1181 link_id_info(sdata, link_id,
1182 "required MCSes not supported, disabling HE\n");
310c8387
JB		 1183 }
1184
1185 if (conn->mode >= IEEE80211_CONN_MODE_EHT &&
1186 !ieee80211_verify_sta_eht_mcs_support(sdata, sband,
1187 elems->eht_operation)) {
1188 conn->mode = IEEE80211_CONN_MODE_HE;
1189 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
1190 conn->bw_limit,
1191 IEEE80211_CONN_BW_LIMIT_160);
2e3de34f
BB		 1192 link_id_info(sdata, link_id,
1193 "required MCSes not supported, disabling EHT\n");
310c8387
JB		 1194 }
1195
310c8387 1196 /* the mode can only decrease, so this must terminate */
1ac6f60a
JB		 1197 if (ap_mode != conn->mode) {
1198 kfree(elems);
310c8387 1199 goto again;
1ac6f60a 1200 }
310c8387
JB		 1201
1202 mlme_link_id_dbg(sdata, link_id,
1203 "connecting with %s mode, max bandwidth %d MHz\n",
1204 ieee80211_conn_mode_str(conn->mode),
1205 20 * (1 << conn->bw_limit));
1206
761748f0 1207 if (WARN_ON_ONCE(!cfg80211_chandef_valid(&chanreq->oper))) {
310c8387
JB		 1208 ret = -EINVAL;
1209 goto free;
1210 }
1211
1212 return elems;
1213free:
1214 kfree(elems);
1215 return ERR_PTR(ret);
1216}
b46524b5 1217EXPORT_SYMBOL_IF_MAC80211_KUNIT(ieee80211_determine_chan_mode);
310c8387
JB		 1218
1219static int ieee80211_config_bw(struct ieee80211_link_data *link,
1220 struct ieee802_11_elems *elems,
69f95565
JB		 1221 bool update, u64 *changed,
1222 const char *frame)
310c8387 1223{
6092077a 1224 struct ieee80211_channel *channel = link->conf->chanreq.oper.chan;
310c8387 1225 struct ieee80211_sub_if_data *sdata = link->sdata;
6092077a 1226 struct ieee80211_chan_req chanreq = {};
5a009b42 1227 struct cfg80211_chan_def ap_chandef;
310c8387
JB		 1228 enum ieee80211_conn_mode ap_mode;
1229 u32 vht_cap_info = 0;
1230 u16 ht_opmode;
1231 int ret;
1232
1233 /* don't track any bandwidth changes in legacy/S1G modes */
1234 if (link->u.mgd.conn.mode == IEEE80211_CONN_MODE_LEGACY ||
1235 link->u.mgd.conn.mode == IEEE80211_CONN_MODE_S1G)
1236 return 0;
1237
1238 if (elems->vht_cap_elem)
1239 vht_cap_info = le32_to_cpu(elems->vht_cap_elem->vht_cap_info);
1240
1241 ap_mode = ieee80211_determine_ap_chan(sdata, channel, vht_cap_info,
1242 elems, true, &link->u.mgd.conn,
5a009b42 1243 &ap_chandef);
310c8387
JB		 1244
1245 if (ap_mode != link->u.mgd.conn.mode) {
1246 link_info(link,
69f95565
JB		 1247 "AP %pM appears to change mode (expected %s, found %s) in %s, disconnect\n",
1248 link->u.mgd.bssid,
310c8387 1249 ieee80211_conn_mode_str(link->u.mgd.conn.mode),
69f95565 1250 ieee80211_conn_mode_str(ap_mode), frame);
310c8387
JB		 1251 return -EINVAL;
1252 }
1253
5a009b42 1254 chanreq.oper = ap_chandef;
9f472520
JB		 1255 ieee80211_set_chanreq_ap(sdata, &chanreq, &link->u.mgd.conn,
1256 &ap_chandef);
761748f0 1257
310c8387
JB		 1258 /*
1259 * if HT operation mode changed store the new one -
1260 * this may be applicable even if channel is identical
1261 */
1262 if (elems->ht_operation) {
1263 ht_opmode = le16_to_cpu(elems->ht_operation->operation_mode);
1264 if (link->conf->ht_operation_mode != ht_opmode) {
1265 *changed |= BSS_CHANGED_HT;
1266 link->conf->ht_operation_mode = ht_opmode;
1267 }
1268 }
1269
1270 /*
1271 * Downgrade the new channel if we associated with restricted
1272 * bandwidth capabilities. For example, if we associated as a
1273 * 20 MHz STA to a 40 MHz AP (due to regulatory, capabilities
1274 * or config reasons) then switching to a 40 MHz channel now
1275 * won't do us any good -- we couldn't use it with the AP.
1276 */
1277 while (link->u.mgd.conn.bw_limit <
761748f0
JB		 1278 ieee80211_min_bw_limit_from_chandef(&chanreq.oper))
1279 ieee80211_chandef_downgrade(&chanreq.oper, NULL);
310c8387 1280
5a009b42
JB		 1281 if (ap_chandef.chan->band == NL80211_BAND_6GHZ &&
1282 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HE) {
1283 ieee80211_rearrange_tpe(&elems->tpe, &ap_chandef,
1284 &chanreq.oper);
1285 if (memcmp(&link->conf->tpe, &elems->tpe, sizeof(elems->tpe))) {
1286 link->conf->tpe = elems->tpe;
1287 *changed |= BSS_CHANGED_TPE;
1288 }
1289 }
1290
761748f0 1291 if (ieee80211_chanreq_identical(&chanreq, &link->conf->chanreq))
310c8387
JB		 1292 return 0;
1293
1294 link_info(link,
69f95565
JB		 1295 "AP %pM changed bandwidth in %s, new used config is %d.%03d MHz, width %d (%d.%03d/%d MHz)\n",
1296 link->u.mgd.bssid, frame, chanreq.oper.chan->center_freq,
761748f0
JB		 1297 chanreq.oper.chan->freq_offset, chanreq.oper.width,
1298 chanreq.oper.center_freq1, chanreq.oper.freq1_offset,
1299 chanreq.oper.center_freq2);
310c8387 1300
761748f0 1301 if (!cfg80211_chandef_valid(&chanreq.oper)) {
310c8387 1302 sdata_info(sdata,
69f95565
JB		 1303 "AP %pM changed caps/bw in %s in a way we can't support - disconnect\n",
1304 link->u.mgd.bssid, frame);
310c8387
JB		 1305 return -EINVAL;
1306 }
1307
6bc574a7
JB		 1308 if (!update) {
1309 link->conf->chanreq = chanreq;
1310 return 0;
1311 }
1312
310c8387
JB		 1313 /*
1314 * We're tracking the current AP here, so don't do any further checks
1315 * here. This keeps us from playing ping-pong with regulatory, without
1316 * it the following can happen (for example):
1317 * - connect to an AP with 80 MHz, world regdom allows 80 MHz
1318 * - AP advertises regdom US
1319 * - CRDA loads regdom US with 80 MHz prohibited (old database)
1320 * - we detect an unsupported channel and disconnect
1321 * - disconnect causes CRDA to reload world regdomain and the game
1322 * starts anew.
1323 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
1324 *
1325 * It seems possible that there are still scenarios with CSA or real
1326 * bandwidth changes where a this could happen, but those cases are
1327 * less common and wouldn't completely prevent using the AP.
1328 */
1329
6092077a 1330 ret = ieee80211_link_change_chanreq(link, &chanreq, changed);
310c8387
JB		 1331 if (ret) {
1332 sdata_info(sdata,
69f95565
JB		 1333 "AP %pM changed bandwidth in %s to incompatible one - disconnect\n",
1334 link->u.mgd.bssid, frame);
310c8387
JB		 1335 return ret;
1336 }
1337
1338 cfg80211_schedule_channels_check(&sdata->wdev);
1339 return 0;
1340}
1341
1342/* frame sending functions */
1343
1344static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
1345 struct sk_buff *skb, u8 ap_ht_param,
1346 struct ieee80211_supported_band *sband,
1347 struct ieee80211_channel *channel,
1348 enum ieee80211_smps_mode smps,
1349 const struct ieee80211_conn_settings *conn)
1350{
1351 u8 *pos;
1352 u32 flags = channel->flags;
1353 u16 cap;
1354 struct ieee80211_sta_ht_cap ht_cap;
1355
1356 BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
1357
1358 memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
1359 ieee80211_apply_htcap_overrides(sdata, &ht_cap);
1360
1361 /* determine capability flags */
1362 cap = ht_cap.cap;
1363
1364 switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
1365 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
1366 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
1367 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
1368 cap &= ~IEEE80211_HT_CAP_SGI_40;
1369 }
1370 break;
1371 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
1372 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
1373 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
1374 cap &= ~IEEE80211_HT_CAP_SGI_40;
1375 }
1376 break;
1377 }
1378
1379 /*
1380 * If 40 MHz was disabled associate as though we weren't
1381 * capable of 40 MHz -- some broken APs will never fall
1382 * back to trying to transmit in 20 MHz.
1383 */
1384 if (conn->bw_limit <= IEEE80211_CONN_BW_LIMIT_20) {
1385 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
1386 cap &= ~IEEE80211_HT_CAP_SGI_40;
1387 }
1388
1389 /* set SM PS mode properly */
1390 cap &= ~IEEE80211_HT_CAP_SM_PS;
1391 switch (smps) {
1392 case IEEE80211_SMPS_AUTOMATIC:
1393 case IEEE80211_SMPS_NUM_MODES:
1394 WARN_ON(1);
1395 fallthrough;
1396 case IEEE80211_SMPS_OFF:
1397 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
1398 IEEE80211_HT_CAP_SM_PS_SHIFT;
1399 break;
1400 case IEEE80211_SMPS_STATIC:
1401 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
1402 IEEE80211_HT_CAP_SM_PS_SHIFT;
66e67e41
JB		 1403 break;
1404 case IEEE80211_SMPS_DYNAMIC:
1405 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
1406 IEEE80211_HT_CAP_SM_PS_SHIFT;
1407 break;
1408 }
1409
1410 /* reserve and fill IE */
1411 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
1412 ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
1413}
1414
322cd406
SS		 1415/* This function determines vht capability flags for the association
1416 * and builds the IE.
df9a9c44 1417 * Note - the function returns true to own the MU-MIMO capability
322cd406 1418 */
df9a9c44 1419static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
d545daba 1420 struct sk_buff *skb,
b08fbbd8 1421 struct ieee80211_supported_band *sband,
df9a9c44 1422 struct ieee80211_vht_cap *ap_vht_cap,
310c8387 1423 const struct ieee80211_conn_settings *conn)
d545daba 1424{
322cd406 1425 struct ieee80211_local *local = sdata->local;
d545daba
MP		 1426 u8 *pos;
1427 u32 cap;
1428 struct ieee80211_sta_vht_cap vht_cap;
c1cf6d4e 1429 u32 mask, ap_bf_sts, our_bf_sts;
df9a9c44 1430 bool mu_mimo_owner = false;
d545daba
MP		 1431
1432 BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
1433
1434 memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
dd5ecfea 1435 ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
d545daba
MP		 1436
1437 /* determine capability flags */
1438 cap = vht_cap.cap;
1439
310c8387 1440 if (conn->bw_limit <= IEEE80211_CONN_BW_LIMIT_80) {
f2d9d270 1441 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
575f0530 1442 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
f2d9d270
JB		 1443 }
1444
b08fbbd8
JB		 1445 /*
1446 * Some APs apparently get confused if our capabilities are better
1447 * than theirs, so restrict what we advertise in the assoc request.
1448 */
3ad4fce6
JB		 1449 if (!ieee80211_hw_check(&local->hw, STRICT)) {
1450 if (!(ap_vht_cap->vht_cap_info &
1451 cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
1452 cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
1453 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1454 else if (!(ap_vht_cap->vht_cap_info &
1455 cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
1456 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
1457 }
322cd406
SS		 1458
1459 /*
ab4040df 1460 * If some other vif is using the MU-MIMO capability we cannot associate
322cd406
SS		 1461 * using MU-MIMO - this will lead to contradictions in the group-id
1462 * mechanism.
1463 * Ownership is defined since association request, in order to avoid
1464 * simultaneous associations with MU-MIMO.
1465 */
1466 if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
1467 bool disable_mu_mimo = false;
1468 struct ieee80211_sub_if_data *other;
1469
ac351800 1470 list_for_each_entry(other, &local->interfaces, list) {
d0a9123e 1471 if (other->vif.bss_conf.mu_mimo_owner) {
322cd406
SS		 1472 disable_mu_mimo = true;
1473 break;
1474 }
1475 }
1476 if (disable_mu_mimo)
1477 cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
1478 else
df9a9c44 1479 mu_mimo_owner = true;
322cd406 1480 }
b08fbbd8 1481
c1cf6d4e
ES		 1482 mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
1483
1484 ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
1485 our_bf_sts = cap & mask;
1486
1487 if (ap_bf_sts < our_bf_sts) {
1488 cap &= ~mask;
1489 cap |= ap_bf_sts;
1490 }
1491
d545daba 1492 /* reserve and fill IE */
d4950281 1493 pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
d545daba 1494 ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
df9a9c44
JB		 1495
1496 return mu_mimo_owner;
d545daba
MP		 1497}
1498
3ad4fce6
JB		 1499static void ieee80211_assoc_add_rates(struct ieee80211_local *local,
1500 struct sk_buff *skb,
c1690b66
JB		 1501 enum nl80211_chan_width width,
1502 struct ieee80211_supported_band *sband,
1503 struct ieee80211_mgd_assoc_data *assoc_data)
1504{
147ceae2 1505 u32 rates;
c1690b66 1506
3ad4fce6
JB		 1507 if (assoc_data->supp_rates_len &&
1508 !ieee80211_hw_check(&local->hw, STRICT)) {
c1690b66
JB		 1509 /*
1510 * Get all rates supported by the device and the AP as
1511 * some APs don't like getting a superset of their rates
1512 * in the association request (e.g. D-Link DAP 1353 in
1513 * b-only mode)...
1514 */
147ceae2
JB		 1515 ieee80211_parse_bitrates(width, sband,
1516 assoc_data->supp_rates,
1517 assoc_data->supp_rates_len,
1518 &rates);
c1690b66
JB		 1519 } else {
1520 /*
1521 * In case AP not provide any supported rates information
1522 * before association, we send information element(s) with
1523 * all rates that we support.
1524 */
147ceae2 1525 rates = ~0;
c1690b66
JB		 1526 }
1527
996c15bd 1528 ieee80211_put_srates_elem(skb, sband, 0, ~rates,
147ceae2 1529 WLAN_EID_SUPP_RATES);
996c15bd 1530 ieee80211_put_srates_elem(skb, sband, 0, ~rates,
147ceae2 1531 WLAN_EID_EXT_SUPP_RATES);
c1690b66
JB		 1532}
1533
3c68cb81
JB		 1534static size_t ieee80211_add_before_ht_elems(struct sk_buff *skb,
1535 const u8 *elems,
1536 size_t elems_len,
1537 size_t offset)
1538{
1539 size_t noffset;
1540
1541 static const u8 before_ht[] = {
1542 WLAN_EID_SSID,
1543 WLAN_EID_SUPP_RATES,
1544 WLAN_EID_EXT_SUPP_RATES,
1545 WLAN_EID_PWR_CAPABILITY,
1546 WLAN_EID_SUPPORTED_CHANNELS,
1547 WLAN_EID_RSN,
1548 WLAN_EID_QOS_CAPA,
1549 WLAN_EID_RRM_ENABLED_CAPABILITIES,
1550 WLAN_EID_MOBILITY_DOMAIN,
1551 WLAN_EID_FAST_BSS_TRANSITION, /* reassoc only */
1552 WLAN_EID_RIC_DATA, /* reassoc only */
1553 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
1554 };
1555 static const u8 after_ric[] = {
1556 WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
1557 WLAN_EID_HT_CAPABILITY,
1558 WLAN_EID_BSS_COEX_2040,
1559 /* luckily this is almost always there */
1560 WLAN_EID_EXT_CAPABILITY,
1561 WLAN_EID_QOS_TRAFFIC_CAPA,
1562 WLAN_EID_TIM_BCAST_REQ,
1563 WLAN_EID_INTERWORKING,
1564 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
1565 WLAN_EID_VHT_CAPABILITY,
1566 WLAN_EID_OPMODE_NOTIF,
1567 };
1568
1569 if (!elems_len)
1570 return offset;
1571
1572 noffset = ieee80211_ie_split_ric(elems, elems_len,
1573 before_ht,
1574 ARRAY_SIZE(before_ht),
1575 after_ric,
1576 ARRAY_SIZE(after_ric),
1577 offset);
1578 skb_put_data(skb, elems + offset, noffset - offset);
1579
1580 return noffset;
1581}
1582
1583static size_t ieee80211_add_before_vht_elems(struct sk_buff *skb,
1584 const u8 *elems,
1585 size_t elems_len,
1586 size_t offset)
1587{
1588 static const u8 before_vht[] = {
1589 /*
1590 * no need to list the ones split off before HT
1591 * or generated here
1592 */
1593 WLAN_EID_BSS_COEX_2040,
1594 WLAN_EID_EXT_CAPABILITY,
1595 WLAN_EID_QOS_TRAFFIC_CAPA,
1596 WLAN_EID_TIM_BCAST_REQ,
1597 WLAN_EID_INTERWORKING,
1598 /* 60 GHz (Multi-band, DMG, MMS) can't happen */
1599 };
1600 size_t noffset;
1601
1602 if (!elems_len)
1603 return offset;
1604
1605 /* RIC already taken care of in ieee80211_add_before_ht_elems() */
1606 noffset = ieee80211_ie_split(elems, elems_len,
1607 before_vht, ARRAY_SIZE(before_vht),
1608 offset);
1609 skb_put_data(skb, elems + offset, noffset - offset);
1610
1611 return noffset;
1612}
1613
1614static size_t ieee80211_add_before_he_elems(struct sk_buff *skb,
1615 const u8 *elems,
1616 size_t elems_len,
1617 size_t offset)
1618{
1619 static const u8 before_he[] = {
1620 /*
1621 * no need to list the ones split off before VHT
1622 * or generated here
1623 */
1624 WLAN_EID_OPMODE_NOTIF,
1625 WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
1626 /* 11ai elements */
1627 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
1628 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
1629 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
1630 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
1631 WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
1632 /* TODO: add 11ah/11aj/11ak elements */
1633 };
1634 size_t noffset;
1635
1636 if (!elems_len)
1637 return offset;
1638
1639 /* RIC already taken care of in ieee80211_add_before_ht_elems() */
1640 noffset = ieee80211_ie_split(elems, elems_len,
1641 before_he, ARRAY_SIZE(before_he),
1642 offset);
1643 skb_put_data(skb, elems + offset, noffset - offset);
1644
1645 return noffset;
1646}
1647
81151ce4
JB		 1648#define PRESENT_ELEMS_MAX 8
1649#define PRESENT_ELEM_EXT_OFFS 0x100
1650
136a4e82
IP		 1651static void
1652ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1653 struct sk_buff *skb, u16 capab,
1654 const struct element *ext_capa,
1655 const u16 *present_elems,
1656 struct ieee80211_mgd_assoc_data *assoc_data);
1657
1658static size_t
1659ieee80211_add_link_elems(struct ieee80211_sub_if_data *sdata,
1660 struct sk_buff *skb, u16 *capab,
1661 const struct element *ext_capa,
1662 const u8 *extra_elems,
1663 size_t extra_elems_len,
1664 unsigned int link_id,
1665 struct ieee80211_link_data *link,
1666 u16 *present_elems,
1667 struct ieee80211_mgd_assoc_data *assoc_data)
978420c2
JB		 1668{
1669 enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
81151ce4 1670 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
978420c2
JB		 1671 struct ieee80211_channel *chan = cbss->channel;
1672 const struct ieee80211_sband_iftype_data *iftd;
1673 struct ieee80211_local *local = sdata->local;
1674 struct ieee80211_supported_band *sband;
1675 enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20;
1676 struct ieee80211_chanctx_conf *chanctx_conf;
81151ce4
JB		 1677 enum ieee80211_smps_mode smps_mode;
1678 u16 orig_capab = *capab;
978420c2 1679 size_t offset = 0;
81151ce4 1680 int present_elems_len = 0;
978420c2
JB		 1681 u8 *pos;
1682 int i;
1683
81151ce4
JB		 1684#define ADD_PRESENT_ELEM(id) do { \
1685 /* need a last for termination - we use 0 == SSID */ \
1686 if (!WARN_ON(present_elems_len >= PRESENT_ELEMS_MAX - 1)) \
1687 present_elems[present_elems_len++] = (id); \
1688} while (0)
1689#define ADD_PRESENT_EXT_ELEM(id) ADD_PRESENT_ELEM(PRESENT_ELEM_EXT_OFFS | (id))
1690
1691 if (link)
1692 smps_mode = link->smps_mode;
1693 else if (sdata->u.mgd.powersave)
1694 smps_mode = IEEE80211_SMPS_DYNAMIC;
1695 else
1696 smps_mode = IEEE80211_SMPS_OFF;
1697
1698 if (link) {
1699 /*
1700 * 5/10 MHz scenarios are only viable without MLO, in which
1701 * case this pointer should be used ... All of this is a bit
1702 * unclear though, not sure this even works at all.
1703 */
1704 rcu_read_lock();
1705 chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
1706 if (chanctx_conf)
1707 width = chanctx_conf->def.width;
1708 rcu_read_unlock();
1709 }
978420c2
JB		 1710
1711 sband = local->hw.wiphy->bands[chan->band];
1712 iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1713
1714 if (sband->band == NL80211_BAND_2GHZ) {
1715 *capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
1716 *capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
1717 }
1718
1719 if ((cbss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
1720 ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
1721 *capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
1722
1723 if (sband->band != NL80211_BAND_S1GHZ)
3ad4fce6 1724 ieee80211_assoc_add_rates(local, skb, width, sband, assoc_data);
978420c2
JB		 1725
1726 if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
1727 *capab & WLAN_CAPABILITY_RADIO_MEASURE) {
1728 struct cfg80211_chan_def chandef = {
1729 .width = width,
1730 .chan = chan,
1731 };
1732
1733 pos = skb_put(skb, 4);
1734 *pos++ = WLAN_EID_PWR_CAPABILITY;
1735 *pos++ = 2;
1736 *pos++ = 0; /* min tx power */
1737 /* max tx power */
1738 *pos++ = ieee80211_chandef_max_power(&chandef);
81151ce4 1739 ADD_PRESENT_ELEM(WLAN_EID_PWR_CAPABILITY);
978420c2
JB		 1740 }
1741
1742 /*
1743 * Per spec, we shouldn't include the list of channels if we advertise
1744 * support for extended channel switching, but we've always done that;
1745 * (for now?) apply this restriction only on the (new) 6 GHz band.
1746 */
1747 if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
1748 (sband->band != NL80211_BAND_6GHZ ||
1749 !ext_capa || ext_capa->datalen < 1 ||
1750 !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
1751 /* TODO: get this in reg domain format */
1752 pos = skb_put(skb, 2 * sband->n_channels + 2);
1753 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
1754 *pos++ = 2 * sband->n_channels;
1755 for (i = 0; i < sband->n_channels; i++) {
1756 int cf = sband->channels[i].center_freq;
1757
1758 *pos++ = ieee80211_frequency_to_channel(cf);
1759 *pos++ = 1; /* one channel in the subband*/
1760 }
81151ce4 1761 ADD_PRESENT_ELEM(WLAN_EID_SUPPORTED_CHANNELS);
978420c2
JB		 1762 }
1763
1764 /* if present, add any custom IEs that go before HT */
1765 offset = ieee80211_add_before_ht_elems(skb, extra_elems,
1766 extra_elems_len,
1767 offset);
1768
1769 if (sband->band != NL80211_BAND_6GHZ &&
310c8387 1770 assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_HT) {
978420c2 1771 ieee80211_add_ht_ie(sdata, skb,
81151ce4
JB		 1772 assoc_data->link[link_id].ap_ht_param,
1773 sband, chan, smps_mode,
310c8387 1774 &assoc_data->link[link_id].conn);
81151ce4
JB		 1775 ADD_PRESENT_ELEM(WLAN_EID_HT_CAPABILITY);
1776 }
978420c2
JB		 1777
1778 /* if present, add any custom IEs that go before VHT */
1779 offset = ieee80211_add_before_vht_elems(skb, extra_elems,
1780 extra_elems_len,
1781 offset);
1782
1783 if (sband->band != NL80211_BAND_6GHZ &&
bf7bc8c5
JB		 1784 assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_VHT &&
1785 sband->vht_cap.vht_supported) {
81151ce4 1786 bool mu_mimo_owner =
978420c2 1787 ieee80211_add_vht_ie(sdata, skb, sband,
81151ce4 1788 &assoc_data->link[link_id].ap_vht_cap,
310c8387 1789 &assoc_data->link[link_id].conn);
81151ce4
JB		 1790
1791 if (link)
1792 link->conf->mu_mimo_owner = mu_mimo_owner;
1793 ADD_PRESENT_ELEM(WLAN_EID_VHT_CAPABILITY);
1794 }
978420c2 1795
978420c2
JB		 1796 /* if present, add any custom IEs that go before HE */
1797 offset = ieee80211_add_before_he_elems(skb, extra_elems,
1798 extra_elems_len,
1799 offset);
1800
310c8387 1801 if (assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_HE) {
28aa895b
JB		 1802 ieee80211_put_he_cap(skb, sdata, sband,
1803 &assoc_data->link[link_id].conn);
81151ce4 1804 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY);
28aa895b 1805 ieee80211_put_he_6ghz_cap(skb, sdata, smps_mode);
81151ce4 1806 }
978420c2 1807
81151ce4
JB		 1808 /*
1809 * careful - need to know about all the present elems before
1810 * calling ieee80211_assoc_add_ml_elem(), so add this one if
1811 * we're going to put it after the ML element
1812 */
310c8387 1813 if (assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_EHT)
81151ce4
JB		 1814 ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_EHT_CAPABILITY);
1815
1816 if (link_id == assoc_data->assoc_link_id)
1817 ieee80211_assoc_add_ml_elem(sdata, skb, orig_capab, ext_capa,
136a4e82 1818 present_elems, assoc_data);
81151ce4
JB		 1819
1820 /* crash if somebody gets it wrong */
1821 present_elems = NULL;
1822
310c8387 1823 if (assoc_data->link[link_id].conn.mode >= IEEE80211_CONN_MODE_EHT)
ea8af8be
JB		 1824 ieee80211_put_eht_cap(skb, sdata, sband,
1825 &assoc_data->link[link_id].conn);
978420c2
JB		 1826
1827 if (sband->band == NL80211_BAND_S1GHZ) {
1828 ieee80211_add_aid_request_ie(sdata, skb);
1829 ieee80211_add_s1g_capab_ie(sdata, &sband->s1g_cap, skb);
1830 }
1831
1832 if (iftd && iftd->vendor_elems.data && iftd->vendor_elems.len)
1833 skb_put_data(skb, iftd->vendor_elems.data, iftd->vendor_elems.len);
1834
1835 return offset;
1836}
1837
81151ce4
JB		 1838static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb,
1839 const u16 *outer,
1840 const u16 *inner)
1841{
1842 unsigned int skb_len = skb->len;
68c22855 1843 bool at_extension = false;
81151ce4
JB		 1844 bool added = false;
1845 int i, j;
1846 u8 *len, *list_len = NULL;
1847
1848 skb_put_u8(skb, WLAN_EID_EXTENSION);
1849 len = skb_put(skb, 1);
1850 skb_put_u8(skb, WLAN_EID_EXT_NON_INHERITANCE);
1851
1852 for (i = 0; i < PRESENT_ELEMS_MAX && outer[i]; i++) {
1853 u16 elem = outer[i];
1854 bool have_inner = false;
81151ce4
JB		 1855
1856 /* should at least be sorted in the sense of normal -> ext */
1857 WARN_ON(at_extension && elem < PRESENT_ELEM_EXT_OFFS);
1858
1859 /* switch to extension list */
1860 if (!at_extension && elem >= PRESENT_ELEM_EXT_OFFS) {
1861 at_extension = true;
1862 if (!list_len)
1863 skb_put_u8(skb, 0);
1864 list_len = NULL;
1865 }
1866
1867 for (j = 0; j < PRESENT_ELEMS_MAX && inner[j]; j++) {
1868 if (elem == inner[j]) {
1869 have_inner = true;
1870 break;
1871 }
1872 }
1873
1874 if (have_inner)
1875 continue;
1876
1877 if (!list_len) {
1878 list_len = skb_put(skb, 1);
1879 *list_len = 0;
1880 }
1881 *list_len += 1;
1882 skb_put_u8(skb, (u8)elem);
68c22855 1883 added = true;
81151ce4
JB		 1884 }
1885
68c22855
JB		 1886 /* if we added a list but no extension list, make a zero-len one */
1887 if (added && (!at_extension || !list_len))
1888 skb_put_u8(skb, 0);
1889
1890 /* if nothing added remove extension element completely */
81151ce4
JB		 1891 if (!added)
1892 skb_trim(skb, skb_len);
1893 else
1894 *len = skb->len - skb_len - 2;
1895}
1896
136a4e82
IP		 1897static void
1898ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1899 struct sk_buff *skb, u16 capab,
1900 const struct element *ext_capa,
1901 const u16 *outer_present_elems,
1902 struct ieee80211_mgd_assoc_data *assoc_data)
81151ce4
JB		 1903{
1904 struct ieee80211_local *local = sdata->local;
81151ce4
JB		 1905 struct ieee80211_multi_link_elem *ml_elem;
1906 struct ieee80211_mle_basic_common_info *common;
1907 const struct wiphy_iftype_ext_capab *ift_ext_capa;
1908 __le16 eml_capa = 0, mld_capa_ops = 0;
1909 unsigned int link_id;
1910 u8 *ml_elem_len;
1911 void *capab_pos;
1912
f1871abd 1913 if (!ieee80211_vif_is_mld(&sdata->vif))
81151ce4
JB		 1914 return;
1915
1916 ift_ext_capa = cfg80211_get_iftype_ext_capa(local->hw.wiphy,
1917 ieee80211_vif_type_p2p(&sdata->vif));
1918 if (ift_ext_capa) {
1919 eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities);
1920 mld_capa_ops = cpu_to_le16(ift_ext_capa->mld_capa_and_ops);
1921 }
1922
1923 skb_put_u8(skb, WLAN_EID_EXTENSION);
1924 ml_elem_len = skb_put(skb, 1);
1925 skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK);
1926 ml_elem = skb_put(skb, sizeof(*ml_elem));
1927 ml_elem->control =
1928 cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC |
81151ce4
JB		 1929 IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP);
1930 common = skb_put(skb, sizeof(*common));
1931 common->len = sizeof(*common) +
81151ce4
JB		 1932 2; /* MLD capa/ops */
1933 memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN);
1cb3cf37
MG		 1934
1935 /* add EML_CAPA only if needed, see Draft P802.11be_D2.1, 35.3.17 */
1936 if (eml_capa &
1937 cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |
1938 IEEE80211_EML_CAP_EMLMR_SUPPORT))) {
1939 common->len += 2; /* EML capabilities */
1940 ml_elem->control |=
1941 cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EML_CAPA);
1942 skb_put_data(skb, &eml_capa, sizeof(eml_capa));
1943 }
81151ce4
JB		 1944 skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops));
1945
96d4311c
JB		 1946 /* Many APs have broken parsing of the extended MLD capa/ops field,
1947 * dropping (re-)association request frames or replying with association
1948 * response with a failure status if it's present. Without a clear
1949 * indication as to whether the AP supports parsing this field or not do
1950 * not include it in the common information unless strict mode is set.
1951 */
1952 if (ieee80211_hw_check(&local->hw, STRICT) &&
1953 assoc_data->ext_mld_capa_ops) {
1954 ml_elem->control |=
1955 cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EXT_MLD_CAPA_OP);
1956 common->len += 2;
1957 skb_put_data(skb, &assoc_data->ext_mld_capa_ops,
1958 sizeof(assoc_data->ext_mld_capa_ops));
1959 }
1960
81151ce4
JB		 1961 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1962 u16 link_present_elems[PRESENT_ELEMS_MAX] = {};
1963 const u8 *extra_elems;
1964 size_t extra_elems_len;
1965 size_t extra_used;
1966 u8 *subelem_len = NULL;
1967 __le16 ctrl;
1968
1969 if (!assoc_data->link[link_id].bss ||
1970 link_id == assoc_data->assoc_link_id)
1971 continue;
1972
1973 extra_elems = assoc_data->link[link_id].elems;
1974 extra_elems_len = assoc_data->link[link_id].elems_len;
1975
1976 skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE);
1977 subelem_len = skb_put(skb, 1);
1978
1979 ctrl = cpu_to_le16(link_id |
1980 IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE |
1981 IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT);
1982 skb_put_data(skb, &ctrl, sizeof(ctrl));
1983 skb_put_u8(skb, 1 + ETH_ALEN); /* STA Info Length */
1984 skb_put_data(skb, assoc_data->link[link_id].addr,
1985 ETH_ALEN);
1986 /*
1987 * Now add the contents of the (re)association request,
1988 * but the "listen interval" and "current AP address"
1989 * (if applicable) are skipped. So we only have
1990 * the capability field (remember the position and fill
1991 * later), followed by the elements added below by
136a4e82 1992 * calling ieee80211_add_link_elems().
81151ce4
JB		 1993 */
1994 capab_pos = skb_put(skb, 2);
1995
136a4e82
IP		 1996 extra_used = ieee80211_add_link_elems(sdata, skb, &capab,
1997 ext_capa,
1998 extra_elems,
1999 extra_elems_len,
2000 link_id, NULL,
2001 link_present_elems,
2002 assoc_data);
81151ce4
JB		 2003 if (extra_elems)
2004 skb_put_data(skb, extra_elems + extra_used,
2005 extra_elems_len - extra_used);
2006
2007 put_unaligned_le16(capab, capab_pos);
2008
2009 ieee80211_add_non_inheritance_elem(skb, outer_present_elems,
2010 link_present_elems);
2011
d094482c
BB		 2012 ieee80211_fragment_element(skb, subelem_len,
2013 IEEE80211_MLE_SUBELEM_FRAGMENT);
81151ce4
JB		 2014 }
2015
d094482c 2016 ieee80211_fragment_element(skb, ml_elem_len, WLAN_EID_FRAGMENT);
81151ce4
JB		 2017}
2018
fa2b73bf
IP		 2019static int
2020ieee80211_link_common_elems_size(struct ieee80211_sub_if_data *sdata,
2021 enum nl80211_iftype iftype,
2022 struct cfg80211_bss *cbss,
2023 size_t elems_len)
2024{
2025 struct ieee80211_local *local = sdata->local;
2026 const struct ieee80211_sband_iftype_data *iftd;
2027 struct ieee80211_supported_band *sband;
2028 size_t size = 0;
2029
2030 if (!cbss)
2031 return size;
2032
2033 sband = local->hw.wiphy->bands[cbss->channel->band];
2034
2035 /* add STA profile elements length */
2036 size += elems_len;
2037
2038 /* and supported rates length */
2039 size += 4 + sband->n_bitrates;
2040
2041 /* supported channels */
2042 size += 2 + 2 * sband->n_channels;
2043
2044 iftd = ieee80211_get_sband_iftype_data(sband, iftype);
2045 if (iftd)
2046 size += iftd->vendor_elems.len;
2047
2048 /* power capability */
2049 size += 4;
2050
2051 /* HT, VHT, HE, EHT */
2052 size += 2 + sizeof(struct ieee80211_ht_cap);
2053 size += 2 + sizeof(struct ieee80211_vht_cap);
2054 size += 2 + 1 + sizeof(struct ieee80211_he_cap_elem) +
2055 sizeof(struct ieee80211_he_mcs_nss_supp) +
2056 IEEE80211_HE_PPE_THRES_MAX_LEN;
2057
2058 if (sband->band == NL80211_BAND_6GHZ)
2059 size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa);
2060
2061 size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) +
2062 sizeof(struct ieee80211_eht_mcs_nss_supp) +
2063 IEEE80211_EHT_PPE_THRES_MAX_LEN;
2064
2065 return size;
2066}
2067
a72c01a9 2068static int ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
66e67e41
JB		 2069{
2070 struct ieee80211_local *local = sdata->local;
2071 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2072 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
81151ce4 2073 struct ieee80211_link_data *link;
66e67e41
JB		 2074 struct sk_buff *skb;
2075 struct ieee80211_mgmt *mgmt;
4d9ec73d 2076 u8 *pos, qos_info, *ie_start;
978420c2 2077 size_t offset, noffset;
6a9c8ed0 2078 u16 capab = 0, link_capab;
05d10957 2079 __le16 listen_int;
2ff69b0e 2080 struct element *ext_capa = NULL;
9bd6a83e 2081 enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
15fae341 2082 struct ieee80211_prep_tx_info info = {};
81151ce4
JB		 2083 unsigned int link_id, n_links = 0;
2084 u16 present_elems[PRESENT_ELEMS_MAX] = {};
978420c2 2085 void *capab_pos;
81151ce4 2086 size_t size;
a72c01a9 2087 int ret;
2ff69b0e
JB		 2088
2089 /* we know it's writable, cast away the const */
2090 if (assoc_data->ie_len)
2091 ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
2092 assoc_data->ie,
2093 assoc_data->ie_len);
66e67e41 2094
076fc877 2095 lockdep_assert_wiphy(sdata->local->hw.wiphy);
66e67e41 2096
81151ce4
JB		 2097 size = local->hw.extra_tx_headroom +
2098 sizeof(*mgmt) + /* bit too much but doesn't matter */
2099 2 + assoc_data->ssid_len + /* SSID */
2100 assoc_data->ie_len + /* extra IEs */
2101 (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
2102 9; /* WMM */
66e67e41 2103
81151ce4
JB		 2104 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
2105 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
fa2b73bf 2106 size_t elems_len = assoc_data->link[link_id].elems_len;
81151ce4
JB		 2107
2108 if (!cbss)
2109 continue;
2110
81151ce4 2111 n_links++;
fa2b73bf
IP		 2112
2113 size += ieee80211_link_common_elems_size(sdata, iftype, cbss,
2114 elems_len);
81151ce4
JB		 2115
2116 /* non-inheritance element */
2117 size += 2 + 2 + PRESENT_ELEMS_MAX;
2118
2119 /* should be the same across all BSSes */
2120 if (cbss->capability & WLAN_CAPABILITY_PRIVACY)
2121 capab |= WLAN_CAPABILITY_PRIVACY;
2122 }
2123
f1871abd 2124 if (ieee80211_vif_is_mld(&sdata->vif)) {
81151ce4
JB		 2125 /* consider the multi-link element with STA profile */
2126 size += sizeof(struct ieee80211_multi_link_elem);
2127 /* max common info field in basic multi-link element */
2128 size += sizeof(struct ieee80211_mle_basic_common_info) +
2129 2 + /* capa & op */
96d4311c 2130 2 + /* ext capa & op */
81151ce4
JB		 2131 2; /* EML capa */
2132
2133 /*
2134 * The capability elements were already considered above;
2135 * note this over-estimates a bit because there's no
2136 * STA profile for the assoc link.
2137 */
2138 size += (n_links - 1) *
2139 (1 + 1 + /* subelement ID/length */
2140 2 + /* STA control */
2141 1 + ETH_ALEN + 2 /* STA Info field */);
2142 }
2143
2144 link = sdata_dereference(sdata->link[assoc_data->assoc_link_id], sdata);
2145 if (WARN_ON(!link))
2146 return -EINVAL;
2147
2148 if (WARN_ON(!assoc_data->link[assoc_data->assoc_link_id].bss))
2149 return -EINVAL;
2150
81151ce4 2151 skb = alloc_skb(size, GFP_KERNEL);
66e67e41 2152 if (!skb)
a72c01a9 2153 return -ENOMEM;
66e67e41
JB		 2154
2155 skb_reserve(skb, local->hw.extra_tx_headroom);
2156
cd2f5dd7
AK		 2157 if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
2158 capab |= WLAN_CAPABILITY_RADIO_MEASURE;
2159
978420c2
JB		 2160 /* Set MBSSID support for HE AP if needed */
2161 if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
310c8387 2162 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HE &&
978420c2
JB		 2163 ext_capa && ext_capa->datalen >= 3)
2164 ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
2165
b080db58 2166 mgmt = skb_put_zero(skb, 24);
4ca04ed3
JB		 2167 memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
2168 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
2169 memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
66e67e41 2170
81151ce4 2171 listen_int = cpu_to_le16(assoc_data->s1g ?
05d10957
TP		 2172 ieee80211_encode_usf(local->hw.conf.listen_interval) :
2173 local->hw.conf.listen_interval);
81151ce4 2174 if (!is_zero_ether_addr(assoc_data->prev_ap_addr)) {
66e67e41
JB		 2175 skb_put(skb, 10);
2176 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2177 IEEE80211_STYPE_REASSOC_REQ);
978420c2 2178 capab_pos = &mgmt->u.reassoc_req.capab_info;
05d10957 2179 mgmt->u.reassoc_req.listen_interval = listen_int;
81151ce4
JB		 2180 memcpy(mgmt->u.reassoc_req.current_ap,
2181 assoc_data->prev_ap_addr, ETH_ALEN);
15fae341 2182 info.subtype = IEEE80211_STYPE_REASSOC_REQ;
66e67e41
JB		 2183 } else {
2184 skb_put(skb, 4);
2185 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2186 IEEE80211_STYPE_ASSOC_REQ);
978420c2 2187 capab_pos = &mgmt->u.assoc_req.capab_info;
05d10957 2188 mgmt->u.assoc_req.listen_interval = listen_int;
15fae341 2189 info.subtype = IEEE80211_STYPE_ASSOC_REQ;
66e67e41
JB		 2190 }
2191
2192 /* SSID */
2193 pos = skb_put(skb, 2 + assoc_data->ssid_len);
4d9ec73d 2194 ie_start = pos;
66e67e41
JB		 2195 *pos++ = WLAN_EID_SSID;
2196 *pos++ = assoc_data->ssid_len;
2197 memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
2198
6a9c8ed0
JB		 2199 /*
2200 * This bit is technically reserved, so it shouldn't matter for either
2201 * the AP or us, but it also means we shouldn't set it. However, we've
2202 * always set it in the past, and apparently some EHT APs check that
2203 * we don't set it. To avoid interoperability issues with old APs that
2204 * for some reason check it and want it to be set, set the bit for all
2205 * pre-EHT connections as we used to do.
2206 */
3ad4fce6
JB		 2207 if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_EHT &&
2208 !ieee80211_hw_check(&local->hw, STRICT))
6a9c8ed0
JB		 2209 capab |= WLAN_CAPABILITY_ESS;
2210
978420c2 2211 /* add the elements for the assoc (main) link */
81151ce4 2212 link_capab = capab;
136a4e82
IP		 2213 offset = ieee80211_add_link_elems(sdata, skb, &link_capab,
2214 ext_capa,
2215 assoc_data->ie,
2216 assoc_data->ie_len,
2217 assoc_data->assoc_link_id, link,
2218 present_elems, assoc_data);
81151ce4 2219 put_unaligned_le16(link_capab, capab_pos);
66e67e41 2220
978420c2 2221 /* if present, add any custom non-vendor IEs */
b3f51e94 2222 if (assoc_data->ie_len) {
66e67e41
JB		 2223 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
2224 assoc_data->ie_len,
2225 offset);
b952f4df 2226 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
66e67e41
JB		 2227 offset = noffset;
2228 }
2229
76f0303d
JB		 2230 if (assoc_data->wmm) {
2231 if (assoc_data->uapsd) {
dc41e4d4
EP		 2232 qos_info = ifmgd->uapsd_queues;
2233 qos_info |= (ifmgd->uapsd_max_sp_len <<
66e67e41
JB		 2234 IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
2235 } else {
2236 qos_info = 0;
2237 }
2238
40b861a0 2239 pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
66e67e41
JB		 2240 }
2241
2242 /* add any remaining custom (i.e. vendor specific here) IEs */
b3f51e94 2243 if (assoc_data->ie_len) {
66e67e41 2244 noffset = assoc_data->ie_len;
b952f4df 2245 skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
66e67e41
JB		 2246 }
2247
a72c01a9
JJ		 2248 if (assoc_data->fils_kek_len) {
2249 ret = fils_encrypt_assoc_req(skb, assoc_data);
2250 if (ret < 0) {
2251 dev_kfree_skb(skb);
2252 return ret;
2253 }
39404fee
JM		 2254 }
2255
4d9ec73d
JM		 2256 pos = skb_tail_pointer(skb);
2257 kfree(ifmgd->assoc_req_ies);
2258 ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
a72c01a9
JJ		 2259 if (!ifmgd->assoc_req_ies) {
2260 dev_kfree_skb(skb);
2261 return -ENOMEM;
2262 }
2263
4d9ec73d
JM		 2264 ifmgd->assoc_req_ies_len = pos - ie_start;
2265
e76f3b4a 2266 info.link_id = assoc_data->assoc_link_id;
15fae341 2267 drv_mgd_prepare_tx(local, sdata, &info);
a1845fc7 2268
66e67e41 2269 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
30686bf7 2270 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1672c0e3
JB		 2271 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
2272 IEEE80211_TX_INTFL_MLME_CONN_TX;
66e67e41 2273 ieee80211_tx_skb(sdata, skb);
a72c01a9
JJ		 2274
2275 return 0;
66e67e41
JB		 2276}
2277
572e0012
KV		 2278void ieee80211_send_pspoll(struct ieee80211_local *local,
2279 struct ieee80211_sub_if_data *sdata)
2280{
572e0012
KV		 2281 struct ieee80211_pspoll *pspoll;
2282 struct sk_buff *skb;
572e0012 2283
d8cd189e
KV		 2284 skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
2285 if (!skb)
572e0012 2286 return;
572e0012 2287
d8cd189e
KV		 2288 pspoll = (struct ieee80211_pspoll *) skb->data;
2289 pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
572e0012 2290
62ae67be
JB		 2291 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
2292 ieee80211_tx_skb(sdata, skb);
572e0012
KV		 2293}
2294
965bedad
JB		 2295void ieee80211_send_nullfunc(struct ieee80211_local *local,
2296 struct ieee80211_sub_if_data *sdata,
076cdcb1 2297 bool powersave)
965bedad
JB		 2298{
2299 struct sk_buff *skb;
d8cd189e 2300 struct ieee80211_hdr_3addr *nullfunc;
b6f35301 2301 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
965bedad 2302
0ab26380
JB		 2303 skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, -1,
2304 !ieee80211_hw_check(&local->hw,
2305 DOESNT_SUPPORT_QOS_NDP));
d8cd189e 2306 if (!skb)
965bedad 2307 return;
965bedad 2308
d8cd189e 2309 nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
965bedad 2310 if (powersave)
d8cd189e 2311 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
965bedad 2312
6c17b77b
SF		 2313 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
2314 IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
ff40b425 2315
30686bf7 2316 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
ff40b425
PF		 2317 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
2318
392b9ffb 2319 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
b6f35301
RM		 2320 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
2321
62ae67be 2322 ieee80211_tx_skb(sdata, skb);
965bedad
JB		 2323}
2324
a5d3cbdb
FF		 2325void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
2326 struct ieee80211_sub_if_data *sdata)
d524215f
FF		 2327{
2328 struct sk_buff *skb;
2329 struct ieee80211_hdr *nullfunc;
2330 __le16 fc;
2331
2332 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2333 return;
2334
2335 skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
d15b8459 2336 if (!skb)
d524215f 2337 return;
d15b8459 2338
d524215f
FF		 2339 skb_reserve(skb, local->hw.extra_tx_headroom);
2340
b080db58 2341 nullfunc = skb_put_zero(skb, 30);
d524215f
FF		 2342 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
2343 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
2344 nullfunc->frame_control = fc;
bfd8403a 2345 memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
d524215f 2346 memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
bfd8403a 2347 memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
d524215f
FF		 2348 memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
2349
2350 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
bf326cf5 2351 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
d524215f
FF		 2352 ieee80211_tx_skb(sdata, skb);
2353}
2354
cc32abd4 2355/* spectrum management related things */
344d18ce
JB		 2356static void ieee80211_csa_switch_work(struct wiphy *wiphy,
2357 struct wiphy_work *work)
cc32abd4 2358{
5bd5666d 2359 struct ieee80211_link_data *link =
ec3252bf 2360 container_of(work, struct ieee80211_link_data,
344d18ce 2361 u.mgd.csa.switch_work.work);
5bd5666d 2362 struct ieee80211_sub_if_data *sdata = link->sdata;
675a0b04 2363 struct ieee80211_local *local = sdata->local;
cc32abd4 2364 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7578d575 2365 int ret;
cc32abd4 2366
9607e6b6 2367 if (!ieee80211_sdata_running(sdata))
cc32abd4
JB		 2368 return;
2369
5435af6e 2370 lockdep_assert_wiphy(local->hw.wiphy);
4c3ebc56 2371
77fdaa12 2372 if (!ifmgd->associated)
076fc877 2373 return;
cc32abd4 2374
5bd5666d 2375 if (!link->conf->csa_active)
076fc877 2376 return;
4c3ebc56 2377
7ef8f682
JB		 2378 /*
2379 * If the link isn't active (now), we cannot wait for beacons, won't
2380 * have a reserved chanctx, etc. Just switch over the chandef and
2381 * update cfg80211 directly.
2382 */
2383 if (!ieee80211_vif_link_active(&sdata->vif, link->link_id)) {
344d18ce
JB		 2384 link->conf->chanreq = link->csa.chanreq;
2385 cfg80211_ch_switch_notify(sdata->dev, &link->csa.chanreq.oper,
7ef8f682
JB		 2386 link->link_id);
2387 return;
2388 }
2389
4c3ebc56
MK		 2390 /*
2391 * using reservation isn't immediate as it may be deferred until later
2392 * with multi-vif. once reservation is complete it will re-schedule the
2393 * work with no reserved_chanctx so verify chandef to check if it
2394 * completed successfully
2395 */
2396
5bd5666d 2397 if (link->reserved_chanctx) {
4c3ebc56
MK		 2398 /*
2399 * with multi-vif csa driver may call ieee80211_csa_finish()
2400 * many times while waiting for other interfaces to use their
2401 * reservations
2402 */
5bd5666d 2403 if (link->reserved_ready)
076fc877 2404 return;
4c3ebc56 2405
5bd5666d 2406 ret = ieee80211_link_use_reserved_context(link);
4c3ebc56 2407 if (ret) {
7ef8f682
JB		 2408 link_info(link,
2409 "failed to use reserved channel context, disconnecting (err=%d)\n",
2410 ret);
4b8d43f1
JB		 2411 wiphy_work_queue(sdata->local->hw.wiphy,
2412 &ifmgd->csa_connection_drop_work);
4c3ebc56 2413 }
076fc877 2414 return;
4c3ebc56
MK		 2415 }
2416
761748f0 2417 if (!ieee80211_chanreq_identical(&link->conf->chanreq,
344d18ce 2418 &link->csa.chanreq)) {
7ef8f682
JB		 2419 link_info(link,
2420 "failed to finalize channel switch, disconnecting\n");
4b8d43f1
JB		 2421 wiphy_work_queue(sdata->local->hw.wiphy,
2422 &ifmgd->csa_connection_drop_work);
076fc877 2423 return;
7578d575 2424 }
675a0b04 2425
344d18ce 2426 link->u.mgd.csa.waiting_bcn = true;
0c21e632 2427
45405681
JB		 2428 /* apply new TPE restrictions immediately on the new channel */
2429 if (link->u.mgd.csa.ap_chandef.chan->band == NL80211_BAND_6GHZ &&
2430 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HE) {
2431 ieee80211_rearrange_tpe(&link->u.mgd.csa.tpe,
2432 &link->u.mgd.csa.ap_chandef,
2433 &link->conf->chanreq.oper);
2434 if (memcmp(&link->conf->tpe, &link->u.mgd.csa.tpe,
2435 sizeof(link->u.mgd.csa.tpe))) {
2436 link->conf->tpe = link->u.mgd.csa.tpe;
2437 ieee80211_link_info_change_notify(sdata, link,
2438 BSS_CHANGED_TPE);
2439 }
2440 }
2441
0c21e632
LC		 2442 ieee80211_sta_reset_beacon_monitor(sdata);
2443 ieee80211_sta_reset_conn_monitor(sdata);
0c21e632
LC		 2444}
2445
5bd5666d 2446static void ieee80211_chswitch_post_beacon(struct ieee80211_link_data *link)
0c21e632 2447{
5bd5666d 2448 struct ieee80211_sub_if_data *sdata = link->sdata;
0c21e632
LC		 2449 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2450 int ret;
2451
076fc877 2452 lockdep_assert_wiphy(sdata->local->hw.wiphy);
0c21e632 2453
5bd5666d 2454 WARN_ON(!link->conf->csa_active);
4c3ebc56 2455
dc494fdc 2456 ieee80211_vif_unblock_queues_csa(sdata);
7578d575 2457
5bd5666d 2458 link->conf->csa_active = false;
344d18ce
JB		 2459 link->u.mgd.csa.blocked_tx = false;
2460 link->u.mgd.csa.waiting_bcn = false;
0c21e632 2461
a469a593 2462 ret = drv_post_channel_switch(link);
f1d65583 2463 if (ret) {
7ef8f682
JB		 2464 link_info(link,
2465 "driver post channel switch failed, disconnecting\n");
4b8d43f1
JB		 2466 wiphy_work_queue(sdata->local->hw.wiphy,
2467 &ifmgd->csa_connection_drop_work);
0c21e632 2468 return;
f1d65583 2469 }
688b1ecf 2470
7ef8f682 2471 cfg80211_ch_switch_notify(sdata->dev, &link->conf->chanreq.oper,
b82730bf 2472 link->link_id);
cc32abd4
JB		 2473}
2474
a469a593
EG		 2475void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success,
2476 unsigned int link_id)
5ce6e438 2477{
55de908a 2478 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
5ce6e438 2479
a469a593
EG		 2480 trace_api_chswitch_done(sdata, success, link_id);
2481
2482 rcu_read_lock();
5bd5666d 2483
5ce6e438 2484 if (!success) {
882a7c69 2485 sdata_info(sdata,
7ef8f682
JB		 2486 "driver channel switch failed (link %d), disconnecting\n",
2487 link_id);
4b8d43f1 2488 wiphy_work_queue(sdata->local->hw.wiphy,
a469a593 2489 &sdata->u.mgd.csa_connection_drop_work);
882a7c69 2490 } else {
a469a593
EG		 2491 struct ieee80211_link_data *link =
2492 rcu_dereference(sdata->link[link_id]);
2493
2494 if (WARN_ON(!link)) {
2495 rcu_read_unlock();
2496 return;
2497 }
2498
ec3252bf 2499 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
344d18ce 2500 &link->u.mgd.csa.switch_work, 0);
5ce6e438 2501 }
a469a593
EG		 2502
2503 rcu_read_unlock();
5ce6e438
JB		 2504}
2505EXPORT_SYMBOL(ieee80211_chswitch_done);
2506
b9cc81d8 2507static void
5bd5666d 2508ieee80211_sta_abort_chanswitch(struct ieee80211_link_data *link)
b9cc81d8 2509{
5bd5666d 2510 struct ieee80211_sub_if_data *sdata = link->sdata;
b9cc81d8
SS		 2511 struct ieee80211_local *local = sdata->local;
2512
5435af6e
JB		 2513 lockdep_assert_wiphy(local->hw.wiphy);
2514
b9cc81d8
SS		 2515 if (!local->ops->abort_channel_switch)
2516 return;
2517
5bd5666d 2518 ieee80211_link_unreserve_chanctx(link);
b9cc81d8 2519
dc494fdc 2520 ieee80211_vif_unblock_queues_csa(sdata);
b9cc81d8 2521
5bd5666d 2522 link->conf->csa_active = false;
344d18ce 2523 link->u.mgd.csa.blocked_tx = false;
b9cc81d8 2524
5ecd5d82 2525 drv_abort_channel_switch(link);
b9cc81d8
SS		 2526}
2527
7ef8f682
JB		 2528struct sta_csa_rnr_iter_data {
2529 struct ieee80211_link_data *link;
2530 struct ieee80211_channel *chan;
2531 u8 mld_id;
2532};
2533
2534static enum cfg80211_rnr_iter_ret
2535ieee80211_sta_csa_rnr_iter(void *_data, u8 type,
2536 const struct ieee80211_neighbor_ap_info *info,
2537 const u8 *tbtt_info, u8 tbtt_info_len)
2538{
2539 struct sta_csa_rnr_iter_data *data = _data;
2540 struct ieee80211_link_data *link = data->link;
2541 struct ieee80211_sub_if_data *sdata = link->sdata;
2542 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2543 const struct ieee80211_tbtt_info_ge_11 *ti;
2544 enum nl80211_band band;
2545 unsigned int center_freq;
2546 int link_id;
2547
2548 if (type != IEEE80211_TBTT_INFO_TYPE_TBTT)
2549 return RNR_ITER_CONTINUE;
2550
2551 if (tbtt_info_len < sizeof(*ti))
2552 return RNR_ITER_CONTINUE;
2553
2554 ti = (const void *)tbtt_info;
2555
2556 if (ti->mld_params.mld_id != data->mld_id)
2557 return RNR_ITER_CONTINUE;
2558
2559 link_id = le16_get_bits(ti->mld_params.params,
2560 IEEE80211_RNR_MLD_PARAMS_LINK_ID);
2561 if (link_id != data->link->link_id)
2562 return RNR_ITER_CONTINUE;
2563
2564 /* we found the entry for our link! */
2565
2566 /* this AP is confused, it had this right before ... just disconnect */
2567 if (!ieee80211_operating_class_to_band(info->op_class, &band)) {
2568 link_info(link,
2569 "AP now has invalid operating class in RNR, disconnect\n");
2570 wiphy_work_queue(sdata->local->hw.wiphy,
2571 &ifmgd->csa_connection_drop_work);
2572 return RNR_ITER_BREAK;
2573 }
2574
2575 center_freq = ieee80211_channel_to_frequency(info->channel, band);
2576 data->chan = ieee80211_get_channel(sdata->local->hw.wiphy, center_freq);
2577
2578 return RNR_ITER_BREAK;
2579}
2580
2581static void
2582ieee80211_sta_other_link_csa_disappeared(struct ieee80211_link_data *link,
2583 struct ieee802_11_elems *elems)
2584{
2585 struct ieee80211_sub_if_data *sdata = link->sdata;
2586 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2587 struct sta_csa_rnr_iter_data data = {
2588 .link = link,
2589 };
2590
2591 /*
2592 * If we get here, we see a beacon from another link without
2593 * CSA still being reported for it, so now we have to check
2594 * if the CSA was aborted or completed. This may not even be
2595 * perfectly possible if the CSA was only done for changing
2596 * the puncturing, but in that case if the link in inactive
2597 * we don't really care, and if it's an active link (or when
2598 * it's activated later) we'll get a beacon and adjust.
2599 */
2600
2601 if (WARN_ON(!elems->ml_basic))
2602 return;
2603
2604 data.mld_id = ieee80211_mle_get_mld_id((const void *)elems->ml_basic);
2605
2606 /*
2607 * So in order to do this, iterate the RNR element(s) and see
2608 * what channel is reported now.
2609 */
2610 cfg80211_iter_rnr(elems->ie_start, elems->total_len,
2611 ieee80211_sta_csa_rnr_iter, &data);
2612
2613 if (!data.chan) {
2614 link_info(link,
2615 "couldn't find (valid) channel in RNR for CSA, disconnect\n");
2616 wiphy_work_queue(sdata->local->hw.wiphy,
2617 &ifmgd->csa_connection_drop_work);
2618 return;
2619 }
2620
2621 /*
2622 * If it doesn't match the CSA, then assume it aborted. This
2623 * may erroneously detect that it was _not_ aborted when it
2624 * was in fact aborted, but only changed the bandwidth or the
2625 * puncturing configuration, but we don't have enough data to
2626 * detect that.
2627 */
344d18ce 2628 if (data.chan != link->csa.chanreq.oper.chan)
7ef8f682
JB		 2629 ieee80211_sta_abort_chanswitch(link);
2630}
2631
2632enum ieee80211_csa_source {
2633 IEEE80211_CSA_SOURCE_BEACON,
2634 IEEE80211_CSA_SOURCE_OTHER_LINK,
414e090b
JB		 2635 IEEE80211_CSA_SOURCE_PROT_ACTION,
2636 IEEE80211_CSA_SOURCE_UNPROT_ACTION,
7ef8f682
JB		 2637};
2638
37799e52 2639static void
5bd5666d 2640ieee80211_sta_process_chanswitch(struct ieee80211_link_data *link,
2ba45384 2641 u64 timestamp, u32 device_timestamp,
7ef8f682
JB		 2642 struct ieee802_11_elems *full_elems,
2643 struct ieee802_11_elems *csa_elems,
2644 enum ieee80211_csa_source source)
cc32abd4 2645{
5bd5666d 2646 struct ieee80211_sub_if_data *sdata = link->sdata;
b4f286a1 2647 struct ieee80211_local *local = sdata->local;
cc32abd4 2648 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7ef8f682 2649 struct ieee80211_chanctx *chanctx = NULL;
4c3ebc56 2650 struct ieee80211_chanctx_conf *conf;
7ef8f682 2651 struct ieee80211_csa_ie csa_ie = {};
e6ee3a37
JB		 2652 struct ieee80211_channel_switch ch_switch = {
2653 .link_id = link->link_id,
7ef8f682
JB		 2654 .timestamp = timestamp,
2655 .device_timestamp = device_timestamp,
e6ee3a37 2656 };
7ef8f682 2657 unsigned long now;
e6b7cde4 2658 int res;
cc32abd4 2659
5435af6e 2660 lockdep_assert_wiphy(local->hw.wiphy);
77fdaa12 2661
7ef8f682
JB		 2662 if (csa_elems) {
2663 struct cfg80211_bss *cbss = link->conf->bss;
2664 enum nl80211_band current_band;
2665 struct ieee80211_bss *bss;
cc32abd4 2666
7ef8f682
JB		 2667 if (WARN_ON(!cbss))
2668 return;
fafd2bce 2669
7ef8f682
JB		 2670 current_band = cbss->channel->band;
2671 bss = (void *)cbss->priv;
2672
2673 res = ieee80211_parse_ch_switch_ie(sdata, csa_elems,
2674 current_band,
2675 bss->vht_cap_info,
2676 &link->u.mgd.conn,
414e090b
JB		 2677 link->u.mgd.bssid,
2678 source == IEEE80211_CSA_SOURCE_UNPROT_ACTION,
2679 &csa_ie);
7ef8f682
JB		 2680 if (res == 0) {
2681 ch_switch.block_tx = csa_ie.mode;
2682 ch_switch.chandef = csa_ie.chanreq.oper;
2683 ch_switch.count = csa_ie.count;
2684 ch_switch.delay = csa_ie.max_switch_time;
2685 }
45405681
JB		 2686
2687 link->u.mgd.csa.tpe = csa_elems->csa_tpe;
7ef8f682
JB		 2688 } else {
2689 /*
2690 * If there was no per-STA profile for this link, we
2691 * get called with csa_elems == NULL. This of course means
2692 * there are no CSA elements, so set res=1 indicating
2693 * no more CSA.
2694 */
2695 res = 1;
fafd2bce
SS		 2696 }
2697
414e090b
JB		 2698 if (res < 0) {
2699 /* ignore this case, not a protected frame */
2700 if (source == IEEE80211_CSA_SOURCE_UNPROT_ACTION)
2701 return;
0cd8080e 2702 goto drop_connection;
414e090b 2703 }
b9cc81d8 2704
f3dee30c 2705 if (link->conf->csa_active) {
7ef8f682 2706 switch (source) {
414e090b
JB		 2707 case IEEE80211_CSA_SOURCE_PROT_ACTION:
2708 case IEEE80211_CSA_SOURCE_UNPROT_ACTION:
7ef8f682 2709 /* already processing - disregard action frames */
f3dee30c 2710 return;
7ef8f682 2711 case IEEE80211_CSA_SOURCE_BEACON:
344d18ce 2712 if (link->u.mgd.csa.waiting_bcn) {
7ef8f682
JB		 2713 ieee80211_chswitch_post_beacon(link);
2714 /*
2715 * If the CSA is still present after the switch
2716 * we need to consider it as a new CSA (possibly
2717 * to self). This happens by not returning here
2718 * so we'll get to the check below.
2719 */
2720 } else if (res) {
2721 ieee80211_sta_abort_chanswitch(link);
2722 return;
2723 } else {
2724 drv_channel_switch_rx_beacon(sdata, &ch_switch);
2725 return;
2726 }
2727 break;
2728 case IEEE80211_CSA_SOURCE_OTHER_LINK:
2729 /* active link: we want to see the beacon to continue */
2730 if (ieee80211_vif_link_active(&sdata->vif,
2731 link->link_id))
2732 return;
f3dee30c 2733
7ef8f682 2734 /* switch work ran, so just complete the process */
344d18ce 2735 if (link->u.mgd.csa.waiting_bcn) {
7ef8f682
JB		 2736 ieee80211_chswitch_post_beacon(link);
2737 /*
2738 * If the CSA is still present after the switch
2739 * we need to consider it as a new CSA (possibly
2740 * to self). This happens by not returning here
2741 * so we'll get to the check below.
2742 */
2743 break;
2744 }
2745
2746 /* link still has CSA but we already know, do nothing */
2747 if (!res)
2748 return;
2749
2750 /* check in the RNR if the CSA aborted */
2751 ieee80211_sta_other_link_csa_disappeared(link,
2752 full_elems);
f3dee30c
JB		 2753 return;
2754 }
b9cc81d8 2755 }
cd64f2a9 2756
414e090b
JB		 2757 /* no active CSA nor a new one */
2758 if (res) {
2759 /*
2760 * However, we may have stopped queues when receiving a public
2761 * action frame that couldn't be protected, if it had the quiet
2762 * bit set. This is a trade-off, we want to be quiet as soon as
2763 * possible, but also don't trust the public action frame much,
2764 * as it can't be protected.
2765 */
2766 if (unlikely(link->u.mgd.csa.blocked_tx)) {
2767 link->u.mgd.csa.blocked_tx = false;
2768 ieee80211_vif_unblock_queues_csa(sdata);
2769 }
2770 return;
2771 }
2772
2773 /*
2774 * We don't really trust public action frames, but block queues (go to
2775 * quiet mode) for them anyway, we should get a beacon soon to either
2776 * know what the CSA really is, or figure out the public action frame
2777 * was actually an attack.
2778 */
2779 if (source == IEEE80211_CSA_SOURCE_UNPROT_ACTION) {
2780 if (csa_ie.mode) {
2781 link->u.mgd.csa.blocked_tx = true;
2782 ieee80211_vif_block_queues_csa(sdata);
2783 }
f3dee30c 2784 return;
414e090b 2785 }
f3dee30c 2786
6092077a
JB		 2787 if (link->conf->chanreq.oper.chan->band !=
2788 csa_ie.chanreq.oper.chan->band) {
7ef8f682
JB		 2789 link_info(link,
2790 "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
2791 link->u.mgd.bssid,
2792 csa_ie.chanreq.oper.chan->center_freq,
2793 csa_ie.chanreq.oper.width,
2794 csa_ie.chanreq.oper.center_freq1,
2795 csa_ie.chanreq.oper.center_freq2);
0cd8080e 2796 goto drop_connection;
3660944a
JB		 2797 }
2798
6092077a 2799 if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chanreq.oper,
85220d71 2800 IEEE80211_CHAN_DISABLED)) {
7ef8f682
JB		 2801 link_info(link,
2802 "AP %pM switches to unsupported channel (%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), disconnecting\n",
2803 link->u.mgd.bssid,
2804 csa_ie.chanreq.oper.chan->center_freq,
2805 csa_ie.chanreq.oper.chan->freq_offset,
2806 csa_ie.chanreq.oper.width,
2807 csa_ie.chanreq.oper.center_freq1,
2808 csa_ie.chanreq.oper.freq1_offset,
2809 csa_ie.chanreq.oper.center_freq2);
0cd8080e 2810 goto drop_connection;
85220d71
JB		 2811 }
2812
6092077a
JB		 2813 if (cfg80211_chandef_identical(&csa_ie.chanreq.oper,
2814 &link->conf->chanreq.oper) &&
7ef8f682 2815 (!csa_ie.mode || source != IEEE80211_CSA_SOURCE_BEACON)) {
344d18ce 2816 if (link->u.mgd.csa.ignored_same_chan)
f84eaa10 2817 return;
7ef8f682
JB		 2818 link_info(link,
2819 "AP %pM tries to chanswitch to same channel, ignore\n",
2820 link->u.mgd.bssid);
344d18ce 2821 link->u.mgd.csa.ignored_same_chan = true;
f84eaa10
JB		 2822 return;
2823 }
2824
c5a71688 2825 /*
85977fc0
JB		 2826 * Drop all TDLS peers on the affected link - either we disconnect or
2827 * move to a different channel from this point on. There's no telling
2828 * what our peer will do.
c5a71688
AN		 2829 * The TDLS WIDER_BW scenario is also problematic, as peers might now
2830 * have an incompatible wider chandef.
2831 */
85977fc0 2832 ieee80211_teardown_tdls_peers(link);
c5a71688 2833
5bd5666d 2834 conf = rcu_dereference_protected(link->conf->chanctx_conf,
5435af6e 2835 lockdep_is_held(&local->hw.wiphy->mtx));
7ef8f682
JB		 2836 if (ieee80211_vif_link_active(&sdata->vif, link->link_id) && !conf) {
2837 link_info(link,
2838 "no channel context assigned to vif?, disconnecting\n");
f3b0bbb3 2839 goto drop_connection;
4c3ebc56
MK		 2840 }
2841
7ef8f682
JB		 2842 if (conf)
2843 chanctx = container_of(conf, struct ieee80211_chanctx, conf);
4c3ebc56 2844
0a44dfc0 2845 if (!ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
7ef8f682
JB		 2846 link_info(link,
2847 "driver doesn't support chan-switch with channel contexts\n");
f3b0bbb3 2848 goto drop_connection;
55de908a
JB		 2849 }
2850
6d027bcc 2851 if (drv_pre_channel_switch(sdata, &ch_switch)) {
7ef8f682
JB		 2852 link_info(link,
2853 "preparing for channel switch failed, disconnecting\n");
f3b0bbb3 2854 goto drop_connection;
6d027bcc
LC		 2855 }
2856
45405681
JB		 2857 link->u.mgd.csa.ap_chandef = csa_ie.chanreq.ap;
2858
9f472520
JB		 2859 link->csa.chanreq.oper = csa_ie.chanreq.oper;
2860 ieee80211_set_chanreq_ap(sdata, &link->csa.chanreq, &link->u.mgd.conn,
2861 &csa_ie.chanreq.ap);
f81747a9 2862
7ef8f682 2863 if (chanctx) {
f81747a9 2864 res = ieee80211_link_reserve_chanctx(link, &link->csa.chanreq,
7ef8f682
JB		 2865 chanctx->mode, false);
2866 if (res) {
2867 link_info(link,
2868 "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
2869 res);
2870 goto drop_connection;
2871 }
55de908a 2872 }
55de908a 2873
5bd5666d 2874 link->conf->csa_active = true;
344d18ce 2875 link->u.mgd.csa.ignored_same_chan = false;
5bd5666d 2876 link->u.mgd.beacon_crc_valid = false;
344d18ce 2877 link->u.mgd.csa.blocked_tx = csa_ie.mode;
55de908a 2878
dc494fdc
JB		 2879 if (csa_ie.mode)
2880 ieee80211_vif_block_queues_csa(sdata);
57eebdf3 2881
6092077a 2882 cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chanreq.oper,
40e38c8d 2883 link->link_id, csa_ie.count,
b82730bf 2884 csa_ie.mode);
2f457293 2885
7ef8f682
JB		 2886 /* we may have to handle timeout for deactivated link in software */
2887 now = jiffies;
344d18ce 2888 link->u.mgd.csa.time = now +
7ef8f682
JB		 2889 TU_TO_JIFFIES((max_t(int, csa_ie.count, 1) - 1) *
2890 link->conf->beacon_int);
2891
2892 if (ieee80211_vif_link_active(&sdata->vif, link->link_id) &&
2893 local->ops->channel_switch) {
2894 /*
2895 * Use driver's channel switch callback, the driver will
2896 * later call ieee80211_chswitch_done(). It may deactivate
2897 * the link as well, we handle that elsewhere and queue
344d18ce 2898 * the csa.switch_work for the calculated time then.
7ef8f682 2899 */
0f791eb4 2900 drv_channel_switch(local, sdata, &ch_switch);
5ce6e438
JB		 2901 return;
2902 }
2903
2904 /* channel switch handled in software */
ec3252bf 2905 wiphy_delayed_work_queue(local->hw.wiphy,
344d18ce
JB		 2906 &link->u.mgd.csa.switch_work,
2907 link->u.mgd.csa.time - now);
f3b0bbb3
JB		 2908 return;
2909 drop_connection:
6c18b27d
EG		 2910 /*
2911 * This is just so that the disconnect flow will know that
2912 * we were trying to switch channel and failed. In case the
2913 * mode is 1 (we are not allowed to Tx), we will know not to
2914 * send a deauthentication frame. Those two fields will be
2915 * reset when the disconnection worker runs.
2916 */
5bd5666d 2917 link->conf->csa_active = true;
344d18ce 2918 link->u.mgd.csa.blocked_tx = csa_ie.mode;
6c18b27d 2919
4b8d43f1
JB		 2920 wiphy_work_queue(sdata->local->hw.wiphy,
2921 &ifmgd->csa_connection_drop_work);
cc32abd4
JB		 2922}
2923
e21dd758
EG		 2924struct sta_bss_param_ch_cnt_data {
2925 struct ieee80211_sub_if_data *sdata;
2926 u8 reporting_link_id;
2927 u8 mld_id;
2928};
2929
2930static enum cfg80211_rnr_iter_ret
2931ieee80211_sta_bss_param_ch_cnt_iter(void *_data, u8 type,
2932 const struct ieee80211_neighbor_ap_info *info,
2933 const u8 *tbtt_info, u8 tbtt_info_len)
2934{
2935 struct sta_bss_param_ch_cnt_data *data = _data;
2936 struct ieee80211_sub_if_data *sdata = data->sdata;
2937 const struct ieee80211_tbtt_info_ge_11 *ti;
2938 u8 bss_param_ch_cnt;
2939 int link_id;
2940
2941 if (type != IEEE80211_TBTT_INFO_TYPE_TBTT)
2942 return RNR_ITER_CONTINUE;
2943
2944 if (tbtt_info_len < sizeof(*ti))
2945 return RNR_ITER_CONTINUE;
2946
2947 ti = (const void *)tbtt_info;
2948
2949 if (ti->mld_params.mld_id != data->mld_id)
2950 return RNR_ITER_CONTINUE;
2951
2952 link_id = le16_get_bits(ti->mld_params.params,
2953 IEEE80211_RNR_MLD_PARAMS_LINK_ID);
2954 bss_param_ch_cnt =
2955 le16_get_bits(ti->mld_params.params,
2956 IEEE80211_RNR_MLD_PARAMS_BSS_CHANGE_COUNT);
2957
2958 if (bss_param_ch_cnt != 255 &&
2959 link_id < ARRAY_SIZE(sdata->link)) {
2960 struct ieee80211_link_data *link =
2961 sdata_dereference(sdata->link[link_id], sdata);
2962
2963 if (link && link->conf->bss_param_ch_cnt != bss_param_ch_cnt) {
2964 link->conf->bss_param_ch_cnt = bss_param_ch_cnt;
2965 link->conf->bss_param_ch_cnt_link_id =
2966 data->reporting_link_id;
2967 }
2968 }
2969
2970 return RNR_ITER_CONTINUE;
2971}
2972
2973static void
2974ieee80211_mgd_update_bss_param_ch_cnt(struct ieee80211_sub_if_data *sdata,
2975 struct ieee80211_bss_conf *bss_conf,
2976 struct ieee802_11_elems *elems)
2977{
2978 struct sta_bss_param_ch_cnt_data data = {
2979 .reporting_link_id = bss_conf->link_id,
2980 .sdata = sdata,
2981 };
2982 int bss_param_ch_cnt;
2983
2984 if (!elems->ml_basic)
2985 return;
2986
2987 data.mld_id = ieee80211_mle_get_mld_id((const void *)elems->ml_basic);
2988
2989 cfg80211_iter_rnr(elems->ie_start, elems->total_len,
2990 ieee80211_sta_bss_param_ch_cnt_iter, &data);
2991
2992 bss_param_ch_cnt =
2993 ieee80211_mle_get_bss_param_ch_cnt((const void *)elems->ml_basic);
2994
2995 /*
2996 * Update bss_param_ch_cnt_link_id even if bss_param_ch_cnt
2997 * didn't change to indicate that we got a beacon on our own
2998 * link.
2999 */
3000 if (bss_param_ch_cnt >= 0 && bss_param_ch_cnt != 255) {
3001 bss_conf->bss_param_ch_cnt = bss_param_ch_cnt;
3002 bss_conf->bss_param_ch_cnt_link_id =
3003 bss_conf->link_id;
3004 }
3005}
3006
24a4e400 3007static bool
eea3323c 3008ieee80211_find_80211h_pwr_constr(struct ieee80211_channel *channel,
24a4e400
SG		 3009 const u8 *country_ie, u8 country_ie_len,
3010 const u8 *pwr_constr_elem,
3011 int *chan_pwr, int *pwr_reduction)
cc32abd4 3012{
04b7b2ff
JB		 3013 struct ieee80211_country_ie_triplet *triplet;
3014 int chan = ieee80211_frequency_to_channel(channel->center_freq);
24a4e400 3015 int i, chan_increment;
04b7b2ff 3016 bool have_chan_pwr = false;
cc32abd4 3017
04b7b2ff
JB		 3018 /* Invalid IE */
3019 if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
24a4e400 3020 return false;
cc32abd4 3021
04b7b2ff
JB		 3022 triplet = (void *)(country_ie + 3);
3023 country_ie_len -= 3;
3024
3025 switch (channel->band) {
3026 default:
3027 WARN_ON_ONCE(1);
fc0561dc 3028 fallthrough;
57fbcce3
JB		 3029 case NL80211_BAND_2GHZ:
3030 case NL80211_BAND_60GHZ:
63fa0426 3031 case NL80211_BAND_LC:
04b7b2ff
JB		 3032 chan_increment = 1;
3033 break;
57fbcce3 3034 case NL80211_BAND_5GHZ:
04b7b2ff
JB		 3035 chan_increment = 4;
3036 break;
2dedfe1d
JB		 3037 case NL80211_BAND_6GHZ:
3038 /*
3039 * In the 6 GHz band, the "maximum transmit power level"
3040 * field in the triplets is reserved, and thus will be
3041 * zero and we shouldn't use it to control TX power.
3042 * The actual TX power will be given in the transmit
3043 * power envelope element instead.
3044 */
3045 return false;
cc32abd4 3046 }
04b7b2ff
JB		 3047
3048 /* find channel */
3049 while (country_ie_len >= 3) {
3050 u8 first_channel = triplet->chans.first_channel;
3051
3052 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
3053 goto next;
3054
3055 for (i = 0; i < triplet->chans.num_channels; i++) {
3056 if (first_channel + i * chan_increment == chan) {
3057 have_chan_pwr = true;
24a4e400 3058 *chan_pwr = triplet->chans.max_power;
04b7b2ff
JB		 3059 break;
3060 }
3061 }
3062 if (have_chan_pwr)
3063 break;
3064
3065 next:
3066 triplet++;
3067 country_ie_len -= 3;
3068 }
3069
a5fee9cb 3070 if (have_chan_pwr && pwr_constr_elem)
24a4e400 3071 *pwr_reduction = *pwr_constr_elem;
a5fee9cb
MB		 3072 else
3073 *pwr_reduction = 0;
3074
24a4e400
SG		 3075 return have_chan_pwr;
3076}
3077
eea3323c 3078static void ieee80211_find_cisco_dtpc(struct ieee80211_channel *channel,
c8d65917
SG		 3079 const u8 *cisco_dtpc_ie,
3080 int *pwr_level)
3081{
3082 /* From practical testing, the first data byte of the DTPC element
3083 * seems to contain the requested dBm level, and the CLI on Cisco
3084 * APs clearly state the range is -127 to 127 dBm, which indicates
3085 * a signed byte, although it seemingly never actually goes negative.
3086 * The other byte seems to always be zero.
3087 */
3088 *pwr_level = (__s8)cisco_dtpc_ie[4];
3089}
3090
15ddba5f 3091static u64 ieee80211_handle_pwr_constr(struct ieee80211_link_data *link,
24a4e400
SG		 3092 struct ieee80211_channel *channel,
3093 struct ieee80211_mgmt *mgmt,
3094 const u8 *country_ie, u8 country_ie_len,
c8d65917
SG		 3095 const u8 *pwr_constr_ie,
3096 const u8 *cisco_dtpc_ie)
24a4e400 3097{
5bd5666d 3098 struct ieee80211_sub_if_data *sdata = link->sdata;
c8d65917
SG		 3099 bool has_80211h_pwr = false, has_cisco_pwr = false;
3100 int chan_pwr = 0, pwr_reduction_80211h = 0;
3101 int pwr_level_cisco, pwr_level_80211h;
24a4e400 3102 int new_ap_level;
a5fee9cb 3103 __le16 capab = mgmt->u.probe_resp.capab_info;
04b7b2ff 3104
09a740ce
TP		 3105 if (ieee80211_is_s1g_beacon(mgmt->frame_control))
3106 return 0; /* TODO */
3107
a5fee9cb
MB		 3108 if (country_ie &&
3109 (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
3110 capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
24a4e400 3111 has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
eea3323c 3112 channel, country_ie, country_ie_len,
24a4e400 3113 pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
c8d65917
SG		 3114 pwr_level_80211h =
3115 max_t(int, 0, chan_pwr - pwr_reduction_80211h);
3116 }
3117
3118 if (cisco_dtpc_ie) {
3119 ieee80211_find_cisco_dtpc(
eea3323c 3120 channel, cisco_dtpc_ie, &pwr_level_cisco);
c8d65917 3121 has_cisco_pwr = true;
24a4e400 3122 }
04b7b2ff 3123
c8d65917 3124 if (!has_80211h_pwr && !has_cisco_pwr)
1ea6f9c0 3125 return 0;
04b7b2ff 3126
c8d65917
SG		 3127 /* If we have both 802.11h and Cisco DTPC, apply both limits
3128 * by picking the smallest of the two power levels advertised.
3129 */
3130 if (has_80211h_pwr &&
3131 (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
a87da0cb
JB		 3132 new_ap_level = pwr_level_80211h;
3133
5bd5666d 3134 if (link->ap_power_level == new_ap_level)
a87da0cb
JB		 3135 return 0;
3136
cef2fc1c
JL		 3137 sdata_dbg(sdata,
3138 "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
3139 pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
5bd5666d 3140 link->u.mgd.bssid);
c8d65917 3141 } else { /* has_cisco_pwr is always true here. */
a87da0cb
JB		 3142 new_ap_level = pwr_level_cisco;
3143
5bd5666d 3144 if (link->ap_power_level == new_ap_level)
a87da0cb
JB		 3145 return 0;
3146
cef2fc1c
JL		 3147 sdata_dbg(sdata,
3148 "Limiting TX power to %d dBm as advertised by %pM\n",
5bd5666d 3149 pwr_level_cisco, link->u.mgd.bssid);
c8d65917 3150 }
04b7b2ff 3151
5bd5666d 3152 link->ap_power_level = new_ap_level;
0b7392ee 3153 if (__ieee80211_recalc_txpower(link))
1ea6f9c0
JB		 3154 return BSS_CHANGED_TXPOWER;
3155 return 0;
cc32abd4
JB		 3156}
3157
965bedad
JB		 3158/* powersave */
3159static void ieee80211_enable_ps(struct ieee80211_local *local,
3160 struct ieee80211_sub_if_data *sdata)
3161{
3162 struct ieee80211_conf *conf = &local->hw.conf;
3163
d5edaedc
JB		 3164 /*
3165 * If we are scanning right now then the parameters will
3166 * take effect when scan finishes.
3167 */
fbe9c429 3168 if (local->scanning)
d5edaedc
JB		 3169 return;
3170
965bedad 3171 if (conf->dynamic_ps_timeout > 0 &&
30686bf7 3172 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
965bedad
JB		 3173 mod_timer(&local->dynamic_ps_timer, jiffies +
3174 msecs_to_jiffies(conf->dynamic_ps_timeout));
3175 } else {
30686bf7 3176 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
076cdcb1 3177 ieee80211_send_nullfunc(local, sdata, true);
375177bf 3178
30686bf7
JB		 3179 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
3180 ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2a13052f
JO		 3181 return;
3182
3183 conf->flags |= IEEE80211_CONF_PS;
3184 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
965bedad
JB		 3185 }
3186}
3187
3188static void ieee80211_change_ps(struct ieee80211_local *local)
3189{
3190 struct ieee80211_conf *conf = &local->hw.conf;
3191
3192 if (local->ps_sdata) {
965bedad
JB		 3193 ieee80211_enable_ps(local, local->ps_sdata);
3194 } else if (conf->flags & IEEE80211_CONF_PS) {
3195 conf->flags &= ~IEEE80211_CONF_PS;
3196 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
8fa7292f 3197 timer_delete_sync(&local->dynamic_ps_timer);
9fa659f9
JB		 3198 wiphy_work_cancel(local->hw.wiphy,
3199 &local->dynamic_ps_enable_work);
965bedad
JB		 3200 }
3201}
3202
808118cb
JY		 3203static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
3204{
8c7c6b58 3205 struct ieee80211_local *local = sdata->local;
808118cb
JY		 3206 struct ieee80211_if_managed *mgd = &sdata->u.mgd;
3207 struct sta_info *sta = NULL;
c2c98fde 3208 bool authorized = false;
808118cb
JY		 3209
3210 if (!mgd->powersave)
3211 return false;
3212
05cb9108
JB		 3213 if (mgd->broken_ap)
3214 return false;
3215
808118cb
JY		 3216 if (!mgd->associated)
3217 return false;
3218
392b9ffb 3219 if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
808118cb
JY		 3220 return false;
3221
8c7c6b58
JB		 3222 if (!(local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO) &&
3223 !sdata->deflink.u.mgd.have_beacon)
ce857888
AB		 3224 return false;
3225
808118cb 3226 rcu_read_lock();
b65567b0 3227 sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
808118cb 3228 if (sta)
c2c98fde 3229 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
808118cb
JY		 3230 rcu_read_unlock();
3231
c2c98fde 3232 return authorized;
808118cb
JY		 3233}
3234
965bedad 3235/* need to hold RTNL or interface lock */
4a733ef1 3236void ieee80211_recalc_ps(struct ieee80211_local *local)
965bedad
JB		 3237{
3238 struct ieee80211_sub_if_data *sdata, *found = NULL;
3239 int count = 0;
195e294d 3240 int timeout;
965bedad 3241
28977e79
JB		 3242 if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS) ||
3243 ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
965bedad
JB		 3244 local->ps_sdata = NULL;
3245 return;
3246 }
3247
3248 list_for_each_entry(sdata, &local->interfaces, list) {
9607e6b6 3249 if (!ieee80211_sdata_running(sdata))
965bedad 3250 continue;
8c7914de
RM		 3251 if (sdata->vif.type == NL80211_IFTYPE_AP) {
3252 /* If an AP vif is found, then disable PS
3253 * by setting the count to zero thereby setting
3254 * ps_sdata to NULL.
3255 */
3256 count = 0;
3257 break;
3258 }
965bedad
JB		 3259 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3260 continue;
3261 found = sdata;
3262 count++;
3263 }
3264
808118cb 3265 if (count == 1 && ieee80211_powersave_allowed(found)) {
bfd8403a 3266 u8 dtimper = found->deflink.u.mgd.dtim_period;
10f644a4 3267
ff616381 3268 timeout = local->dynamic_ps_forced_timeout;
4a733ef1
JB		 3269 if (timeout < 0)
3270 timeout = 100;
09b85568 3271 local->hw.conf.dynamic_ps_timeout = timeout;
195e294d 3272
4a733ef1
JB		 3273 /* If the TIM IE is invalid, pretend the value is 1 */
3274 if (!dtimper)
3275 dtimper = 1;
3276
3277 local->hw.conf.ps_dtim_period = dtimper;
3278 local->ps_sdata = found;
10f644a4 3279 } else {
965bedad 3280 local->ps_sdata = NULL;
10f644a4 3281 }
965bedad
JB		 3282
3283 ieee80211_change_ps(local);
3284}
3285
ab095877
EP		 3286void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
3287{
3288 bool ps_allowed = ieee80211_powersave_allowed(sdata);
3289
a3b8008d
JB		 3290 if (sdata->vif.cfg.ps != ps_allowed) {
3291 sdata->vif.cfg.ps = ps_allowed;
3292 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_PS);
ab095877
EP		 3293 }
3294}
3295
9fa659f9
JB		 3296void ieee80211_dynamic_ps_disable_work(struct wiphy *wiphy,
3297 struct wiphy_work *work)
965bedad
JB		 3298{
3299 struct ieee80211_local *local =
3300 container_of(work, struct ieee80211_local,
3301 dynamic_ps_disable_work);
3302
3303 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
3304 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
3305 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
3306 }
3307
3308 ieee80211_wake_queues_by_reason(&local->hw,
445ea4e8 3309 IEEE80211_MAX_QUEUE_MAP,
cca07b00
LC		 3310 IEEE80211_QUEUE_STOP_REASON_PS,
3311 false);
965bedad
JB		 3312}
3313
9fa659f9
JB		 3314void ieee80211_dynamic_ps_enable_work(struct wiphy *wiphy,
3315 struct wiphy_work *work)
965bedad
JB		 3316{
3317 struct ieee80211_local *local =
3318 container_of(work, struct ieee80211_local,
3319 dynamic_ps_enable_work);
3320 struct ieee80211_sub_if_data *sdata = local->ps_sdata;
5e34069c 3321 struct ieee80211_if_managed *ifmgd;
1ddc2867
RM		 3322 unsigned long flags;
3323 int q;
965bedad
JB		 3324
3325 /* can only happen when PS was just disabled anyway */
3326 if (!sdata)
3327 return;
3328
5e34069c
CL		 3329 ifmgd = &sdata->u.mgd;
3330
965bedad
JB		 3331 if (local->hw.conf.flags & IEEE80211_CONF_PS)
3332 return;
3333
09b85568 3334 if (local->hw.conf.dynamic_ps_timeout > 0) {
77b7023a
AN		 3335 /* don't enter PS if TX frames are pending */
3336 if (drv_tx_frames_pending(local)) {
1ddc2867
RM		 3337 mod_timer(&local->dynamic_ps_timer, jiffies +
3338 msecs_to_jiffies(
3339 local->hw.conf.dynamic_ps_timeout));
3340 return;
3341 }
77b7023a
AN		 3342
3343 /*
3344 * transmission can be stopped by others which leads to
3345 * dynamic_ps_timer expiry. Postpone the ps timer if it
3346 * is not the actual idle state.
3347 */
3348 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
3349 for (q = 0; q < local->hw.queues; q++) {
3350 if (local->queue_stop_reasons[q]) {
3351 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
3352 flags);
3353 mod_timer(&local->dynamic_ps_timer, jiffies +
3354 msecs_to_jiffies(
3355 local->hw.conf.dynamic_ps_timeout));
3356 return;
3357 }
3358 }
3359 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1ddc2867 3360 }
1ddc2867 3361
30686bf7 3362 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
9c38a8b4 3363 !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
a1598383 3364 if (drv_tx_frames_pending(local)) {
e8306f98
VN		 3365 mod_timer(&local->dynamic_ps_timer, jiffies +
3366 msecs_to_jiffies(
3367 local->hw.conf.dynamic_ps_timeout));
a1598383 3368 } else {
076cdcb1 3369 ieee80211_send_nullfunc(local, sdata, true);
e8306f98 3370 /* Flush to get the tx status of nullfunc frame */
3b24f4c6 3371 ieee80211_flush_queues(local, sdata, false);
e8306f98 3372 }
f3e85b9e
VN		 3373 }
3374
30686bf7
JB		 3375 if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
3376 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
375177bf
VN		 3377 (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
3378 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
3379 local->hw.conf.flags |= IEEE80211_CONF_PS;
3380 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
3381 }
965bedad
JB		 3382}
3383
34f11cd3 3384void ieee80211_dynamic_ps_timer(struct timer_list *t)
965bedad 3385{
41cb0855
IM		 3386 struct ieee80211_local *local = timer_container_of(local, t,
3387 dynamic_ps_timer);
965bedad 3388
9fa659f9 3389 wiphy_work_queue(local->hw.wiphy, &local->dynamic_ps_enable_work);
965bedad
JB		 3390}
3391
766d2601 3392void ieee80211_dfs_cac_timer_work(struct wiphy *wiphy, struct wiphy_work *work)
164eb02d 3393{
6241d79f
AKS		 3394 struct ieee80211_link_data *link =
3395 container_of(work, struct ieee80211_link_data,
766d2601 3396 dfs_cac_timer_work.work);
6241d79f
AKS		 3397 struct cfg80211_chan_def chandef = link->conf->chanreq.oper;
3398 struct ieee80211_sub_if_data *sdata = link->sdata;
164eb02d 3399
0cd8080e
JB		 3400 lockdep_assert_wiphy(sdata->local->hw.wiphy);
3401
0b779823 3402 if (sdata->wdev.links[link->link_id].cac_started) {
6241d79f 3403 ieee80211_link_release_channel(link);
34a3740d
JB		 3404 cfg80211_cac_event(sdata->dev, &chandef,
3405 NL80211_RADAR_CAC_FINISHED,
0b779823 3406 GFP_KERNEL, link->link_id);
34a3740d 3407 }
164eb02d
SW		 3408}
3409
02219b3a
JB		 3410static bool
3411__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
3412{
3413 struct ieee80211_local *local = sdata->local;
3414 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
cc72f6e2 3415 bool ret = false;
02219b3a
JB		 3416 int ac;
3417
3418 if (local->hw.queues < IEEE80211_NUM_ACS)
3419 return false;
3420
3421 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3422 struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
3423 int non_acm_ac;
3424 unsigned long now = jiffies;
3425
3426 if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
3427 tx_tspec->admitted_time &&
3428 time_after(now, tx_tspec->time_slice_start + HZ)) {
3429 tx_tspec->consumed_tx_time = 0;
3430 tx_tspec->time_slice_start = now;
3431
3432 if (tx_tspec->downgraded)
3433 tx_tspec->action =
3434 TX_TSPEC_ACTION_STOP_DOWNGRADE;
3435 }
3436
3437 switch (tx_tspec->action) {
3438 case TX_TSPEC_ACTION_STOP_DOWNGRADE:
3439 /* take the original parameters */
b3e2130b
JB		 3440 if (drv_conf_tx(local, &sdata->deflink, ac,
3441 &sdata->deflink.tx_conf[ac]))
3442 link_err(&sdata->deflink,
3443 "failed to set TX queue parameters for queue %d\n",
3444 ac);
02219b3a
JB		 3445 tx_tspec->action = TX_TSPEC_ACTION_NONE;
3446 tx_tspec->downgraded = false;
3447 ret = true;
3448 break;
3449 case TX_TSPEC_ACTION_DOWNGRADE:
3450 if (time_after(now, tx_tspec->time_slice_start + HZ)) {
3451 tx_tspec->action = TX_TSPEC_ACTION_NONE;
3452 ret = true;
3453 break;
3454 }
3455 /* downgrade next lower non-ACM AC */
3456 for (non_acm_ac = ac + 1;
3457 non_acm_ac < IEEE80211_NUM_ACS;
3458 non_acm_ac++)
3459 if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
3460 break;
93db1d9e
JB		 3461 /* Usually the loop will result in using BK even if it
3462 * requires admission control, but such a configuration
3463 * makes no sense and we have to transmit somehow - the
3464 * AC selection does the same thing.
3465 * If we started out trying to downgrade from BK, then
3466 * the extra condition here might be needed.
02219b3a 3467 */
93db1d9e
JB		 3468 if (non_acm_ac >= IEEE80211_NUM_ACS)
3469 non_acm_ac = IEEE80211_AC_BK;
b3e2130b
JB		 3470 if (drv_conf_tx(local, &sdata->deflink, ac,
3471 &sdata->deflink.tx_conf[non_acm_ac]))
3472 link_err(&sdata->deflink,
3473 "failed to set TX queue parameters for queue %d\n",
3474 ac);
02219b3a
JB		 3475 tx_tspec->action = TX_TSPEC_ACTION_NONE;
3476 ret = true;
aca40a5f
JB		 3477 wiphy_delayed_work_queue(local->hw.wiphy,
3478 &ifmgd->tx_tspec_wk,
3479 tx_tspec->time_slice_start +
3480 HZ - now + 1);
02219b3a
JB		 3481 break;
3482 case TX_TSPEC_ACTION_NONE:
3483 /* nothing now */
3484 break;
3485 }
3486 }
3487
3488 return ret;
3489}
3490
3491void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
3492{
3493 if (__ieee80211_sta_handle_tspec_ac_params(sdata))
d8675a63
JB		 3494 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3495 BSS_CHANGED_QOS);
02219b3a
JB		 3496}
3497
aca40a5f
JB		 3498static void ieee80211_sta_handle_tspec_ac_params_wk(struct wiphy *wiphy,
3499 struct wiphy_work *work)
02219b3a
JB		 3500{
3501 struct ieee80211_sub_if_data *sdata;
3502
3503 sdata = container_of(work, struct ieee80211_sub_if_data,
3504 u.mgd.tx_tspec_wk.work);
3505 ieee80211_sta_handle_tspec_ac_params(sdata);
3506}
3507
7e415d0c
JB		 3508void ieee80211_mgd_set_link_qos_params(struct ieee80211_link_data *link)
3509{
3510 struct ieee80211_sub_if_data *sdata = link->sdata;
3511 struct ieee80211_local *local = sdata->local;
3512 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3513 struct ieee80211_tx_queue_params *params = link->tx_conf;
3514 u8 ac;
3515
3516 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3517 mlme_dbg(sdata,
3518 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
3519 ac, params[ac].acm,
3520 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
3521 params[ac].txop, params[ac].uapsd,
3522 ifmgd->tx_tspec[ac].downgraded);
3523 if (!ifmgd->tx_tspec[ac].downgraded &&
3524 drv_conf_tx(local, link, ac, &params[ac]))
3525 link_err(link,
3526 "failed to set TX queue parameters for AC %d\n",
3527 ac);
3528 }
3529}
3530
60f8b39c 3531/* MLME */
41cbb0f5 3532static bool
9696b80b
IP		 3533_ieee80211_sta_wmm_params(struct ieee80211_local *local,
3534 struct ieee80211_link_data *link,
3535 const u8 *wmm_param, size_t wmm_param_len,
3536 const struct ieee80211_mu_edca_param_set *mu_edca)
f0706e82 3537{
b3e2130b 3538 struct ieee80211_sub_if_data *sdata = link->sdata;
2ed77ea6 3539 struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
4ced3f74 3540 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
f0706e82 3541 size_t left;
2e249fc3 3542 int count, mu_edca_count, ac;
4a3cb702
JB		 3543 const u8 *pos;
3544 u8 uapsd_queues = 0;
f0706e82 3545
e1b3ec1a 3546 if (!local->ops->conf_tx)
7d25745d 3547 return false;
e1b3ec1a 3548
32c5057b 3549 if (local->hw.queues < IEEE80211_NUM_ACS)
7d25745d 3550 return false;
3434fbd3
JB		 3551
3552 if (!wmm_param)
7d25745d 3553 return false;
3434fbd3 3554
f0706e82 3555 if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
7d25745d 3556 return false;
ab13315a
KV		 3557
3558 if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
dc41e4d4 3559 uapsd_queues = ifmgd->uapsd_queues;
ab13315a 3560
f0706e82 3561 count = wmm_param[6] & 0x0f;
2e249fc3
ST		 3562 /* -1 is the initial value of ifmgd->mu_edca_last_param_set.
3563 * if mu_edca was preset before and now it disappeared tell
3564 * the driver about it.
3565 */
3566 mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
b3e2130b
JB		 3567 if (count == link->u.mgd.wmm_last_param_set &&
3568 mu_edca_count == link->u.mgd.mu_edca_last_param_set)
7d25745d 3569 return false;
b3e2130b
JB		 3570 link->u.mgd.wmm_last_param_set = count;
3571 link->u.mgd.mu_edca_last_param_set = mu_edca_count;
f0706e82
JB		 3572
3573 pos = wmm_param + 8;
3574 left = wmm_param_len - 8;
3575
3576 memset(&params, 0, sizeof(params));
3577
00e96dec 3578 sdata->wmm_acm = 0;
f0706e82
JB		 3579 for (; left >= 4; left -= 4, pos += 4) {
3580 int aci = (pos[0] >> 5) & 0x03;
3581 int acm = (pos[0] >> 4) & 0x01;
ab13315a 3582 bool uapsd = false;
f0706e82
JB		 3583
3584 switch (aci) {
0eeb59fe 3585 case 1: /* AC_BK */
2ed77ea6 3586 ac = IEEE80211_AC_BK;
988c0f72 3587 if (acm)
00e96dec 3588 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
ab13315a
KV		 3589 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
3590 uapsd = true;
41cbb0f5
LC		 3591 params[ac].mu_edca = !!mu_edca;
3592 if (mu_edca)
3593 params[ac].mu_edca_param_rec = mu_edca->ac_bk;
f0706e82 3594 break;
0eeb59fe 3595 case 2: /* AC_VI */
2ed77ea6 3596 ac = IEEE80211_AC_VI;
988c0f72 3597 if (acm)
00e96dec 3598 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
ab13315a
KV		 3599 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
3600 uapsd = true;
41cbb0f5
LC		 3601 params[ac].mu_edca = !!mu_edca;
3602 if (mu_edca)
3603 params[ac].mu_edca_param_rec = mu_edca->ac_vi;
f0706e82 3604 break;
0eeb59fe 3605 case 3: /* AC_VO */
2ed77ea6 3606 ac = IEEE80211_AC_VO;
988c0f72 3607 if (acm)
00e96dec 3608 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
ab13315a
KV		 3609 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
3610 uapsd = true;
41cbb0f5
LC		 3611 params[ac].mu_edca = !!mu_edca;
3612 if (mu_edca)
3613 params[ac].mu_edca_param_rec = mu_edca->ac_vo;
f0706e82 3614 break;
0eeb59fe 3615 case 0: /* AC_BE */
f0706e82 3616 default:
2ed77ea6 3617 ac = IEEE80211_AC_BE;
988c0f72 3618 if (acm)
00e96dec 3619 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
ab13315a
KV		 3620 if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
3621 uapsd = true;
41cbb0f5
LC		 3622 params[ac].mu_edca = !!mu_edca;
3623 if (mu_edca)
3624 params[ac].mu_edca_param_rec = mu_edca->ac_be;
f0706e82
JB		 3625 break;
3626 }
3627
2ed77ea6 3628 params[ac].aifs = pos[0] & 0x0f;
730a7550 3629
2ed77ea6 3630 if (params[ac].aifs < 2) {
b580a372
JB		 3631 link_info(link,
3632 "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
3633 params[ac].aifs, aci);
2ed77ea6 3634 params[ac].aifs = 2;
730a7550 3635 }
2ed77ea6
JB		 3636 params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
3637 params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
3638 params[ac].txop = get_unaligned_le16(pos + 2);
3639 params[ac].acm = acm;
3640 params[ac].uapsd = uapsd;
ab13315a 3641
911a2648 3642 if (params[ac].cw_min == 0 ||
c470bdc1 3643 params[ac].cw_min > params[ac].cw_max) {
b580a372
JB		 3644 link_info(link,
3645 "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
3646 params[ac].cw_min, params[ac].cw_max, aci);
2ed77ea6
JB		 3647 return false;
3648 }
e552af05 3649 ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2ed77ea6
JB		 3650 }
3651
05aaa5c9
BN		 3652 /* WMM specification requires all 4 ACIs. */
3653 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3654 if (params[ac].cw_min == 0) {
b580a372
JB		 3655 link_info(link,
3656 "AP has invalid WMM params (missing AC %d), using defaults\n",
3657 ac);
05aaa5c9
BN		 3658 return false;
3659 }
3660 }
3661
7e415d0c 3662 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
b3e2130b 3663 link->tx_conf[ac] = params[ac];
7e415d0c 3664
9696b80b
IP		 3665 return true;
3666}
3667
3668static bool
3669ieee80211_sta_wmm_params(struct ieee80211_local *local,
3670 struct ieee80211_link_data *link,
3671 const u8 *wmm_param, size_t wmm_param_len,
3672 const struct ieee80211_mu_edca_param_set *mu_edca)
3673{
3674 if (!_ieee80211_sta_wmm_params(local, link, wmm_param, wmm_param_len,
3675 mu_edca))
3676 return false;
3677
7e415d0c 3678 ieee80211_mgd_set_link_qos_params(link);
e1b3ec1a
SG		 3679
3680 /* enable WMM or activate new settings */
b3e2130b 3681 link->conf->qos = true;
7d25745d 3682 return true;
f0706e82
JB		 3683}
3684
925e64c3
SG		 3685static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
3686{
0cd8080e 3687 lockdep_assert_wiphy(sdata->local->hw.wiphy);
925e64c3 3688
392b9ffb 3689 sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
925e64c3
SG		 3690 ieee80211_run_deferred_scan(sdata->local);
3691}
3692
3693static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
3694{
0cd8080e
JB		 3695 lockdep_assert_wiphy(sdata->local->hw.wiphy);
3696
925e64c3 3697 __ieee80211_stop_poll(sdata);
925e64c3
SG		 3698}
3699
15ddba5f 3700static u64 ieee80211_handle_bss_capability(struct ieee80211_link_data *link,
7a5158ef 3701 u16 capab, bool erp_valid, u8 erp)
5628221c 3702{
1dd0f31c 3703 struct ieee80211_bss_conf *bss_conf = link->conf;
21a8e9dd 3704 struct ieee80211_supported_band *sband;
15ddba5f 3705 u64 changed = 0;
7a5158ef
JB		 3706 bool use_protection;
3707 bool use_short_preamble;
3708 bool use_short_slot;
3709
1dd0f31c 3710 sband = ieee80211_get_link_sband(link);
21a8e9dd
MSS		 3711 if (!sband)
3712 return changed;
3713
7a5158ef
JB		 3714 if (erp_valid) {
3715 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
3716 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
3717 } else {
3718 use_protection = false;
3719 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
3720 }
3721
3722 use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
07c12d61
TM		 3723 if (sband->band == NL80211_BAND_5GHZ ||
3724 sband->band == NL80211_BAND_6GHZ)
43d35343 3725 use_short_slot = true;
5628221c 3726
471b3efd 3727 if (use_protection != bss_conf->use_cts_prot) {
471b3efd
JB		 3728 bss_conf->use_cts_prot = use_protection;
3729 changed |= BSS_CHANGED_ERP_CTS_PROT;
5628221c 3730 }
7e9ed188 3731
d43c7b37 3732 if (use_short_preamble != bss_conf->use_short_preamble) {
d43c7b37 3733 bss_conf->use_short_preamble = use_short_preamble;
471b3efd 3734 changed |= BSS_CHANGED_ERP_PREAMBLE;
7e9ed188 3735 }
d9430a32 3736
7a5158ef 3737 if (use_short_slot != bss_conf->use_short_slot) {
7a5158ef
JB		 3738 bss_conf->use_short_slot = use_short_slot;
3739 changed |= BSS_CHANGED_ERP_SLOT;
50c4afb9
JL		 3740 }
3741
3742 return changed;
3743}
3744
e820373a 3745static u64 ieee80211_link_set_associated(struct ieee80211_link_data *link,
5d3a341c 3746 struct cfg80211_bss *cbss)
f0706e82 3747{
5d3a341c 3748 struct ieee80211_sub_if_data *sdata = link->sdata;
5bd5666d 3749 struct ieee80211_bss_conf *bss_conf = link->conf;
5d3a341c 3750 struct ieee80211_bss *bss = (void *)cbss->priv;
15ddba5f 3751 u64 changed = BSS_CHANGED_QOS;
d6f2da5b 3752
81151ce4 3753 /* not really used in MLO */
5d3a341c
JB		 3754 sdata->u.mgd.beacon_timeout =
3755 usecs_to_jiffies(ieee80211_tu_to_usec(beacon_loss_count *
3756 bss_conf->beacon_int));
21c0cbe7 3757
5d3a341c
JB		 3758 changed |= ieee80211_handle_bss_capability(link,
3759 bss_conf->assoc_capability,
3760 bss->has_erp_value,
3761 bss->erp_value);
3762
3763 ieee80211_check_rate_mask(link);
7ccc8bd7 3764
d73fbaf2 3765 link->conf->bss = cbss;
5bd5666d 3766 memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
e8e4f528 3767
b115b972
JD		 3768 if (sdata->vif.p2p ||
3769 sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
9caf0364 3770 const struct cfg80211_bss_ies *ies;
488dd7b5 3771
9caf0364
JB		 3772 rcu_read_lock();
3773 ies = rcu_dereference(cbss->ies);
3774 if (ies) {
9caf0364
JB		 3775 int ret;
3776
3777 ret = cfg80211_get_p2p_attr(
3778 ies->data, ies->len,
3779 IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
67baf663
JD		 3780 (u8 *) &bss_conf->p2p_noa_attr,
3781 sizeof(bss_conf->p2p_noa_attr));
9caf0364 3782 if (ret >= 2) {
5bd5666d 3783 link->u.mgd.p2p_noa_index =
67baf663 3784 bss_conf->p2p_noa_attr.index;
5d3a341c 3785 changed |= BSS_CHANGED_P2P_PS;
9caf0364 3786 }
488dd7b5 3787 }
9caf0364 3788 rcu_read_unlock();
488dd7b5
JB		 3789 }
3790
5bd5666d 3791 if (link->u.mgd.have_beacon) {
817cee76 3792 bss_conf->beacon_rate = bss->beacon_rate;
5d3a341c 3793 changed |= BSS_CHANGED_BEACON_INFO;
826262c3 3794 } else {
817cee76 3795 bss_conf->beacon_rate = NULL;
826262c3 3796 }
e5b900d2 3797
a97c13c3 3798 /* Tell the driver to monitor connection quality (if supported) */
ea086359 3799 if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
68542962 3800 bss_conf->cqm_rssi_thold)
5d3a341c
JB		 3801 changed |= BSS_CHANGED_CQM;
3802
3803 return changed;
3804}
3805
3806static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
81151ce4
JB		 3807 struct ieee80211_mgd_assoc_data *assoc_data,
3808 u64 changed[IEEE80211_MLD_MAX_NUM_LINKS])
5d3a341c
JB		 3809{
3810 struct ieee80211_local *local = sdata->local;
5d3a341c 3811 struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
81151ce4
JB		 3812 u64 vif_changed = BSS_CHANGED_ASSOC;
3813 unsigned int link_id;
5d3a341c 3814
be0df01d
JB		 3815 lockdep_assert_wiphy(local->hw.wiphy);
3816
5d3a341c 3817 sdata->u.mgd.associated = true;
81151ce4
JB		 3818
3819 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
3820 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
3821 struct ieee80211_link_data *link;
3822
c2d052a3
IP		 3823 if (!cbss ||
3824 assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
81151ce4
JB		 3825 continue;
3826
6d543b34
IP		 3827 if (ieee80211_vif_is_mld(&sdata->vif) &&
3828 !(ieee80211_vif_usable_links(&sdata->vif) & BIT(link_id)))
3829 continue;
3830
81151ce4
JB		 3831 link = sdata_dereference(sdata->link[link_id], sdata);
3832 if (WARN_ON(!link))
3833 return;
3834
3835 changed[link_id] |= ieee80211_link_set_associated(link, cbss);
3836 }
3837
5d3a341c
JB		 3838 /* just to be sure */
3839 ieee80211_stop_poll(sdata);
3840
3841 ieee80211_led_assoc(local, 1);
3842
3843 vif_cfg->assoc = 1;
a97c13c3 3844
68542962 3845 /* Enable ARP filtering */
f276e20b 3846 if (vif_cfg->arp_addr_cnt)
81151ce4
JB		 3847 vif_changed |= BSS_CHANGED_ARP_FILTER;
3848
f1871abd 3849 if (ieee80211_vif_is_mld(&sdata->vif)) {
81151ce4
JB		 3850 for (link_id = 0;
3851 link_id < IEEE80211_MLD_MAX_NUM_LINKS;
3852 link_id++) {
3853 struct ieee80211_link_data *link;
3854 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
68542962 3855
c2d052a3 3856 if (!cbss ||
6d543b34
IP		 3857 !(BIT(link_id) &
3858 ieee80211_vif_usable_links(&sdata->vif)) ||
c2d052a3 3859 assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
81151ce4
JB		 3860 continue;
3861
3862 link = sdata_dereference(sdata->link[link_id], sdata);
3863 if (WARN_ON(!link))
3864 return;
3865
3866 ieee80211_link_info_change_notify(sdata, link,
3867 changed[link_id]);
3868
3869 ieee80211_recalc_smps(sdata, link);
3870 }
3871
3872 ieee80211_vif_cfg_change_notify(sdata, vif_changed);
3873 } else {
3874 ieee80211_bss_info_change_notify(sdata,
3875 vif_changed | changed[0]);
3876 }
f0706e82 3877
4a733ef1 3878 ieee80211_recalc_ps(local);
e0cb686f 3879
81151ce4 3880 /* leave this here to not change ordering in non-MLO cases */
f1871abd 3881 if (!ieee80211_vif_is_mld(&sdata->vif))
81151ce4 3882 ieee80211_recalc_smps(sdata, &sdata->deflink);
ab095877
EP		 3883 ieee80211_recalc_ps_vif(sdata);
3884
9ac19a90 3885 netif_carrier_on(sdata->dev);
f0706e82
JB		 3886}
3887
36e05b0b
IP		 3888static void ieee80211_ml_reconf_reset(struct ieee80211_sub_if_data *sdata)
3889{
3890 struct ieee80211_mgd_assoc_data *add_links_data =
3891 sdata->u.mgd.reconf.add_links_data;
3892
3893 if (!ieee80211_vif_is_mld(&sdata->vif) ||
3894 !(sdata->u.mgd.reconf.added_links |
3895 sdata->u.mgd.reconf.removed_links))
3896 return;
3897
3898 wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
3899 &sdata->u.mgd.reconf.wk);
3900 sdata->u.mgd.reconf.added_links = 0;
3901 sdata->u.mgd.reconf.removed_links = 0;
3902 sdata->u.mgd.reconf.dialog_token = 0;
3903
3904 if (add_links_data) {
3905 struct cfg80211_mlo_reconf_done_data done_data = {};
3906 u8 link_id;
3907
3908 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
3909 link_id++)
3910 done_data.links[link_id].bss =
3911 add_links_data->link[link_id].bss;
3912
3913 cfg80211_mlo_reconf_add_done(sdata->dev, &done_data);
3914
3915 kfree(sdata->u.mgd.reconf.add_links_data);
3916 sdata->u.mgd.reconf.add_links_data = NULL;
3917 }
3918}
3919
e69e95db 3920static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
37ad3888
JB		 3921 u16 stype, u16 reason, bool tx,
3922 u8 *frame_buf)
aa458d17 3923{
46900298 3924 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
aa458d17 3925 struct ieee80211_local *local = sdata->local;
687a7c8a 3926 struct sta_info *ap_sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
81151ce4 3927 unsigned int link_id;
15ddba5f 3928 u64 changed = 0;
15fae341
JB		 3929 struct ieee80211_prep_tx_info info = {
3930 .subtype = stype,
8c626172
JB		 3931 .was_assoc = true,
3932 .link_id = ffs(sdata->vif.active_links) - 1,
15fae341 3933 };
aa458d17 3934
0cd8080e 3935 lockdep_assert_wiphy(local->hw.wiphy);
77fdaa12 3936
8af596e8
JB		 3937 if (frame_buf)
3938 memset(frame_buf, 0, IEEE80211_DEAUTH_FRAME_LEN);
3939
687a7c8a
MK		 3940 if (WARN_ON(!ap_sta))
3941 return;
3942
37ad3888
JB		 3943 if (WARN_ON_ONCE(tx && !frame_buf))
3944 return;
3945
b291ba11
JB		 3946 if (WARN_ON(!ifmgd->associated))
3947 return;
3948
79543d8e
DS		 3949 ieee80211_stop_poll(sdata);
3950
5dfad108 3951 ifmgd->associated = false;
39d80599 3952
ccbaf782
EG		 3953 if (tx) {
3954 bool tx_link_found = false;
3955
3956 for (link_id = 0;
3957 link_id < ARRAY_SIZE(sdata->link);
3958 link_id++) {
3959 struct ieee80211_link_data *link;
3960
3961 if (!ieee80211_vif_link_active(&sdata->vif, link_id))
3962 continue;
3963
3964 link = sdata_dereference(sdata->link[link_id], sdata);
3965 if (WARN_ON_ONCE(!link))
3966 continue;
3967
3968 if (link->u.mgd.csa.blocked_tx)
3969 continue;
3970
3971 tx_link_found = true;
3972 break;
3973 }
3974
3975 tx = tx_link_found;
3976 }
3977
39d80599 3978 /* other links will be destroyed */
d73fbaf2 3979 sdata->deflink.conf->bss = NULL;
de86c5f6 3980 sdata->deflink.conf->epcs_support = false;
86b2dac2 3981 sdata->deflink.smps_mode = IEEE80211_SMPS_OFF;
39d80599 3982
aa458d17
TW		 3983 netif_carrier_off(sdata->dev);
3984
88bc40e8
EP		 3985 /*
3986 * if we want to get out of ps before disassoc (why?) we have
3987 * to do it before sending disassoc, as otherwise the null-packet
3988 * won't be valid.
3989 */
3990 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
3991 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
3992 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
3993 }
3994 local->ps_sdata = NULL;
3995
ab095877
EP		 3996 /* disable per-vif ps */
3997 ieee80211_recalc_ps_vif(sdata);
3998
14f2ae83
EG		 3999 /* make sure ongoing transmission finishes */
4000 synchronize_net();
4001
3b24f4c6
EG		 4002 /*
4003 * drop any frame before deauth/disassoc, this can be data or
4004 * management frame. Since we are disconnecting, we should not
4005 * insist sending these frames which can take time and delay
4006 * the disconnection and possible the roaming.
4007 */
ccbaf782 4008 ieee80211_flush_queues(local, sdata, true);
f823981e 4009
ccbaf782 4010 if (tx) {
8c626172 4011 drv_mgd_prepare_tx(sdata->local, sdata, &info);
94ba9271 4012
81151ce4
JB		 4013 ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr,
4014 sdata->vif.cfg.ap_addr, stype,
ccbaf782 4015 reason, true, frame_buf);
37ad3888 4016
ccbaf782 4017 /* flush out frame - make sure the deauth was actually sent */
3b24f4c6 4018 ieee80211_flush_queues(local, sdata, false);
37ad3888 4019
1798271b 4020 drv_mgd_complete_tx(sdata->local, sdata, &info);
ccbaf782
EG		 4021 } else if (frame_buf) {
4022 ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr,
4023 sdata->vif.cfg.ap_addr, stype,
4024 reason, false, frame_buf);
4025 }
15fae341 4026
81151ce4
JB		 4027 /* clear AP addr only after building the needed mgmt frames */
4028 eth_zero_addr(sdata->deflink.u.mgd.bssid);
b65567b0 4029 eth_zero_addr(sdata->vif.cfg.ap_addr);
81151ce4 4030
f276e20b 4031 sdata->vif.cfg.ssid_len = 0;
b0140fda 4032
687a7c8a
MK		 4033 /* Remove TDLS peers */
4034 __sta_info_flush(sdata, false, -1, ap_sta);
4035
4036 if (sdata->vif.driver_flags & IEEE80211_VIF_REMOVE_AP_AFTER_DISASSOC) {
4037 /* Only move the AP state */
4038 sta_info_move_state(ap_sta, IEEE80211_STA_NONE);
4039 } else {
4040 /* Remove AP peer */
4041 sta_info_flush(sdata, -1);
4042 }
37ad3888
JB		 4043
4044 /* finally reset all BSS / config parameters */
f1871abd 4045 if (!ieee80211_vif_is_mld(&sdata->vif))
a94c90d3 4046 changed |= ieee80211_reset_erp_info(sdata);
f5e5bf25 4047
f5e5bf25 4048 ieee80211_led_assoc(local, 0);
ae5eb026 4049 changed |= BSS_CHANGED_ASSOC;
f276e20b 4050 sdata->vif.cfg.assoc = false;
f5e5bf25 4051
39d80599
JB		 4052 sdata->deflink.u.mgd.p2p_noa_index = -1;
4053 memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
4054 sizeof(sdata->vif.bss_conf.p2p_noa_attr));
488dd7b5 4055
dd5ecfea 4056 /* on the next assoc, re-program HT/VHT parameters */
ef96a842
BG		 4057 memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
4058 memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
dd5ecfea
JB		 4059 memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
4060 memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
23a1f8d4 4061
39d80599
JB		 4062 /*
4063 * reset MU-MIMO ownership and group data in default link,
4064 * if used, other links are destroyed
4065 */
4066 memset(sdata->vif.bss_conf.mu_group.membership, 0,
4067 sizeof(sdata->vif.bss_conf.mu_group.membership));
4068 memset(sdata->vif.bss_conf.mu_group.position, 0,
4069 sizeof(sdata->vif.bss_conf.mu_group.position));
f1871abd 4070 if (!ieee80211_vif_is_mld(&sdata->vif))
39d80599
JB		 4071 changed |= BSS_CHANGED_MU_GROUPS;
4072 sdata->vif.bss_conf.mu_mimo_owner = false;
413ad50a 4073
39d80599 4074 sdata->deflink.ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
a8302de9 4075
8fa7292f 4076 timer_delete_sync(&local->dynamic_ps_timer);
9fa659f9 4077 wiphy_work_cancel(local->hw.wiphy, &local->dynamic_ps_enable_work);
520eb820 4078
68542962 4079 /* Disable ARP filtering */
f276e20b 4080 if (sdata->vif.cfg.arp_addr_cnt)
68542962 4081 changed |= BSS_CHANGED_ARP_FILTER;
68542962 4082
39d80599 4083 sdata->vif.bss_conf.qos = false;
f1871abd 4084 if (!ieee80211_vif_is_mld(&sdata->vif)) {
81151ce4
JB		 4085 changed |= BSS_CHANGED_QOS;
4086 /* The BSSID (not really interesting) and HT changed */
4087 changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
a94c90d3
JB		 4088 ieee80211_bss_info_change_notify(sdata, changed);
4089 } else {
4090 ieee80211_vif_cfg_change_notify(sdata, changed);
81151ce4 4091 }
3abead59 4092
687a7c8a
MK		 4093 if (sdata->vif.driver_flags & IEEE80211_VIF_REMOVE_AP_AFTER_DISASSOC) {
4094 /*
4095 * After notifying the driver about the disassoc,
4096 * remove the ap sta.
4097 */
4098 sta_info_flush(sdata, -1);
4099 }
4100
3abead59 4101 /* disassociated - set to defaults now */
b3e2130b 4102 ieee80211_set_wmm_default(&sdata->deflink, false, false);
3abead59 4103
8fa7292f
TG		 4104 timer_delete_sync(&sdata->u.mgd.conn_mon_timer);
4105 timer_delete_sync(&sdata->u.mgd.bcn_mon_timer);
4106 timer_delete_sync(&sdata->u.mgd.timer);
2d9957cc 4107
39d80599
JB		 4108 sdata->vif.bss_conf.dtim_period = 0;
4109 sdata->vif.bss_conf.beacon_rate = NULL;
817cee76 4110
39d80599
JB		 4111 sdata->deflink.u.mgd.have_beacon = false;
4112 sdata->deflink.u.mgd.tracking_signal_avg = false;
4113 sdata->deflink.u.mgd.disable_wmm_tracking = false;
826262c3 4114
028e8da0 4115 ifmgd->flags = 0;
81151ce4
JB		 4116
4117 for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
4118 struct ieee80211_link_data *link;
4119
4120 link = sdata_dereference(sdata->link[link_id], sdata);
4121 if (!link)
4122 continue;
4123 ieee80211_link_release_channel(link);
4124 }
59af6928 4125
39d80599 4126 sdata->vif.bss_conf.csa_active = false;
344d18ce
JB		 4127 sdata->deflink.u.mgd.csa.blocked_tx = false;
4128 sdata->deflink.u.mgd.csa.waiting_bcn = false;
4129 sdata->deflink.u.mgd.csa.ignored_same_chan = false;
dc494fdc 4130 ieee80211_vif_unblock_queues_csa(sdata);
2475b1cc 4131
02219b3a
JB		 4132 /* existing TX TSPEC sessions no longer exist */
4133 memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
aca40a5f 4134 wiphy_delayed_work_cancel(local->hw.wiphy, &ifmgd->tx_tspec_wk);
02219b3a 4135
bc8a0fac 4136 sdata->vif.bss_conf.power_type = IEEE80211_REG_UNSET_AP;
39d80599 4137 sdata->vif.bss_conf.pwr_reduction = 0;
39dc8b8e 4138 ieee80211_clear_tpe(&sdata->vif.bss_conf.tpe);
81151ce4 4139
a8b65260
JB		 4140 sdata->vif.cfg.eml_cap = 0;
4141 sdata->vif.cfg.eml_med_sync_delay = 0;
4142 sdata->vif.cfg.mld_capa_op = 0;
4143
702e8047
AB		 4144 memset(&sdata->u.mgd.ttlm_info, 0,
4145 sizeof(sdata->u.mgd.ttlm_info));
4146 wiphy_delayed_work_cancel(sdata->local->hw.wiphy, &ifmgd->ttlm_work);
a8b65260 4147
609c12a2 4148 memset(&sdata->vif.neg_ttlm, 0, sizeof(sdata->vif.neg_ttlm));
f7660b3f
AB		 4149 wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
4150 &ifmgd->neg_ttlm_timeout_work);
53b739fd
JB		 4151
4152 sdata->u.mgd.removed_links = 0;
4153 wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
4154 &sdata->u.mgd.ml_reconf_work);
4155
3567bd6d
JB		 4156 wiphy_work_cancel(sdata->local->hw.wiphy,
4157 &ifmgd->teardown_ttlm_work);
4158
36e05b0b
IP		 4159 /* if disconnection happens in the middle of the ML reconfiguration
4160 * flow, cfg80211 must called to release the BSS references obtained
4161 * when the flow started.
4162 */
4163 ieee80211_ml_reconf_reset(sdata);
de86c5f6 4164
82306ea1
JB		 4165 ieee80211_vif_set_links(sdata, 0, 0);
4166
4167 ifmgd->mcast_seq_last = IEEE80211_SN_MODULO;
4168
de86c5f6
IP		 4169 ifmgd->epcs.enabled = false;
4170 ifmgd->epcs.dialog_token = 0;
80834e7d
JB		 4171
4172 memset(ifmgd->userspace_selectors, 0,
4173 sizeof(ifmgd->userspace_selectors));
aa458d17 4174}
f0706e82 4175
4e5ff376
FF		 4176static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
4177{
4178 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
133d40f9 4179 struct ieee80211_local *local = sdata->local;
4e5ff376 4180
0cd8080e
JB		 4181 lockdep_assert_wiphy(local->hw.wiphy);
4182
392b9ffb 4183 if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
0cd8080e 4184 return;
4e5ff376 4185
925e64c3 4186 __ieee80211_stop_poll(sdata);
133d40f9 4187
4a733ef1 4188 ieee80211_recalc_ps(local);
4e5ff376 4189
30686bf7 4190 if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
0cd8080e 4191 return;
4e5ff376
FF		 4192
4193 /*
4194 * We've received a probe response, but are not sure whether
4195 * we have or will be receiving any beacons or data, so let's
4196 * schedule the timers again, just in case.
4197 */
4198 ieee80211_sta_reset_beacon_monitor(sdata);
4199
4200 mod_timer(&ifmgd->conn_mon_timer,
4201 round_jiffies_up(jiffies +
4202 IEEE80211_CONNECTION_IDLE_TIME));
4203}
4204
02219b3a
JB		 4205static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
4206 struct ieee80211_hdr *hdr,
4207 u16 tx_time)
4208{
4209 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
d5e568c3
JB		 4210 u16 tid;
4211 int ac;
4212 struct ieee80211_sta_tx_tspec *tx_tspec;
02219b3a
JB		 4213 unsigned long now = jiffies;
4214
d5e568c3
JB		 4215 if (!ieee80211_is_data_qos(hdr->frame_control))
4216 return;
4217
4218 tid = ieee80211_get_tid(hdr);
4219 ac = ieee80211_ac_from_tid(tid);
4220 tx_tspec = &ifmgd->tx_tspec[ac];
4221
02219b3a
JB		 4222 if (likely(!tx_tspec->admitted_time))
4223 return;
4224
4225 if (time_after(now, tx_tspec->time_slice_start + HZ)) {
4226 tx_tspec->consumed_tx_time = 0;
4227 tx_tspec->time_slice_start = now;
4228
4229 if (tx_tspec->downgraded) {
4230 tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
aca40a5f
JB		 4231 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
4232 &ifmgd->tx_tspec_wk, 0);
02219b3a
JB		 4233 }
4234 }
4235
4236 if (tx_tspec->downgraded)
4237 return;
4238
4239 tx_tspec->consumed_tx_time += tx_time;
4240
4241 if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
4242 tx_tspec->downgraded = true;
4243 tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
aca40a5f
JB		 4244 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
4245 &ifmgd->tx_tspec_wk, 0);
02219b3a
JB		 4246 }
4247}
4248
4e5ff376 4249void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
02219b3a 4250 struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
4e5ff376 4251{
02219b3a
JB		 4252 ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
4253
9abf4e49
FF		 4254 if (!ieee80211_is_any_nullfunc(hdr->frame_control) ||
4255 !sdata->u.mgd.probe_send_count)
cab1c7fd 4256 return;
cab1c7fd 4257
e3f25908
FF		 4258 if (ack)
4259 sdata->u.mgd.probe_send_count = 0;
4260 else
9abf4e49 4261 sdata->u.mgd.nullfunc_failed = true;
16114496 4262 wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
4e5ff376
FF		 4263}
4264
45ad6834
JB		 4265static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
4266 const u8 *src, const u8 *dst,
4267 const u8 *ssid, size_t ssid_len,
4268 struct ieee80211_channel *channel)
4269{
4270 struct sk_buff *skb;
4271
4272 skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
4273 ssid, ssid_len, NULL, 0,
4274 IEEE80211_PROBE_FLAG_DIRECTED);
4275 if (skb)
4276 ieee80211_tx_skb(sdata, skb);
4277}
4278
a43abf29
ML		 4279static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
4280{
4281 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
b65567b0 4282 u8 *dst = sdata->vif.cfg.ap_addr;
180205bd 4283 u8 unicast_limit = max(1, max_probe_tries - 3);
49ddf8e6 4284 struct sta_info *sta;
f01a067d 4285
5435af6e
JB		 4286 lockdep_assert_wiphy(sdata->local->hw.wiphy);
4287
f1871abd 4288 if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
5bd5666d
JB		 4289 return;
4290
f01a067d
LR		 4291 /*
4292 * Try sending broadcast probe requests for the last three
4293 * probe requests after the first ones failed since some
4294 * buggy APs only support broadcast probe requests.
4295 */
4296 if (ifmgd->probe_send_count >= unicast_limit)
4297 dst = NULL;
a43abf29 4298
4e5ff376
FF		 4299 /*
4300 * When the hardware reports an accurate Tx ACK status, it's
4301 * better to send a nullfunc frame instead of a probe request,
4302 * as it will kick us off the AP quickly if we aren't associated
4303 * anymore. The timeout will be reset if the frame is ACKed by
4304 * the AP.
4305 */
992e68bf
SD		 4306 ifmgd->probe_send_count++;
4307
49ddf8e6 4308 if (dst) {
49ddf8e6
JB		 4309 sta = sta_info_get(sdata, dst);
4310 if (!WARN_ON(!sta))
4311 ieee80211_check_fast_rx(sta);
49ddf8e6
JB		 4312 }
4313
30686bf7 4314 if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
04ac3c0e 4315 ifmgd->nullfunc_failed = false;
2832943c 4316 ieee80211_send_nullfunc(sdata->local, sdata, false);
04ac3c0e 4317 } else {
45ad6834 4318 ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
f276e20b
JB		 4319 sdata->vif.cfg.ssid,
4320 sdata->vif.cfg.ssid_len,
d73fbaf2 4321 sdata->deflink.conf->bss->channel);
4e5ff376 4322 }
a43abf29 4323
180205bd 4324 ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
8d61ffa5 4325 run_again(sdata, ifmgd->probe_timeout);
a43abf29
ML		 4326}
4327
b291ba11
JB		 4328static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
4329 bool beacon)
04de8381 4330{
04de8381 4331 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
b291ba11 4332 bool already = false;
34bfc411 4333
0cd8080e
JB		 4334 lockdep_assert_wiphy(sdata->local->hw.wiphy);
4335
f1871abd 4336 if (WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif)))
5bd5666d
JB		 4337 return;
4338
9607e6b6 4339 if (!ieee80211_sdata_running(sdata))
0e2b6286
JB		 4340 return;
4341
77fdaa12 4342 if (!ifmgd->associated)
076fc877 4343 return;
77fdaa12 4344
076fc877
JB		 4345 if (sdata->local->tmp_channel || sdata->local->scanning)
4346 return;
133d40f9 4347
b33fb28c
LP		 4348 if (sdata->local->suspending) {
4349 /* reschedule after resume */
b33fb28c 4350 ieee80211_reset_ap_probe(sdata);
076fc877 4351 return;
b33fb28c
LP		 4352 }
4353
a13fbe54 4354 if (beacon) {
bdcbd8e0 4355 mlme_dbg_ratelimited(sdata,
59c1ec2b
BG		 4356 "detected beacon loss from AP (missed %d beacons) - probing\n",
4357 beacon_loss_count);
bdcbd8e0 4358
98f03342 4359 ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
a13fbe54 4360 }
04de8381 4361
b291ba11
JB		 4362 /*
4363 * The driver/our work has already reported this event or the
4364 * connection monitoring has kicked in and we have already sent
4365 * a probe request. Or maybe the AP died and the driver keeps
4366 * reporting until we disassociate...
4367 *
4368 * In either case we have to ignore the current call to this
4369 * function (except for setting the correct probe reason bit)
4370 * because otherwise we would reset the timer every time and
4371 * never check whether we received a probe response!
4372 */
392b9ffb 4373 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
b291ba11
JB		 4374 already = true;
4375
12b5f34d
EP		 4376 ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
4377
b291ba11 4378 if (already)
076fc877 4379 return;
b291ba11 4380
4a733ef1 4381 ieee80211_recalc_ps(sdata->local);
4e751843 4382
a43abf29
ML		 4383 ifmgd->probe_send_count = 0;
4384 ieee80211_mgd_probe_ap_send(sdata);
04de8381
KV		 4385}
4386
a619a4c0
JO		 4387struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
4388 struct ieee80211_vif *vif)
4389{
4390 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4391 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
d9b3b28b 4392 struct cfg80211_bss *cbss;
a619a4c0 4393 struct sk_buff *skb;
f2622138 4394 const struct element *ssid;
88c868c4 4395 int ssid_len;
a619a4c0 4396
076fc877
JB		 4397 lockdep_assert_wiphy(sdata->local->hw.wiphy);
4398
5bd5666d 4399 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
f1871abd 4400 ieee80211_vif_is_mld(&sdata->vif)))
a619a4c0
JO		 4401 return NULL;
4402
d9b3b28b 4403 if (ifmgd->associated)
d73fbaf2 4404 cbss = sdata->deflink.conf->bss;
d9b3b28b
EP		 4405 else if (ifmgd->auth_data)
4406 cbss = ifmgd->auth_data->bss;
81151ce4
JB		 4407 else if (ifmgd->assoc_data && ifmgd->assoc_data->link[0].bss)
4408 cbss = ifmgd->assoc_data->link[0].bss;
d9b3b28b 4409 else
a619a4c0
JO		 4410 return NULL;
4411
9caf0364 4412 rcu_read_lock();
f2622138
JB		 4413 ssid = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
4414 if (WARN_ONCE(!ssid || ssid->datalen > IEEE80211_MAX_SSID_LEN,
4415 "invalid SSID element (len=%d)",
4416 ssid ? ssid->datalen : -1))
88c868c4
SG		 4417 ssid_len = 0;
4418 else
f2622138 4419 ssid_len = ssid->datalen;
88c868c4 4420
a344d677 4421 skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
55de908a 4422 (u32) -1, cbss->channel,
f2622138 4423 ssid->data, ssid_len,
00387f32 4424 NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
9caf0364 4425 rcu_read_unlock();
a619a4c0
JO		 4426
4427 return skb;
4428}
4429EXPORT_SYMBOL(ieee80211_ap_probereq_get);
4430
a90faa9d
EG		 4431static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
4432 const u8 *buf, size_t len, bool tx,
3f8a39ff 4433 u16 reason, bool reconnect)
a90faa9d
EG		 4434{
4435 struct ieee80211_event event = {
4436 .type = MLME_EVENT,
4437 .u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
4438 .u.mlme.reason = reason,
4439 };
4440
4441 if (tx)
3f8a39ff 4442 cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
a90faa9d
EG		 4443 else
4444 cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
4445
4446 drv_event_callback(sdata->local, sdata, &event);
4447}
4448
076fc877 4449static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
1e4dcd01 4450{
59af6928 4451 struct ieee80211_local *local = sdata->local;
1e4dcd01 4452 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6ae16775 4453 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
1e4dcd01 4454
0cd8080e
JB		 4455 lockdep_assert_wiphy(local->hw.wiphy);
4456
ff32b450 4457 if (!ifmgd->associated)
1e4dcd01 4458 return;
1e4dcd01 4459
3f8a39ff 4460 if (!ifmgd->driver_disconnect) {
81151ce4
JB		 4461 unsigned int link_id;
4462
3f8a39ff
JB		 4463 /*
4464 * AP is probably out of range (or not reachable for another
81151ce4
JB		 4465 * reason) so remove the bss structs for that AP. In the case
4466 * of multi-link, it's not clear that all of them really are
4467 * out of range, but if they weren't the driver likely would
4468 * have switched to just have a single link active?
3f8a39ff 4469 */
81151ce4
JB		 4470 for (link_id = 0;
4471 link_id < ARRAY_SIZE(sdata->link);
4472 link_id++) {
4473 struct ieee80211_link_data *link;
4474
4475 link = sdata_dereference(sdata->link[link_id], sdata);
0e104aa3 4476 if (!link || !link->conf->bss)
81151ce4 4477 continue;
d73fbaf2
MK		 4478 cfg80211_unlink_bss(local->hw.wiphy, link->conf->bss);
4479 link->conf->bss = NULL;
81151ce4 4480 }
3f8a39ff 4481 }
20eb7ea9 4482
37ad3888 4483 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3f8a39ff
JB		 4484 ifmgd->driver_disconnect ?
4485 WLAN_REASON_DEAUTH_LEAVING :
4486 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
ccbaf782 4487 true, frame_buf);
39d80599 4488 /* the other links will be destroyed */
d0a9123e 4489 sdata->vif.bss_conf.csa_active = false;
344d18ce
JB		 4490 sdata->deflink.u.mgd.csa.waiting_bcn = false;
4491 sdata->deflink.u.mgd.csa.blocked_tx = false;
dc494fdc 4492 ieee80211_vif_unblock_queues_csa(sdata);
7da7cc1d 4493
ccbaf782 4494 ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
3f8a39ff
JB		 4495 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
4496 ifmgd->reconnect);
4497 ifmgd->reconnect = false;
ff32b450 4498}
a90faa9d 4499
4b8d43f1
JB		 4500static void ieee80211_beacon_connection_loss_work(struct wiphy *wiphy,
4501 struct wiphy_work *work)
b291ba11
JB		 4502{
4503 struct ieee80211_sub_if_data *sdata =
4504 container_of(work, struct ieee80211_sub_if_data,
1e4dcd01 4505 u.mgd.beacon_connection_loss_work);
a85e1d55 4506 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
a85e1d55 4507
682bd38b 4508 if (ifmgd->connection_loss) {
882a7c69 4509 sdata_info(sdata, "Connection to AP %pM lost\n",
b65567b0 4510 sdata->vif.cfg.ap_addr);
eef9e54c 4511 __ieee80211_disconnect(sdata);
3f8a39ff
JB		 4512 ifmgd->connection_loss = false;
4513 } else if (ifmgd->driver_disconnect) {
4514 sdata_info(sdata,
4515 "Driver requested disconnection from AP %pM\n",
b65567b0 4516 sdata->vif.cfg.ap_addr);
3f8a39ff
JB		 4517 __ieee80211_disconnect(sdata);
4518 ifmgd->driver_disconnect = false;
882a7c69 4519 } else {
5bd5666d
JB		 4520 if (ifmgd->associated)
4521 sdata->deflink.u.mgd.beacon_loss_count++;
1e4dcd01 4522 ieee80211_mgd_probe_ap(sdata, true);
882a7c69
JB		 4523 }
4524}
4525
4b8d43f1
JB		 4526static void ieee80211_csa_connection_drop_work(struct wiphy *wiphy,
4527 struct wiphy_work *work)
882a7c69
JB		 4528{
4529 struct ieee80211_sub_if_data *sdata =
4530 container_of(work, struct ieee80211_sub_if_data,
4531 u.mgd.csa_connection_drop_work);
4532
eef9e54c 4533 __ieee80211_disconnect(sdata);
b291ba11
JB		 4534}
4535
04de8381
KV		 4536void ieee80211_beacon_loss(struct ieee80211_vif *vif)
4537{
4538 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1e4dcd01 4539 struct ieee80211_hw *hw = &sdata->local->hw;
04de8381 4540
b5878a2d
JB		 4541 trace_api_beacon_loss(sdata);
4542
682bd38b 4543 sdata->u.mgd.connection_loss = false;
4b8d43f1 4544 wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
04de8381
KV		 4545}
4546EXPORT_SYMBOL(ieee80211_beacon_loss);
4547
1e4dcd01
JO		 4548void ieee80211_connection_loss(struct ieee80211_vif *vif)
4549{
41eba076
MK		 4550 struct ieee80211_sub_if_data *sdata;
4551 struct ieee80211_hw *hw;
4552
4553 KUNIT_STATIC_STUB_REDIRECT(ieee80211_connection_loss, vif);
4554
4555 sdata = vif_to_sdata(vif);
4556 hw = &sdata->local->hw;
1e4dcd01 4557
b5878a2d
JB		 4558 trace_api_connection_loss(sdata);
4559
682bd38b 4560 sdata->u.mgd.connection_loss = true;
4b8d43f1 4561 wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
1e4dcd01
JO		 4562}
4563EXPORT_SYMBOL(ieee80211_connection_loss);
4564
3f8a39ff
JB		 4565void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
4566{
4567 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4568 struct ieee80211_hw *hw = &sdata->local->hw;
4569
4570 trace_api_disconnect(sdata, reconnect);
4571
4572 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
4573 return;
4574
4575 sdata->u.mgd.driver_disconnect = true;
4576 sdata->u.mgd.reconnect = reconnect;
4b8d43f1 4577 wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3f8a39ff
JB		 4578}
4579EXPORT_SYMBOL(ieee80211_disconnect);
1e4dcd01 4580
66e67e41
JB		 4581static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
4582 bool assoc)
4583{
4584 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
4585
0cd8080e 4586 lockdep_assert_wiphy(sdata->local->hw.wiphy);
66e67e41 4587
295adaf4
MK		 4588 sdata->u.mgd.auth_data = NULL;
4589
66e67e41 4590 if (!assoc) {
c1e140bf
EG		 4591 /*
4592 * we are not authenticated yet, the only timer that could be
4593 * running is the timeout for the authentication response which
4594 * which is not relevant anymore.
4595 */
8fa7292f 4596 timer_delete_sync(&sdata->u.mgd.timer);
81151ce4 4597 sta_info_destroy_addr(sdata, auth_data->ap_addr);
66e67e41 4598
81151ce4 4599 /* other links are destroyed */
bfd8403a 4600 eth_zero_addr(sdata->deflink.u.mgd.bssid);
d8675a63
JB		 4601 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
4602 BSS_CHANGED_BSSID);
028e8da0 4603 sdata->u.mgd.flags = 0;
69371801 4604
b4f85443 4605 ieee80211_link_release_channel(&sdata->deflink);
6d543b34 4606 ieee80211_vif_set_links(sdata, 0, 0);
66e67e41
JB		 4607 }
4608
5b112d3d 4609 cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
66e67e41 4610 kfree(auth_data);
66e67e41
JB		 4611}
4612
afa2d659
JB		 4613enum assoc_status {
4614 ASSOC_SUCCESS,
4615 ASSOC_REJECTED,
4616 ASSOC_TIMEOUT,
4617 ASSOC_ABANDON,
4618};
4619
c9c99f89 4620static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
afa2d659 4621 enum assoc_status status)
c9c99f89
JB		 4622{
4623 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
4624
0cd8080e 4625 lockdep_assert_wiphy(sdata->local->hw.wiphy);
c9c99f89 4626
295adaf4
MK		 4627 sdata->u.mgd.assoc_data = NULL;
4628
afa2d659 4629 if (status != ASSOC_SUCCESS) {
c9c99f89
JB		 4630 /*
4631 * we are not associated yet, the only timer that could be
4632 * running is the timeout for the association response which
4633 * which is not relevant anymore.
4634 */
8fa7292f 4635 timer_delete_sync(&sdata->u.mgd.timer);
81151ce4 4636 sta_info_destroy_addr(sdata, assoc_data->ap_addr);
c9c99f89 4637
bfd8403a 4638 eth_zero_addr(sdata->deflink.u.mgd.bssid);
d8675a63
JB		 4639 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
4640 BSS_CHANGED_BSSID);
c9c99f89 4641 sdata->u.mgd.flags = 0;
d0a9123e 4642 sdata->vif.bss_conf.mu_mimo_owner = false;
b5a33d52 4643
afa2d659 4644 if (status != ASSOC_REJECTED) {
f662d2f4 4645 struct cfg80211_assoc_failure data = {
afa2d659 4646 .timeout = status == ASSOC_TIMEOUT,
f662d2f4 4647 };
81151ce4
JB		 4648 int i;
4649
4650 BUILD_BUG_ON(ARRAY_SIZE(data.bss) !=
4651 ARRAY_SIZE(assoc_data->link));
4652
4653 for (i = 0; i < ARRAY_SIZE(data.bss); i++)
4654 data.bss[i] = assoc_data->link[i].bss;
4655
f1871abd 4656 if (ieee80211_vif_is_mld(&sdata->vif))
81151ce4 4657 data.ap_mld_addr = assoc_data->ap_addr;
f662d2f4
JB		 4658
4659 cfg80211_assoc_failure(sdata->dev, &data);
4660 }
81151ce4 4661
69371801 4662 ieee80211_link_release_channel(&sdata->deflink);
6d543b34 4663 ieee80211_vif_set_links(sdata, 0, 0);
c9c99f89
JB		 4664 }
4665
4666 kfree(assoc_data);
c9c99f89
JB		 4667}
4668
66e67e41
JB		 4669static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
4670 struct ieee80211_mgmt *mgmt, size_t len)
4671{
1672c0e3 4672 struct ieee80211_local *local = sdata->local;
66e67e41 4673 struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
49a765d6 4674 const struct element *challenge;
66e67e41 4675 u8 *pos;
1672c0e3 4676 u32 tx_flags = 0;
15fae341
JB		 4677 struct ieee80211_prep_tx_info info = {
4678 .subtype = IEEE80211_STYPE_AUTH,
e76f3b4a 4679 .link_id = auth_data->link_id,
15fae341 4680 };
66e67e41
JB		 4681
4682 pos = mgmt->u.auth.variable;
49a765d6
JB		 4683 challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
4684 len - (pos - (u8 *)mgmt));
4685 if (!challenge)
66e67e41
JB		 4686 return;
4687 auth_data->expected_transaction = 4;
15fae341 4688 drv_mgd_prepare_tx(sdata->local, sdata, &info);
30686bf7 4689 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1672c0e3
JB		 4690 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
4691 IEEE80211_TX_INTFL_MLME_CONN_TX;
700e8ea6 4692 ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
49a765d6
JB		 4693 (void *)challenge,
4694 challenge->datalen + sizeof(*challenge),
81151ce4 4695 auth_data->ap_addr, auth_data->ap_addr,
66e67e41 4696 auth_data->key, auth_data->key_len,
1672c0e3 4697 auth_data->key_idx, tx_flags);
66e67e41
JB		 4698}
4699
a857c21e 4700static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata)
fc107a93 4701{
efb543e6 4702 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
81151ce4 4703 const u8 *ap_addr = ifmgd->auth_data->ap_addr;
fc107a93
JM		 4704 struct sta_info *sta;
4705
5435af6e
JB		 4706 lockdep_assert_wiphy(sdata->local->hw.wiphy);
4707
efb543e6
JM		 4708 sdata_info(sdata, "authenticated\n");
4709 ifmgd->auth_data->done = true;
4710 ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
4711 ifmgd->auth_data->timeout_started = true;
4712 run_again(sdata, ifmgd->auth_data->timeout);
4713
fc107a93 4714 /* move station state to auth */
b65567b0 4715 sta = sta_info_get(sdata, ap_addr);
fc107a93 4716 if (!sta) {
b65567b0 4717 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, ap_addr);
4d3acf43 4718 return false;
fc107a93
JM		 4719 }
4720 if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
b65567b0 4721 sdata_info(sdata, "failed moving %pM to auth\n", ap_addr);
4d3acf43 4722 return false;
fc107a93 4723 }
fc107a93 4724
4d3acf43 4725 return true;
fc107a93
JM		 4726}
4727
8d61ffa5
JB		 4728static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
4729 struct ieee80211_mgmt *mgmt, size_t len)
66e67e41
JB		 4730{
4731 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
66e67e41 4732 u16 auth_alg, auth_transaction, status_code;
a9409093
EG		 4733 struct ieee80211_event event = {
4734 .type = MLME_EVENT,
4735 .u.mlme.data = AUTH_EVENT,
4736 };
15fae341
JB		 4737 struct ieee80211_prep_tx_info info = {
4738 .subtype = IEEE80211_STYPE_AUTH,
4739 };
66e67e41 4740
076fc877 4741 lockdep_assert_wiphy(sdata->local->hw.wiphy);
66e67e41
JB		 4742
4743 if (len < 24 + 6)
8d61ffa5 4744 return;
66e67e41
JB		 4745
4746 if (!ifmgd->auth_data || ifmgd->auth_data->done)
8d61ffa5 4747 return;
66e67e41 4748
81151ce4 4749 if (!ether_addr_equal(ifmgd->auth_data->ap_addr, mgmt->bssid))
8d61ffa5 4750 return;
66e67e41
JB		 4751
4752 auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
4753 auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
4754 status_code = le16_to_cpu(mgmt->u.auth.status_code);
4755
8c60179b
EG		 4756 info.link_id = ifmgd->auth_data->link_id;
4757
66e67e41 4758 if (auth_alg != ifmgd->auth_data->algorithm ||
efb543e6
JM		 4759 (auth_alg != WLAN_AUTH_SAE &&
4760 auth_transaction != ifmgd->auth_data->expected_transaction) ||
4761 (auth_alg == WLAN_AUTH_SAE &&
4762 (auth_transaction < ifmgd->auth_data->expected_transaction ||
4763 auth_transaction > 2))) {
0f4126e8
JM		 4764 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
4765 mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
4766 auth_transaction,
4767 ifmgd->auth_data->expected_transaction);
15fae341 4768 goto notify_driver;
0f4126e8 4769 }
66e67e41
JB		 4770
4771 if (status_code != WLAN_STATUS_SUCCESS) {
a4055e74
AO		 4772 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
4773
4774 if (auth_alg == WLAN_AUTH_SAE &&
4e56cde1
JM		 4775 (status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED ||
4776 (auth_transaction == 1 &&
4777 (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
94d9864c
JB		 4778 status_code == WLAN_STATUS_SAE_PK)))) {
4779 /* waiting for userspace now */
4780 ifmgd->auth_data->waiting = true;
4781 ifmgd->auth_data->timeout =
4782 jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY;
4783 ifmgd->auth_data->timeout_started = true;
4784 run_again(sdata, ifmgd->auth_data->timeout);
15fae341 4785 goto notify_driver;
94d9864c 4786 }
a4055e74 4787
bdcbd8e0
JB		 4788 sdata_info(sdata, "%pM denied authentication (status %d)\n",
4789 mgmt->sa, status_code);
dac211ec 4790 ieee80211_destroy_auth_data(sdata, false);
a9409093
EG		 4791 event.u.mlme.status = MLME_DENIED;
4792 event.u.mlme.reason = status_code;
4793 drv_event_callback(sdata->local, sdata, &event);
15fae341 4794 goto notify_driver;
66e67e41
JB		 4795 }
4796
4797 switch (ifmgd->auth_data->algorithm) {
4798 case WLAN_AUTH_OPEN:
4799 case WLAN_AUTH_LEAP:
4800 case WLAN_AUTH_FT:
6b8ece3a 4801 case WLAN_AUTH_SAE:
dbc0c2cb
JM		 4802 case WLAN_AUTH_FILS_SK:
4803 case WLAN_AUTH_FILS_SK_PFS:
4804 case WLAN_AUTH_FILS_PK:
66e67e41
JB		 4805 break;
4806 case WLAN_AUTH_SHARED_KEY:
4807 if (ifmgd->auth_data->expected_transaction != 4) {
4808 ieee80211_auth_challenge(sdata, mgmt, len);
4809 /* need another frame */
8d61ffa5 4810 return;
66e67e41
JB		 4811 }
4812 break;
4813 default:
4814 WARN_ONCE(1, "invalid auth alg %d",
4815 ifmgd->auth_data->algorithm);
15fae341 4816 goto notify_driver;
66e67e41
JB		 4817 }
4818
a9409093 4819 event.u.mlme.status = MLME_SUCCESS;
15fae341 4820 info.success = 1;
a9409093 4821 drv_event_callback(sdata->local, sdata, &event);
efb543e6
JM		 4822 if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
4823 (auth_transaction == 2 &&
4824 ifmgd->auth_data->expected_transaction == 2)) {
a857c21e 4825 if (!ieee80211_mark_sta_auth(sdata))
0daa63ed 4826 return; /* ignore frame -- wait for timeout */
efb543e6
JM		 4827 } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
4828 auth_transaction == 2) {
4829 sdata_info(sdata, "SAE peer confirmed\n");
4830 ifmgd->auth_data->peer_confirmed = true;
6b8ece3a
JM		 4831 }
4832
6ff57cf8 4833 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
15fae341
JB		 4834notify_driver:
4835 drv_mgd_complete_tx(sdata->local, sdata, &info);
66e67e41
JB		 4836}
4837
dfa1ad29
CO		 4838#define case_WLAN(type) \
4839 case WLAN_REASON_##type: return #type
4840
79c92ca4 4841const char *ieee80211_get_reason_code_string(u16 reason_code)
dfa1ad29
CO		 4842{
4843 switch (reason_code) {
4844 case_WLAN(UNSPECIFIED);
4845 case_WLAN(PREV_AUTH_NOT_VALID);
4846 case_WLAN(DEAUTH_LEAVING);
4847 case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
4848 case_WLAN(DISASSOC_AP_BUSY);
4849 case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
4850 case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
4851 case_WLAN(DISASSOC_STA_HAS_LEFT);
4852 case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
4853 case_WLAN(DISASSOC_BAD_POWER);
4854 case_WLAN(DISASSOC_BAD_SUPP_CHAN);
4855 case_WLAN(INVALID_IE);
4856 case_WLAN(MIC_FAILURE);
4857 case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
4858 case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
4859 case_WLAN(IE_DIFFERENT);
4860 case_WLAN(INVALID_GROUP_CIPHER);
4861 case_WLAN(INVALID_PAIRWISE_CIPHER);
4862 case_WLAN(INVALID_AKMP);
4863 case_WLAN(UNSUPP_RSN_VERSION);
4864 case_WLAN(INVALID_RSN_IE_CAP);
4865 case_WLAN(IEEE8021X_FAILED);
4866 case_WLAN(CIPHER_SUITE_REJECTED);
4867 case_WLAN(DISASSOC_UNSPECIFIED_QOS);
4868 case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
4869 case_WLAN(DISASSOC_LOW_ACK);
4870 case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
4871 case_WLAN(QSTA_LEAVE_QBSS);
4872 case_WLAN(QSTA_NOT_USE);
4873 case_WLAN(QSTA_REQUIRE_SETUP);
4874 case_WLAN(QSTA_TIMEOUT);
4875 case_WLAN(QSTA_CIPHER_NOT_SUPP);
4876 case_WLAN(MESH_PEER_CANCELED);
4877 case_WLAN(MESH_MAX_PEERS);
4878 case_WLAN(MESH_CONFIG);
4879 case_WLAN(MESH_CLOSE);
4880 case_WLAN(MESH_MAX_RETRIES);
4881 case_WLAN(MESH_CONFIRM_TIMEOUT);
4882 case_WLAN(MESH_INVALID_GTK);
4883 case_WLAN(MESH_INCONSISTENT_PARAM);
4884 case_WLAN(MESH_INVALID_SECURITY);
4885 case_WLAN(MESH_PATH_ERROR);
4886 case_WLAN(MESH_PATH_NOFORWARD);
4887 case_WLAN(MESH_PATH_DEST_UNREACHABLE);
4888 case_WLAN(MAC_EXISTS_IN_MBSS);
4889 case_WLAN(MESH_CHAN_REGULATORY);
4890 case_WLAN(MESH_CHAN);
4891 default: return "<unknown>";
4892 }
4893}
66e67e41 4894
8d61ffa5
JB		 4895static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
4896 struct ieee80211_mgmt *mgmt, size_t len)
f0706e82 4897{
46900298 4898 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
c9c99f89 4899 u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
f0706e82 4900
076fc877 4901 lockdep_assert_wiphy(sdata->local->hw.wiphy);
66e67e41 4902
f4ea83dd 4903 if (len < 24 + 2)
8d61ffa5 4904 return;
f0706e82 4905
79c92ca4
YW		 4906 if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
4907 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
4908 return;
4909 }
4910
c9c99f89 4911 if (ifmgd->associated &&
81151ce4 4912 ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {
c9c99f89 4913 sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
81151ce4 4914 sdata->vif.cfg.ap_addr, reason_code,
c9c99f89 4915 ieee80211_get_reason_code_string(reason_code));
f0706e82 4916
c9c99f89 4917 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
f0706e82 4918
c9c99f89 4919 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
3f8a39ff 4920 reason_code, false);
c9c99f89
JB		 4921 return;
4922 }
77fdaa12 4923
c9c99f89 4924 if (ifmgd->assoc_data &&
81151ce4 4925 ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->ap_addr)) {
c9c99f89
JB		 4926 sdata_info(sdata,
4927 "deauthenticated from %pM while associating (Reason: %u=%s)\n",
81151ce4 4928 ifmgd->assoc_data->ap_addr, reason_code,
c9c99f89
JB		 4929 ieee80211_get_reason_code_string(reason_code));
4930
afa2d659 4931 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
c9c99f89
JB		 4932
4933 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
4934 return;
4935 }
f0706e82
JB		 4936}
4937
4938
8d61ffa5
JB		 4939static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
4940 struct ieee80211_mgmt *mgmt, size_t len)
f0706e82 4941{
46900298 4942 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
f0706e82
JB		 4943 u16 reason_code;
4944
076fc877 4945 lockdep_assert_wiphy(sdata->local->hw.wiphy);
77fdaa12 4946
66e67e41 4947 if (len < 24 + 2)
8d61ffa5 4948 return;
77fdaa12 4949
66e67e41 4950 if (!ifmgd->associated ||
81151ce4 4951 !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
8d61ffa5 4952 return;
f0706e82
JB		 4953
4954 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
4955
79c92ca4
YW		 4956 if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
4957 ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
4958 return;
4959 }
4960
68506e9a 4961 sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
81151ce4 4962 sdata->vif.cfg.ap_addr, reason_code,
68506e9a 4963 ieee80211_get_reason_code_string(reason_code));
f0706e82 4964
37ad3888
JB		 4965 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
4966
3f8a39ff
JB		 4967 ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
4968 false);
f0706e82
JB		 4969}
4970
0143ea09
HD		 4971static bool ieee80211_twt_req_supported(struct ieee80211_sub_if_data *sdata,
4972 struct ieee80211_supported_band *sband,
4973 const struct link_sta_info *link_sta,
55ebd6e6
EG		 4974 const struct ieee802_11_elems *elems)
4975{
0143ea09 4976 const struct ieee80211_sta_he_cap *own_he_cap =
1ec7291e 4977 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
0143ea09 4978
55ebd6e6
EG		 4979 if (elems->ext_capab_len < 10)
4980 return false;
4981
4982 if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
4983 return false;
4984
98b0b467 4985 return link_sta->pub->he_cap.he_cap_elem.mac_cap_info[0] &
0143ea09
HD		 4986 IEEE80211_HE_MAC_CAP0_TWT_RES &&
4987 own_he_cap &&
4988 (own_he_cap->he_cap_elem.mac_cap_info[0] &
4989 IEEE80211_HE_MAC_CAP0_TWT_REQ);
55ebd6e6
EG		 4990}
4991
15ddba5f 4992static u64 ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
0143ea09
HD		 4993 struct ieee80211_supported_band *sband,
4994 struct ieee80211_link_data *link,
98b0b467 4995 struct link_sta_info *link_sta,
c9d3245e
JC		 4996 struct ieee802_11_elems *elems)
4997{
0143ea09 4998 bool twt = ieee80211_twt_req_supported(sdata, sband, link_sta, elems);
c9d3245e 4999
5bd5666d
JB		 5000 if (link->conf->twt_requester != twt) {
5001 link->conf->twt_requester = twt;
c9d3245e
JC		 5002 return BSS_CHANGED_TWT;
5003 }
5004 return 0;
5005}
5006
bac2fd3d
JB		 5007static bool ieee80211_twt_bcast_support(struct ieee80211_sub_if_data *sdata,
5008 struct ieee80211_bss_conf *bss_conf,
d8b26154 5009 struct ieee80211_supported_band *sband,
98b0b467 5010 struct link_sta_info *link_sta)
d8b26154
ST		 5011{
5012 const struct ieee80211_sta_he_cap *own_he_cap =
1ec7291e 5013 ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
d8b26154
ST		 5014
5015 return bss_conf->he_support &&
98b0b467 5016 (link_sta->pub->he_cap.he_cap_elem.mac_cap_info[2] &
d8b26154
ST		 5017 IEEE80211_HE_MAC_CAP2_BCAST_TWT) &&
5018 own_he_cap &&
5019 (own_he_cap->he_cap_elem.mac_cap_info[2] &
5020 IEEE80211_HE_MAC_CAP2_BCAST_TWT);
5021}
5022
de86c5f6
IP		 5023static void ieee80211_epcs_changed(struct ieee80211_sub_if_data *sdata,
5024 bool enabled)
5025{
5026 /* in any case this is called, dialog token should be reset */
5027 sdata->u.mgd.epcs.dialog_token = 0;
5028
5029 if (sdata->u.mgd.epcs.enabled == enabled)
5030 return;
5031
5032 sdata->u.mgd.epcs.enabled = enabled;
5033 cfg80211_epcs_changed(sdata->dev, enabled);
5034}
5035
5036static void ieee80211_epcs_teardown(struct ieee80211_sub_if_data *sdata)
5037{
5038 struct ieee80211_local *local = sdata->local;
5039 u8 link_id;
5040
5041 if (!sdata->u.mgd.epcs.enabled)
5042 return;
5043
5044 lockdep_assert_wiphy(local->hw.wiphy);
5045
5046 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5047 struct ieee802_11_elems *elems;
5048 struct ieee80211_link_data *link;
5049 const struct cfg80211_bss_ies *ies;
5050 bool ret;
5051
5052 rcu_read_lock();
5053
5054 link = sdata_dereference(sdata->link[link_id], sdata);
5055 if (!link || !link->conf || !link->conf->bss) {
5056 rcu_read_unlock();
5057 continue;
5058 }
5059
5060 if (link->u.mgd.disable_wmm_tracking) {
5061 rcu_read_unlock();
5062 ieee80211_set_wmm_default(link, false, false);
5063 continue;
5064 }
5065
5066 ies = rcu_dereference(link->conf->bss->beacon_ies);
5067 if (!ies) {
5068 rcu_read_unlock();
5069 ieee80211_set_wmm_default(link, false, false);
5070 continue;
5071 }
5072
5073 elems = ieee802_11_parse_elems(ies->data, ies->len, false,
5074 NULL);
5075 if (!elems) {
5076 rcu_read_unlock();
5077 ieee80211_set_wmm_default(link, false, false);
5078 continue;
5079 }
5080
5081 ret = _ieee80211_sta_wmm_params(local, link,
5082 elems->wmm_param,
5083 elems->wmm_param_len,
5084 elems->mu_edca_param_set);
5085
5086 kfree(elems);
5087 rcu_read_unlock();
5088
5089 if (!ret) {
5090 ieee80211_set_wmm_default(link, false, false);
5091 continue;
5092 }
5093
5094 ieee80211_mgd_set_link_qos_params(link);
5095 ieee80211_link_info_change_notify(sdata, link, BSS_CHANGED_QOS);
5096 }
5097}
5098
6911458d
JB		 5099static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
5100 struct link_sta_info *link_sta,
5101 struct cfg80211_bss *cbss,
5102 struct ieee80211_mgmt *mgmt,
5103 const u8 *elem_start,
5104 unsigned int elem_len,
5105 u64 *changed)
5106{
5107 struct ieee80211_sub_if_data *sdata = link->sdata;
36e05b0b
IP		 5108 struct ieee80211_mgd_assoc_data *assoc_data =
5109 sdata->u.mgd.assoc_data ?: sdata->u.mgd.reconf.add_links_data;
6911458d
JB		 5110 struct ieee80211_bss_conf *bss_conf = link->conf;
5111 struct ieee80211_local *local = sdata->local;
45ebac4f 5112 unsigned int link_id = link->link_id;
6911458d 5113 struct ieee80211_elems_parse_params parse_params = {
310c8387 5114 .mode = link->u.mgd.conn.mode,
6911458d
JB		 5115 .start = elem_start,
5116 .len = elem_len,
45ebac4f 5117 .link_id = link_id == assoc_data->assoc_link_id ? -1 : link_id,
ea5cba26 5118 .from_ap = true,
6911458d 5119 };
310c8387 5120 bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
6911458d
JB		 5121 bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
5122 bool is_s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
5123 const struct cfg80211_bss_ies *bss_ies = NULL;
5124 struct ieee80211_supported_band *sband;
5125 struct ieee802_11_elems *elems;
5c1f9753
JB		 5126 const __le16 prof_bss_param_ch_present =
5127 cpu_to_le16(IEEE80211_MLE_STA_CONTROL_BSS_PARAM_CHANGE_CNT_PRESENT);
6911458d
JB		 5128 u16 capab_info;
5129 bool ret;
5130
5131 elems = ieee802_11_parse_elems_full(&parse_params);
5132 if (!elems)
5133 return false;
5134
45ebac4f
IP		 5135 if (link_id == assoc_data->assoc_link_id) {
5136 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
c2d052a3
IP		 5137
5138 /*
5139 * we should not get to this flow unless the association was
5140 * successful, so set the status directly to success
5141 */
5142 assoc_data->link[link_id].status = WLAN_STATUS_SUCCESS;
5c1f9753 5143 if (elems->ml_basic) {
6bd14aee
JB		 5144 int bss_param_ch_cnt =
5145 ieee80211_mle_get_bss_param_ch_cnt((const void *)elems->ml_basic);
5146
5147 if (bss_param_ch_cnt < 0) {
5c1f9753
JB		 5148 ret = false;
5149 goto out;
5150 }
e21dd758
EG		 5151 bss_conf->bss_param_ch_cnt = bss_param_ch_cnt;
5152 bss_conf->bss_param_ch_cnt_link_id = link_id;
5c1f9753 5153 }
a57944d1
JB		 5154 } else if (elems->parse_error & IEEE80211_PARSE_ERR_DUP_NEST_ML_BASIC ||
5155 !elems->prof ||
5c1f9753 5156 !(elems->prof->control & prof_bss_param_ch_present)) {
45ebac4f
IP		 5157 ret = false;
5158 goto out;
5159 } else {
5160 const u8 *ptr = elems->prof->variable +
5161 elems->prof->sta_info_len - 1;
e21dd758 5162 int bss_param_ch_cnt;
45ebac4f 5163
c2d052a3
IP		 5164 /*
5165 * During parsing, we validated that these fields exist,
5166 * otherwise elems->prof would have been set to NULL.
5167 */
45ebac4f 5168 capab_info = get_unaligned_le16(ptr);
c2d052a3 5169 assoc_data->link[link_id].status = get_unaligned_le16(ptr + 2);
e21dd758 5170 bss_param_ch_cnt =
5c1f9753 5171 ieee80211_mle_basic_sta_prof_bss_param_ch_cnt(elems->prof);
e21dd758
EG		 5172 bss_conf->bss_param_ch_cnt = bss_param_ch_cnt;
5173 bss_conf->bss_param_ch_cnt_link_id = link_id;
c2d052a3
IP		 5174
5175 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
5176 link_info(link, "association response status code=%u\n",
5177 assoc_data->link[link_id].status);
5178 ret = true;
5179 goto out;
5180 }
45ebac4f 5181 }
6911458d
JB		 5182
5183 if (!is_s1g && !elems->supp_rates) {
5184 sdata_info(sdata, "no SuppRates element in AssocResp\n");
5185 ret = false;
5186 goto out;
5187 }
5188
5189 link->u.mgd.tdls_chan_switch_prohibited =
5190 elems->ext_capab && elems->ext_capab_len >= 5 &&
5191 (elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
5192
5193 /*
5194 * Some APs are erroneously not including some information in their
5195 * (re)association response frames. Try to recover by using the data
5196 * from the beacon or probe response. This seems to afflict mobile
5197 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
5198 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
5199 */
3ad4fce6 5200 if (!ieee80211_hw_check(&local->hw, STRICT) && !is_6ghz &&
6911458d 5201 ((assoc_data->wmm && !elems->wmm_param) ||
310c8387 5202 (link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT &&
6911458d 5203 (!elems->ht_cap_elem || !elems->ht_operation)) ||
67bb124c 5204 (is_5ghz && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT &&
6911458d
JB		 5205 (!elems->vht_cap_elem || !elems->vht_operation)))) {
5206 const struct cfg80211_bss_ies *ies;
5207 struct ieee802_11_elems *bss_elems;
5208
5209 rcu_read_lock();
5210 ies = rcu_dereference(cbss->ies);
5211 if (ies)
5212 bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
5213 GFP_ATOMIC);
5214 rcu_read_unlock();
5215 if (!bss_ies) {
5216 ret = false;
5217 goto out;
5218 }
5219
5220 parse_params.start = bss_ies->data;
5221 parse_params.len = bss_ies->len;
8950b598 5222 parse_params.bss = cbss;
99ca2c28 5223 parse_params.link_id = -1;
6911458d
JB		 5224 bss_elems = ieee802_11_parse_elems_full(&parse_params);
5225 if (!bss_elems) {
5226 ret = false;
5227 goto out;
5228 }
5229
5230 if (assoc_data->wmm &&
5231 !elems->wmm_param && bss_elems->wmm_param) {
5232 elems->wmm_param = bss_elems->wmm_param;
5233 sdata_info(sdata,
5234 "AP bug: WMM param missing from AssocResp\n");
5235 }
5236
5237 /*
5238 * Also check if we requested HT/VHT, otherwise the AP doesn't
5239 * have to include the IEs in the (re)association response.
5240 */
5241 if (!elems->ht_cap_elem && bss_elems->ht_cap_elem &&
310c8387 5242 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT) {
6911458d
JB		 5243 elems->ht_cap_elem = bss_elems->ht_cap_elem;
5244 sdata_info(sdata,
5245 "AP bug: HT capability missing from AssocResp\n");
5246 }
5247 if (!elems->ht_operation && bss_elems->ht_operation &&
310c8387 5248 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT) {
6911458d
JB		 5249 elems->ht_operation = bss_elems->ht_operation;
5250 sdata_info(sdata,
5251 "AP bug: HT operation missing from AssocResp\n");
5252 }
6911458d 5253
67bb124c
IP		 5254 if (is_5ghz) {
5255 if (!elems->vht_cap_elem && bss_elems->vht_cap_elem &&
5256 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT) {
5257 elems->vht_cap_elem = bss_elems->vht_cap_elem;
5258 sdata_info(sdata,
5259 "AP bug: VHT capa missing from AssocResp\n");
5260 }
5261
5262 if (!elems->vht_operation && bss_elems->vht_operation &&
5263 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT) {
5264 elems->vht_operation = bss_elems->vht_operation;
5265 sdata_info(sdata,
5266 "AP bug: VHT operation missing from AssocResp\n");
5267 }
5268 }
6911458d
JB		 5269 kfree(bss_elems);
5270 }
5271
5272 /*
5273 * We previously checked these in the beacon/probe response, so
5274 * they should be present here. This is just a safety net.
6bc574a7
JB		 5275 * Note that the ieee80211_config_bw() below would also check
5276 * for this (and more), but this has better error reporting.
6911458d 5277 */
310c8387 5278 if (!is_6ghz && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT &&
6911458d
JB		 5279 (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
5280 sdata_info(sdata,
5281 "HT AP is missing WMM params or HT capability/operation\n");
5282 ret = false;
5283 goto out;
5284 }
5285
310c8387 5286 if (is_5ghz && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT &&
6911458d
JB		 5287 (!elems->vht_cap_elem || !elems->vht_operation)) {
5288 sdata_info(sdata,
5289 "VHT AP is missing VHT capability/operation\n");
5290 ret = false;
5291 goto out;
5292 }
5293
6bc574a7
JB		 5294 /* check/update if AP changed anything in assoc response vs. scan */
5295 if (ieee80211_config_bw(link, elems,
5296 link_id == assoc_data->assoc_link_id,
69f95565 5297 changed, "assoc response")) {
6bc574a7
JB		 5298 ret = false;
5299 goto out;
5300 }
5301
6092077a 5302 if (WARN_ON(!link->conf->chanreq.oper.chan)) {
6911458d
JB		 5303 ret = false;
5304 goto out;
5305 }
6092077a 5306 sband = local->hw.wiphy->bands[link->conf->chanreq.oper.chan->band];
6911458d 5307
6911458d 5308 /* Set up internal HT/VHT capabilities */
310c8387 5309 if (elems->ht_cap_elem && link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HT)
6911458d
JB		 5310 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
5311 elems->ht_cap_elem,
5312 link_sta);
5313
084cf2ae 5314 if (elems->vht_cap_elem &&
310c8387 5315 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_VHT) {
084cf2ae
JB		 5316 const struct ieee80211_vht_cap *bss_vht_cap = NULL;
5317 const struct cfg80211_bss_ies *ies;
5318
5319 /*
5320 * Cisco AP module 9115 with FW 17.3 has a bug and sends a
5321 * too large maximum MPDU length in the association response
5322 * (indicating 12k) that it cannot actually process ...
5323 * Work around that.
5324 */
5325 rcu_read_lock();
5326 ies = rcu_dereference(cbss->ies);
5327 if (ies) {
5328 const struct element *elem;
5329
5330 elem = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY,
5331 ies->data, ies->len);
5332 if (elem && elem->datalen >= sizeof(*bss_vht_cap))
5333 bss_vht_cap = (const void *)elem->data;
5334 }
5335
3ad4fce6
JB		 5336 if (ieee80211_hw_check(&local->hw, STRICT) &&
5337 (!bss_vht_cap || memcmp(bss_vht_cap, elems->vht_cap_elem,
5338 sizeof(*bss_vht_cap)))) {
5339 rcu_read_unlock();
5340 ret = false;
5341 link_info(link, "VHT capabilities mismatch\n");
5342 goto out;
5343 }
5344
6911458d
JB		 5345 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
5346 elems->vht_cap_elem,
084cf2ae
JB		 5347 bss_vht_cap, link_sta);
5348 rcu_read_unlock();
5349 }
6911458d 5350
310c8387
JB		 5351 if (elems->he_operation &&
5352 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HE &&
6911458d
JB		 5353 elems->he_cap) {
5354 ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
5355 elems->he_cap,
5356 elems->he_cap_len,
5357 elems->he_6ghz_capa,
5358 link_sta);
5359
5360 bss_conf->he_support = link_sta->pub->he_cap.has_he;
5361 if (elems->rsnx && elems->rsnx_len &&
5362 (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
5363 wiphy_ext_feature_isset(local->hw.wiphy,
5364 NL80211_EXT_FEATURE_PROTECTED_TWT))
5365 bss_conf->twt_protected = true;
5366 else
5367 bss_conf->twt_protected = false;
5368
0143ea09
HD		 5369 *changed |= ieee80211_recalc_twt_req(sdata, sband, link,
5370 link_sta, elems);
6911458d
JB		 5371
5372 if (elems->eht_operation && elems->eht_cap &&
310c8387 5373 link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_EHT) {
6911458d
JB		 5374 ieee80211_eht_cap_ie_to_sta_eht_cap(sdata, sband,
5375 elems->he_cap,
5376 elems->he_cap_len,
5377 elems->eht_cap,
5378 elems->eht_cap_len,
5379 link_sta);
5380
5381 bss_conf->eht_support = link_sta->pub->eht_cap.has_eht;
de86c5f6
IP		 5382 bss_conf->epcs_support = bss_conf->eht_support &&
5383 !!(elems->eht_cap->fixed.mac_cap_info[0] &
5384 IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS);
5385
5386 /* EPCS might be already enabled but a new added link
5387 * does not support EPCS. This should not really happen
5388 * in practice.
5389 */
5390 if (sdata->u.mgd.epcs.enabled &&
5391 !bss_conf->epcs_support)
5392 ieee80211_epcs_teardown(sdata);
6911458d
JB		 5393 } else {
5394 bss_conf->eht_support = false;
de86c5f6 5395 bss_conf->epcs_support = false;
6911458d
JB		 5396 }
5397 } else {
5398 bss_conf->he_support = false;
5399 bss_conf->twt_requester = false;
5400 bss_conf->twt_protected = false;
5401 bss_conf->eht_support = false;
de86c5f6 5402 bss_conf->epcs_support = false;
6911458d
JB		 5403 }
5404
5405 bss_conf->twt_broadcast =
5406 ieee80211_twt_bcast_support(sdata, bss_conf, sband, link_sta);
5407
5408 if (bss_conf->he_support) {
5409 bss_conf->he_bss_color.color =
5410 le32_get_bits(elems->he_operation->he_oper_params,
5411 IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
5412 bss_conf->he_bss_color.partial =
5413 le32_get_bits(elems->he_operation->he_oper_params,
5414 IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
5415 bss_conf->he_bss_color.enabled =
5416 !le32_get_bits(elems->he_operation->he_oper_params,
5417 IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
5418
5419 if (bss_conf->he_bss_color.enabled)
5420 *changed |= BSS_CHANGED_HE_BSS_COLOR;
5421
5422 bss_conf->htc_trig_based_pkt_ext =
5423 le32_get_bits(elems->he_operation->he_oper_params,
5424 IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
5425 bss_conf->frame_time_rts_th =
5426 le32_get_bits(elems->he_operation->he_oper_params,
5427 IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
5428
5429 bss_conf->uora_exists = !!elems->uora_element;
5430 if (elems->uora_element)
5431 bss_conf->uora_ocw_range = elems->uora_element[0];
5432
5433 ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
5434 ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
5435 /* TODO: OPEN: what happens if BSS color disable is set? */
5436 }
5437
5438 if (cbss->transmitted_bss) {
5439 bss_conf->nontransmitted = true;
5440 ether_addr_copy(bss_conf->transmitter_bssid,
5441 cbss->transmitted_bss->bssid);
5442 bss_conf->bssid_indicator = cbss->max_bssid_indicator;
5443 bss_conf->bssid_index = cbss->bssid_index;
5444 }
5445
5446 /*
5447 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
5448 * in their association response, so ignore that data for our own
5449 * configuration. If it changed since the last beacon, we'll get the
5450 * next beacon and update then.
5451 */
5452
5453 /*
5454 * If an operating mode notification IE is present, override the
5455 * NSS calculation (that would be done in rate_control_rate_init())
5456 * and use the # of streams from that element.
5457 */
5458 if (elems->opmode_notif &&
5459 !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
5460 u8 nss;
5461
5462 nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
5463 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
5464 nss += 1;
5465 link_sta->pub->rx_nss = nss;
5466 }
5467
5468 /*
5469 * Always handle WMM once after association regardless
5470 * of the first value the AP uses. Setting -1 here has
5471 * that effect because the AP values is an unsigned
5472 * 4-bit value.
5473 */
5474 link->u.mgd.wmm_last_param_set = -1;
5475 link->u.mgd.mu_edca_last_param_set = -1;
5476
5477 if (link->u.mgd.disable_wmm_tracking) {
5478 ieee80211_set_wmm_default(link, false, false);
5479 } else if (!ieee80211_sta_wmm_params(local, link, elems->wmm_param,
5480 elems->wmm_param_len,
5481 elems->mu_edca_param_set)) {
5482 /* still enable QoS since we might have HT/VHT */
5483 ieee80211_set_wmm_default(link, false, true);
5484 /* disable WMM tracking in this case to disable
5485 * tracking WMM parameter changes in the beacon if
5486 * the parameters weren't actually valid. Doing so
5487 * avoids changing parameters very strangely when
5488 * the AP is going back and forth between valid and
5489 * invalid parameters.
5490 */
5491 link->u.mgd.disable_wmm_tracking = true;
5492 }
5493
5494 if (elems->max_idle_period_ie) {
5495 bss_conf->max_idle_period =
5496 le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
5497 bss_conf->protected_keep_alive =
5498 !!(elems->max_idle_period_ie->idle_options &
5499 WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
5500 *changed |= BSS_CHANGED_KEEP_ALIVE;
5501 } else {
5502 bss_conf->max_idle_period = 0;
5503 bss_conf->protected_keep_alive = false;
5504 }
5505
5506 /* set assoc capability (AID was already set earlier),
5507 * ieee80211_set_associated() will tell the driver */
5508 bss_conf->assoc_capability = capab_info;
5509
5510 ret = true;
5511out:
5512 kfree(elems);
5513 kfree(bss_ies);
5514 return ret;
5515}
5516
bbe90107
JB		 5517static int ieee80211_mgd_setup_link_sta(struct ieee80211_link_data *link,
5518 struct sta_info *sta,
b18d87f5 5519 struct link_sta_info *link_sta,
bbe90107
JB		 5520 struct cfg80211_bss *cbss)
5521{
5522 struct ieee80211_sub_if_data *sdata = link->sdata;
5523 struct ieee80211_local *local = sdata->local;
5524 struct ieee80211_bss *bss = (void *)cbss->priv;
5525 u32 rates = 0, basic_rates = 0;
5526 bool have_higher_than_11mbit = false;
5527 int min_rate = INT_MAX, min_rate_index = -1;
bbe90107
JB		 5528 struct ieee80211_supported_band *sband;
5529
5530 memcpy(link_sta->addr, cbss->bssid, ETH_ALEN);
b18d87f5 5531 memcpy(link_sta->pub->addr, cbss->bssid, ETH_ALEN);
bbe90107
JB		 5532
5533 /* TODO: S1G Basic Rate Set is expressed elsewhere */
5534 if (cbss->channel->band == NL80211_BAND_S1GHZ) {
5535 ieee80211_s1g_sta_rate_init(sta);
5536 return 0;
5537 }
5538
5539 sband = local->hw.wiphy->bands[cbss->channel->band];
5540
5541 ieee80211_get_rates(sband, bss->supp_rates, bss->supp_rates_len,
708d06b3 5542 NULL, 0,
931cf025
BB		 5543 &rates, &basic_rates, NULL,
5544 &have_higher_than_11mbit,
2400dfe2 5545 &min_rate, &min_rate_index);
bbe90107
JB		 5546
5547 /*
5548 * This used to be a workaround for basic rates missing
5549 * in the association response frame. Now that we no
5550 * longer use the basic rates from there, it probably
5551 * doesn't happen any more, but keep the workaround so
5552 * in case some *other* APs are buggy in different ways
5553 * we can connect -- with a warning.
5554 * Allow this workaround only in case the AP provided at least
5555 * one rate.
5556 */
5557 if (min_rate_index < 0) {
5558 link_info(link, "No legacy rates in association response\n");
5559 return -EINVAL;
5560 } else if (!basic_rates) {
5561 link_info(link, "No basic rates, using min rate instead\n");
5562 basic_rates = BIT(min_rate_index);
5563 }
5564
5565 if (rates)
b18d87f5 5566 link_sta->pub->supp_rates[cbss->channel->band] = rates;
bbe90107
JB		 5567 else
5568 link_info(link, "No rates found, keeping mandatory only\n");
5569
5570 link->conf->basic_rates = basic_rates;
5571
5572 /* cf. IEEE 802.11 9.2.12 */
5573 link->operating_11g_mode = sband->band == NL80211_BAND_2GHZ &&
5574 have_higher_than_11mbit;
5575
5576 return 0;
5577}
5578
61513162
JB		 5579static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
5580 struct cfg80211_bss *cbss)
f0706e82 5581{
61513162
JB		 5582 struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
5583 const struct element *ht_cap_elem, *vht_cap_elem;
5584 const struct cfg80211_bss_ies *ies;
5585 const struct ieee80211_ht_cap *ht_cap;
5586 const struct ieee80211_vht_cap *vht_cap;
5587 const struct ieee80211_he_cap_elem *he_cap;
5588 const struct element *he_cap_elem;
5589 u16 mcs_80_map, mcs_160_map;
5590 int i, mcs_nss_size;
5591 bool support_160;
310c8387 5592 u8 chains = 1;
41cbb0f5 5593
310c8387
JB		 5594 if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_HT)
5595 return chains;
d46b4ab8 5596
310c8387
JB		 5597 ht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_CAPABILITY);
5598 if (ht_cap_elem && ht_cap_elem->datalen >= sizeof(*ht_cap)) {
5599 ht_cap = (void *)ht_cap_elem->data;
5600 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
5601 /*
5602 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
5603 * "Tx Unequal Modulation Supported" fields.
5604 */
5605 }
a1de6407 5606
310c8387
JB		 5607 if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_VHT)
5608 return chains;
a1de6407 5609
310c8387
JB		 5610 vht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
5611 if (vht_cap_elem && vht_cap_elem->datalen >= sizeof(*vht_cap)) {
5612 u8 nss;
5613 u16 tx_mcs_map;
5614
5615 vht_cap = (void *)vht_cap_elem->data;
5616 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
5617 for (nss = 8; nss > 0; nss--) {
5618 if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
5619 IEEE80211_VHT_MCS_NOT_SUPPORTED)
5620 break;
a1de6407 5621 }
310c8387
JB		 5622 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
5623 chains = max(chains, nss);
41cbb0f5
LC		 5624 }
5625
310c8387
JB		 5626 if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_HE)
5627 return chains;
41cbb0f5 5628
310c8387
JB		 5629 ies = rcu_dereference(cbss->ies);
5630 he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
5631 ies->data, ies->len);
41cbb0f5 5632
310c8387
JB		 5633 if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
5634 return chains;
41cbb0f5 5635
310c8387
JB		 5636 /* skip one byte ext_tag_id */
5637 he_cap = (void *)(he_cap_elem->data + 1);
5638 mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
78ac51f8 5639
310c8387
JB		 5640 /* invalid HE IE */
5641 if (he_cap_elem->datalen < 1 + mcs_nss_size + sizeof(*he_cap))
5642 return chains;
1128958d 5643
310c8387
JB		 5644 /* mcs_nss is right after he_cap info */
5645 he_mcs_nss_supp = (void *)(he_cap + 1);
bee7f586 5646
310c8387 5647 mcs_80_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
f0706e82 5648
310c8387
JB		 5649 for (i = 7; i >= 0; i--) {
5650 u8 mcs_80 = mcs_80_map >> (2 * i) & 3;
5394af4d 5651
310c8387
JB		 5652 if (mcs_80 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
5653 chains = max_t(u8, chains, i + 1);
5654 break;
61513162 5655 }
c8987876
JB		 5656 }
5657
310c8387
JB		 5658 support_160 = he_cap->phy_cap_info[0] &
5659 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
cf0b045e 5660
310c8387
JB		 5661 if (!support_160)
5662 return chains;
cf0b045e 5663
310c8387
JB		 5664 mcs_160_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_160);
5665 for (i = 7; i >= 0; i--) {
5666 u8 mcs_160 = mcs_160_map >> (2 * i) & 3;
cf0b045e 5667
310c8387
JB		 5668 if (mcs_160 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
5669 chains = max_t(u8, chains, i + 1);
5670 break;
5671 }
cf0b045e
JB		 5672 }
5673
310c8387 5674 return chains;
cf0b045e
JB		 5675}
5676
310c8387
JB		 5677static void
5678ieee80211_determine_our_sta_mode(struct ieee80211_sub_if_data *sdata,
5679 struct ieee80211_supported_band *sband,
5680 struct cfg80211_assoc_request *req,
5681 bool wmm_used, int link_id,
5682 struct ieee80211_conn_settings *conn)
cf0b045e 5683{
310c8387
JB		 5684 struct ieee80211_sta_ht_cap sta_ht_cap = sband->ht_cap;
5685 bool is_5ghz = sband->band == NL80211_BAND_5GHZ;
5686 bool is_6ghz = sband->band == NL80211_BAND_6GHZ;
5687 const struct ieee80211_sta_he_cap *he_cap;
5688 const struct ieee80211_sta_eht_cap *eht_cap;
5689 struct ieee80211_sta_vht_cap vht_cap;
cf0b045e 5690
310c8387
JB		 5691 if (sband->band == NL80211_BAND_S1GHZ) {
5692 conn->mode = IEEE80211_CONN_MODE_S1G;
5693 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
5694 mlme_dbg(sdata, "operating as S1G STA\n");
5695 return;
5696 }
cf0b045e 5697
310c8387
JB		 5698 conn->mode = IEEE80211_CONN_MODE_LEGACY;
5699 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
cf0b045e 5700
310c8387 5701 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
cf0b045e 5702
310c8387
JB		 5703 if (req && req->flags & ASSOC_REQ_DISABLE_HT) {
5704 mlme_link_id_dbg(sdata, link_id,
5705 "HT disabled by flag, limiting to legacy\n");
5706 goto out;
5707 }
cf0b045e 5708
310c8387
JB		 5709 if (!wmm_used) {
5710 mlme_link_id_dbg(sdata, link_id,
5711 "WMM/QoS not supported, limiting to legacy\n");
5712 goto out;
5713 }
cf0b045e 5714
310c8387
JB		 5715 if (req) {
5716 unsigned int i;
cf0b045e 5717
310c8387
JB		 5718 for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
5719 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
5720 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
5721 req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
5722 netdev_info(sdata->dev,
5723 "WEP/TKIP use, limiting to legacy\n");
5724 goto out;
5725 }
cf0b045e
JB		 5726 }
5727 }
5728
310c8387
JB		 5729 if (!sta_ht_cap.ht_supported && !is_6ghz) {
5730 mlme_link_id_dbg(sdata, link_id,
5731 "HT not supported (and not on 6 GHz), limiting to legacy\n");
5732 goto out;
5733 }
f2176d72 5734
310c8387
JB		 5735 /* HT is fine */
5736 conn->mode = IEEE80211_CONN_MODE_HT;
5737 conn->bw_limit = sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
5738 IEEE80211_CONN_BW_LIMIT_40 :
5739 IEEE80211_CONN_BW_LIMIT_20;
0cd8080e 5740
310c8387
JB		 5741 memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
5742 ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
61513162 5743
310c8387
JB		 5744 if (req && req->flags & ASSOC_REQ_DISABLE_VHT) {
5745 mlme_link_id_dbg(sdata, link_id,
5746 "VHT disabled by flag, limiting to HT\n");
5747 goto out;
2ed77ea6 5748 }
f0706e82 5749
310c8387
JB		 5750 if (vht_cap.vht_supported && is_5ghz) {
5751 bool have_80mhz = false;
5752 unsigned int i;
5753
5754 if (conn->bw_limit == IEEE80211_CONN_BW_LIMIT_20) {
5755 mlme_link_id_dbg(sdata, link_id,
5756 "no 40 MHz support on 5 GHz, limiting to HT\n");
5757 goto out;
5758 }
5759
5760 /* Allow VHT if at least one channel on the sband supports 80 MHz */
5761 for (i = 0; i < sband->n_channels; i++) {
5762 if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
5763 IEEE80211_CHAN_NO_80MHZ))
5764 continue;
61513162 5765
310c8387
JB		 5766 have_80mhz = true;
5767 break;
5768 }
5769
5770 if (!have_80mhz) {
5771 mlme_link_id_dbg(sdata, link_id,
5772 "no 80 MHz channel support on 5 GHz, limiting to HT\n");
5773 goto out;
5774 }
5775 } else if (is_5ghz) { /* !vht_supported but on 5 GHz */
5776 mlme_link_id_dbg(sdata, link_id,
5777 "no VHT support on 5 GHz, limiting to HT\n");
5778 goto out;
5779 }
61513162 5780
310c8387
JB		 5781 /* VHT - if we have - is fine, including 80 MHz, check 160 below again */
5782 if (sband->band != NL80211_BAND_2GHZ) {
5783 conn->mode = IEEE80211_CONN_MODE_VHT;
5784 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_160;
e38a017b
AS		 5785 }
5786
310c8387
JB		 5787 if (is_5ghz &&
5788 !(vht_cap.cap & (IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
5789 IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))) {
5790 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_80;
5791 mlme_link_id_dbg(sdata, link_id,
5792 "no VHT 160 MHz capability on 5 GHz, limiting to 80 MHz");
61513162 5793 }
f0706e82 5794
310c8387
JB		 5795 if (req && req->flags & ASSOC_REQ_DISABLE_HE) {
5796 mlme_link_id_dbg(sdata, link_id,
5797 "HE disabled by flag, limiting to HT/VHT\n");
5798 goto out;
61513162 5799 }
d524215f 5800
310c8387
JB		 5801 he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
5802 if (!he_cap) {
5803 WARN_ON(is_6ghz);
5804 mlme_link_id_dbg(sdata, link_id,
5805 "no HE support, limiting to HT/VHT\n");
5806 goto out;
61513162 5807 }
15b7b062 5808
310c8387
JB		 5809 /* so we have HE */
5810 conn->mode = IEEE80211_CONN_MODE_HE;
f0706e82 5811
310c8387
JB		 5812 /* check bandwidth */
5813 switch (sband->band) {
5814 default:
5815 case NL80211_BAND_2GHZ:
5816 if (he_cap->he_cap_elem.phy_cap_info[0] &
5817 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G)
5818 break;
5819 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
5820 mlme_link_id_dbg(sdata, link_id,
5821 "no 40 MHz HE cap in 2.4 GHz, limiting to 20 MHz\n");
5822 break;
5823 case NL80211_BAND_5GHZ:
5824 if (!(he_cap->he_cap_elem.phy_cap_info[0] &
5825 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G)) {
5826 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
5827 mlme_link_id_dbg(sdata, link_id,
5828 "no 40/80 MHz HE cap in 5 GHz, limiting to 20 MHz\n");
5829 break;
61513162 5830 }
310c8387
JB		 5831 if (!(he_cap->he_cap_elem.phy_cap_info[0] &
5832 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G)) {
5833 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
5834 conn->bw_limit,
5835 IEEE80211_CONN_BW_LIMIT_80);
5836 mlme_link_id_dbg(sdata, link_id,
5837 "no 160 MHz HE cap in 5 GHz, limiting to 80 MHz\n");
5838 }
5839 break;
5840 case NL80211_BAND_6GHZ:
5841 if (he_cap->he_cap_elem.phy_cap_info[0] &
5842 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G)
5843 break;
5844 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
5845 conn->bw_limit,
5846 IEEE80211_CONN_BW_LIMIT_80);
5847 mlme_link_id_dbg(sdata, link_id,
5848 "no 160 MHz HE cap in 6 GHz, limiting to 80 MHz\n");
5849 break;
61513162 5850 }
66e67e41 5851
310c8387
JB		 5852 if (req && req->flags & ASSOC_REQ_DISABLE_EHT) {
5853 mlme_link_id_dbg(sdata, link_id,
5854 "EHT disabled by flag, limiting to HE\n");
5855 goto out;
5856 }
66e67e41 5857
310c8387
JB		 5858 eht_cap = ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
5859 if (!eht_cap) {
5860 mlme_link_id_dbg(sdata, link_id,
5861 "no EHT support, limiting to HE\n");
5862 goto out;
61513162 5863 }
1d00ce80 5864
310c8387 5865 /* we have EHT */
66e67e41 5866
310c8387 5867 conn->mode = IEEE80211_CONN_MODE_EHT;
1d00ce80 5868
310c8387
JB		 5869 /* check bandwidth */
5870 if (is_6ghz &&
5871 eht_cap->eht_cap_elem.phy_cap_info[0] & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ)
5872 conn->bw_limit = IEEE80211_CONN_BW_LIMIT_320;
5873 else if (is_6ghz)
5874 mlme_link_id_dbg(sdata, link_id,
5875 "no EHT 320 MHz cap in 6 GHz, limiting to 160 MHz\n");
66e67e41 5876
310c8387
JB		 5877out:
5878 mlme_link_id_dbg(sdata, link_id,
5879 "determined local STA to be %s, BW limited to %d MHz\n",
5880 ieee80211_conn_mode_str(conn->mode),
5881 20 * (1 << conn->bw_limit));
5882}
66e67e41 5883
310c8387
JB		 5884static void
5885ieee80211_determine_our_sta_mode_auth(struct ieee80211_sub_if_data *sdata,
5886 struct ieee80211_supported_band *sband,
5887 struct cfg80211_auth_request *req,
5888 bool wmm_used,
5889 struct ieee80211_conn_settings *conn)
5890{
5891 ieee80211_determine_our_sta_mode(sdata, sband, NULL, wmm_used,
5892 req->link_id > 0 ? req->link_id : 0,
5893 conn);
5894}
61513162 5895
310c8387
JB		 5896static void
5897ieee80211_determine_our_sta_mode_assoc(struct ieee80211_sub_if_data *sdata,
5898 struct ieee80211_supported_band *sband,
5899 struct cfg80211_assoc_request *req,
5900 bool wmm_used, int link_id,
5901 struct ieee80211_conn_settings *conn)
5902{
5903 struct ieee80211_conn_settings tmp;
61513162 5904
310c8387 5905 WARN_ON(!req);
61513162 5906
310c8387
JB		 5907 ieee80211_determine_our_sta_mode(sdata, sband, req, wmm_used, link_id,
5908 &tmp);
66e67e41 5909
310c8387
JB		 5910 conn->mode = min_t(enum ieee80211_conn_mode,
5911 conn->mode, tmp.mode);
5912 conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,
5913 conn->bw_limit, tmp.bw_limit);
5914}
ce2bb3b6 5915
e3bae9b2
MS		 5916static enum ieee80211_ap_reg_power
5917ieee80211_ap_power_type(u8 control)
5918{
5919 switch (u8_get_bits(control, IEEE80211_HE_6GHZ_OPER_CTRL_REG_INFO)) {
5920 case IEEE80211_6GHZ_CTRL_REG_LPI_AP:
5921 case IEEE80211_6GHZ_CTRL_REG_INDOOR_LPI_AP:
5922 return IEEE80211_REG_LPI_AP;
5923 case IEEE80211_6GHZ_CTRL_REG_SP_AP:
5924 case IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP:
5925 return IEEE80211_REG_SP_AP;
5926 case IEEE80211_6GHZ_CTRL_REG_VLP_AP:
5927 return IEEE80211_REG_VLP_AP;
5928 default:
5929 return IEEE80211_REG_UNSET_AP;
5930 }
5931}
5932
310c8387
JB		 5933static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
5934 struct ieee80211_link_data *link,
5935 int link_id,
5936 struct cfg80211_bss *cbss, bool mlo,
8ee0b202
BB		 5937 struct ieee80211_conn_settings *conn,
5938 unsigned long *userspace_selectors)
310c8387
JB		 5939{
5940 struct ieee80211_local *local = sdata->local;
310c8387 5941 bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
6092077a 5942 struct ieee80211_chan_req chanreq = {};
39dc8b8e 5943 struct cfg80211_chan_def ap_chandef;
310c8387
JB		 5944 struct ieee802_11_elems *elems;
5945 int ret;
cf0b045e 5946
310c8387 5947 lockdep_assert_wiphy(local->hw.wiphy);
39404fee 5948
310c8387
JB		 5949 rcu_read_lock();
5950 elems = ieee80211_determine_chan_mode(sdata, conn, cbss, link_id,
8ee0b202
BB		 5951 &chanreq, &ap_chandef,
5952 userspace_selectors);
66e67e41 5953
310c8387
JB		 5954 if (IS_ERR(elems)) {
5955 rcu_read_unlock();
5956 return PTR_ERR(elems);
61513162 5957 }
78ac51f8 5958
310c8387
JB		 5959 if (mlo && !elems->ml_basic) {
5960 sdata_info(sdata, "Rejecting MLO as it is not supported by AP\n");
5961 rcu_read_unlock();
5962 kfree(elems);
5963 return -EINVAL;
1ad22fb5
T		 5964 }
5965
310c8387 5966 if (link && is_6ghz && conn->mode >= IEEE80211_CONN_MODE_HE) {
e3bae9b2 5967 const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
b291ba11 5968
310c8387 5969 if (elems->pwr_constr_elem)
39dc8b8e 5970 link->conf->pwr_reduction = *elems->pwr_constr_elem;
e3bae9b2
MS		 5971
5972 he_6ghz_oper = ieee80211_he_6ghz_oper(elems->he_operation);
5973 if (he_6ghz_oper)
39dc8b8e 5974 link->conf->power_type =
e3bae9b2
MS		 5975 ieee80211_ap_power_type(he_6ghz_oper->control);
5976 else
5977 link_info(link,
5978 "HE 6 GHz operation missing (on %d MHz), expect issues\n",
5979 cbss->channel->center_freq);
39dc8b8e
JB		 5980
5981 link->conf->tpe = elems->tpe;
5982 ieee80211_rearrange_tpe(&link->conf->tpe, &ap_chandef,
5983 &chanreq.oper);
310c8387 5984 }
6911458d
JB		 5985 rcu_read_unlock();
5986 /* the element data was RCU protected so no longer valid anyway */
5987 kfree(elems);
5988 elems = NULL;
90d13e8f 5989
6911458d
JB		 5990 if (!link)
5991 return 0;
0c21e632 5992
310c8387
JB		 5993 rcu_read_lock();
5994 link->needed_rx_chains = min(ieee80211_max_rx_chains(link, cbss),
5995 local->rx_chains);
5996 rcu_read_unlock();
5997
6911458d
JB		 5998 /*
5999 * If this fails (possibly due to channel context sharing
6000 * on incompatible channels, e.g. 80+80 and 160 sharing the
6001 * same control channel) try to use a smaller bandwidth.
6002 */
6092077a 6003 ret = ieee80211_link_use_channel(link, &chanreq,
6911458d 6004 IEEE80211_CHANCTX_SHARED);
30196673 6005
6911458d 6006 /* don't downgrade for 5 and 10 MHz channels, though. */
6092077a
JB		 6007 if (chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
6008 chanreq.oper.width == NL80211_CHAN_WIDTH_10)
310c8387 6009 return ret;
7d25745d 6010
6092077a 6011 while (ret && chanreq.oper.width != NL80211_CHAN_WIDTH_20_NOHT) {
761748f0 6012 ieee80211_chanreq_downgrade(&chanreq, conn);
6092077a
JB		 6013
6014 ret = ieee80211_link_use_channel(link, &chanreq,
6911458d 6015 IEEE80211_CHANCTX_SHARED);
61513162 6016 }
310c8387 6017
6911458d
JB		 6018 return ret;
6019}
d70b7616 6020
189a0c52
JB		 6021static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
6022 u8 *dtim_count, u8 *dtim_period)
6023{
6024 const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
6025 const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
6026 ies->len);
6027 const struct ieee80211_tim_ie *tim = NULL;
6028 const struct ieee80211_bssid_index *idx;
6029 bool valid = tim_ie && tim_ie[1] >= 2;
6030
6031 if (valid)
6032 tim = (void *)(tim_ie + 2);
6033
6034 if (dtim_count)
6035 *dtim_count = valid ? tim->dtim_count : 0;
6036
6037 if (dtim_period)
6038 *dtim_period = valid ? tim->dtim_period : 0;
6039
6040 /* Check if value is overridden by non-transmitted profile */
6041 if (!idx_ie || idx_ie[1] < 3)
6042 return valid;
6043
6044 idx = (void *)(idx_ie + 2);
6045
6046 if (dtim_count)
6047 *dtim_count = idx->dtim_count;
6048
6049 if (dtim_period)
6050 *dtim_period = idx->dtim_period;
6051
6052 return true;
6053}
6054
6911458d 6055static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
6911458d
JB		 6056 struct ieee80211_mgmt *mgmt,
6057 struct ieee802_11_elems *elems,
6058 const u8 *elem_start, unsigned int elem_len)
6059{
6060 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
81151ce4 6061 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
6911458d 6062 struct ieee80211_local *local = sdata->local;
81151ce4 6063 unsigned int link_id;
6911458d 6064 struct sta_info *sta;
81151ce4 6065 u64 changed[IEEE80211_MLD_MAX_NUM_LINKS] = {};
6d543b34 6066 u16 valid_links = 0, dormant_links = 0;
6911458d 6067 int err;
7d25745d 6068
4d3acf43 6069 lockdep_assert_wiphy(sdata->local->hw.wiphy);
c65dd147 6070 /*
6911458d
JB		 6071 * station info was already allocated and inserted before
6072 * the association and should be available to us
c65dd147 6073 */
81151ce4 6074 sta = sta_info_get(sdata, assoc_data->ap_addr);
6911458d
JB		 6075 if (WARN_ON(!sta))
6076 goto out_err;
ef429dad 6077
3b220ed8
JB		 6078 sta->sta.spp_amsdu = assoc_data->spp_amsdu;
6079
f1871abd 6080 if (ieee80211_vif_is_mld(&sdata->vif)) {
81151ce4
JB		 6081 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
6082 if (!assoc_data->link[link_id].bss)
6083 continue;
81151ce4 6084
6d543b34 6085 valid_links |= BIT(link_id);
aaba3cd3 6086 if (assoc_data->link[link_id].disabled)
6d543b34 6087 dormant_links |= BIT(link_id);
aaba3cd3
BB		 6088
6089 if (link_id != assoc_data->assoc_link_id) {
81151ce4
JB		 6090 err = ieee80211_sta_allocate_link(sta, link_id);
6091 if (err)
6092 goto out_err;
6093 }
6094 }
6095
6d543b34 6096 ieee80211_vif_set_links(sdata, valid_links, dormant_links);
81151ce4
JB		 6097 }
6098
6099 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
cb04b5ef 6100 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
81151ce4
JB		 6101 struct ieee80211_link_data *link;
6102 struct link_sta_info *link_sta;
6103
aaba3cd3 6104 if (!cbss)
81151ce4
JB		 6105 continue;
6106
6107 link = sdata_dereference(sdata->link[link_id], sdata);
6108 if (WARN_ON(!link))
6109 goto out_err;
6110
f1871abd 6111 if (ieee80211_vif_is_mld(&sdata->vif))
81151ce4 6112 link_info(link,
7a693ce0 6113 "local address %pM, AP link address %pM%s\n",
81151ce4 6114 link->conf->addr,
7a693ce0
JB		 6115 assoc_data->link[link_id].bss->bssid,
6116 link_id == assoc_data->assoc_link_id ?
6117 " (assoc)" : "");
81151ce4
JB		 6118
6119 link_sta = rcu_dereference_protected(sta->link[link_id],
4d3acf43 6120 lockdep_is_held(&local->hw.wiphy->mtx));
81151ce4
JB		 6121 if (WARN_ON(!link_sta))
6122 goto out_err;
6123
cb04b5ef 6124 if (!link->u.mgd.have_beacon) {
189a0c52
JB		 6125 const struct cfg80211_bss_ies *ies;
6126
6127 rcu_read_lock();
cb04b5ef
JB		 6128 ies = rcu_dereference(cbss->beacon_ies);
6129 if (ies)
6130 link->u.mgd.have_beacon = true;
6131 else
6132 ies = rcu_dereference(cbss->ies);
189a0c52
JB		 6133 ieee80211_get_dtim(ies,
6134 &link->conf->sync_dtim_count,
6135 &link->u.mgd.dtim_period);
189a0c52
JB		 6136 link->conf->beacon_int = cbss->beacon_interval;
6137 rcu_read_unlock();
cb04b5ef 6138 }
189a0c52 6139
cb04b5ef
JB		 6140 link->conf->dtim_period = link->u.mgd.dtim_period ?: 1;
6141
6142 if (link_id != assoc_data->assoc_link_id) {
310c8387
JB		 6143 link->u.mgd.conn = assoc_data->link[link_id].conn;
6144
6145 err = ieee80211_prep_channel(sdata, link, link_id, cbss,
8ee0b202 6146 true, &link->u.mgd.conn,
80834e7d 6147 sdata->u.mgd.userspace_selectors);
efe9c2bf
JB		 6148 if (err) {
6149 link_info(link, "prep_channel failed\n");
81151ce4 6150 goto out_err;
efe9c2bf 6151 }
81151ce4
JB		 6152 }
6153
b18d87f5 6154 err = ieee80211_mgd_setup_link_sta(link, sta, link_sta,
81151ce4
JB		 6155 assoc_data->link[link_id].bss);
6156 if (err)
6157 goto out_err;
6158
6159 if (!ieee80211_assoc_config_link(link, link_sta,
6160 assoc_data->link[link_id].bss,
6161 mgmt, elem_start, elem_len,
6162 &changed[link_id]))
6163 goto out_err;
6164
c2d052a3
IP		 6165 if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
6166 valid_links &= ~BIT(link_id);
6167 ieee80211_sta_remove_link(sta, link_id);
6168 continue;
6169 }
6170
81151ce4
JB		 6171 if (link_id != assoc_data->assoc_link_id) {
6172 err = ieee80211_sta_activate_link(sta, link_id);
6173 if (err)
6174 goto out_err;
6175 }
6176 }
482a9c74 6177
c2d052a3 6178 /* links might have changed due to rejected ones, set them again */
6d543b34 6179 ieee80211_vif_set_links(sdata, valid_links, dormant_links);
c2d052a3 6180
f828deb7 6181 rate_control_rate_init_all_links(sta);
482a9c74 6182
61513162
JB		 6183 if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
6184 set_sta_flag(sta, WLAN_STA_MFP);
6185 sta->sta.mfp = true;
6186 } else {
6187 sta->sta.mfp = false;
c65dd147
EG		 6188 }
6189
175ad2ec
JB		 6190 ieee80211_sta_set_max_amsdu_subframes(sta, elems->ext_capab,
6191 elems->ext_capab_len);
6192
61513162
JB		 6193 sta->sta.wme = (elems->wmm_param || elems->s1g_capab) &&
6194 local->hw.queues >= IEEE80211_NUM_ACS;
6195
6196 err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
6197 if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
6198 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
6199 if (err) {
6200 sdata_info(sdata,
6201 "failed to move station %pM to desired state\n",
6202 sta->sta.addr);
6203 WARN_ON(__sta_info_destroy(sta));
6911458d 6204 goto out_err;
50c4afb9 6205 }
09a740ce 6206
61513162
JB		 6207 if (sdata->wdev.use_4addr)
6208 drv_sta_set_4addr(local, sdata, &sta->sta, true);
f0706e82 6209
81151ce4 6210 ieee80211_set_associated(sdata, assoc_data, changed);
f0706e82 6211
61513162
JB		 6212 /*
6213 * If we're using 4-addr mode, let the AP know that we're
6214 * doing so, so that it can create the STA VLAN on its side
6215 */
6216 if (ifmgd->use_4addr)
6217 ieee80211_send_4addr_nullfunc(local, sdata);
09a740ce 6218
61513162
JB		 6219 /*
6220 * Start timer to probe the connection to the AP now.
6221 * Also start the timer that will detect beacon loss.
6222 */
6223 ieee80211_sta_reset_beacon_monitor(sdata);
6224 ieee80211_sta_reset_conn_monitor(sdata);
09a740ce 6225
6911458d
JB		 6226 return true;
6227out_err:
8a9be422 6228 eth_zero_addr(sdata->vif.cfg.ap_addr);
6911458d 6229 return false;
09a740ce
TP		 6230}
6231
61513162
JB		 6232static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
6233 struct ieee80211_mgmt *mgmt,
6234 size_t len)
f0706e82 6235{
61513162
JB		 6236 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6237 struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
6238 u16 capab_info, status_code, aid;
ea5cba26
JB		 6239 struct ieee80211_elems_parse_params parse_params = {
6240 .bss = NULL,
6241 .link_id = -1,
6242 .from_ap = true,
6243 };
61513162
JB		 6244 struct ieee802_11_elems *elems;
6245 int ac;
6911458d
JB		 6246 const u8 *elem_start;
6247 unsigned int elem_len;
61513162 6248 bool reassoc;
61513162
JB		 6249 struct ieee80211_event event = {
6250 .type = MLME_EVENT,
6251 .u.mlme.data = ASSOC_EVENT,
6252 };
6253 struct ieee80211_prep_tx_info info = {};
8e4687f6 6254 struct cfg80211_rx_assoc_resp_data resp = {
61513162
JB		 6255 .uapsd_queues = -1,
6256 };
78a6a43a 6257 u8 ap_mld_addr[ETH_ALEN] __aligned(2);
81151ce4 6258 unsigned int link_id;
f0706e82 6259
076fc877 6260 lockdep_assert_wiphy(sdata->local->hw.wiphy);
f0706e82 6261
61513162
JB		 6262 if (!assoc_data)
6263 return;
77fdaa12 6264
e3d91a68
BB		 6265 info.link_id = assoc_data->assoc_link_id;
6266
310c8387
JB		 6267 parse_params.mode =
6268 assoc_data->link[assoc_data->assoc_link_id].conn.mode;
6269
81151ce4
JB		 6270 if (!ether_addr_equal(assoc_data->ap_addr, mgmt->bssid) ||
6271 !ether_addr_equal(assoc_data->ap_addr, mgmt->sa))
61513162 6272 return;
5d24828d 6273
61513162
JB		 6274 /*
6275 * AssocResp and ReassocResp have identical structure, so process both
6276 * of them in this function.
6277 */
37799e52 6278
61513162
JB		 6279 if (len < 24 + 6)
6280 return;
37799e52 6281
61513162
JB		 6282 reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
6283 capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
6284 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
81151ce4 6285 if (assoc_data->s1g)
6911458d
JB		 6286 elem_start = mgmt->u.s1g_assoc_resp.variable;
6287 else
6288 elem_start = mgmt->u.assoc_resp.variable;
5d24828d 6289
61513162
JB		 6290 /*
6291 * Note: this may not be perfect, AP might misbehave - if
6292 * anyone needs to rely on perfect complete notification
6293 * with the exact right subtype, then we need to track what
6294 * we actually transmitted.
6295 */
6296 info.subtype = reassoc ? IEEE80211_STYPE_REASSOC_REQ :
6297 IEEE80211_STYPE_ASSOC_REQ;
1b3a2e49 6298
61513162
JB		 6299 if (assoc_data->fils_kek_len &&
6300 fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
6301 return;
1b3a2e49 6302
6911458d 6303 elem_len = len - (elem_start - (u8 *)mgmt);
ea5cba26
JB		 6304 parse_params.start = elem_start;
6305 parse_params.len = elem_len;
6306 elems = ieee802_11_parse_elems_full(&parse_params);
61513162
JB		 6307 if (!elems)
6308 goto notify_driver;
1b3a2e49 6309
6911458d
JB		 6310 if (elems->aid_resp)
6311 aid = le16_to_cpu(elems->aid_resp->aid);
81151ce4 6312 else if (assoc_data->s1g)
6911458d
JB		 6313 aid = 0; /* TODO */
6314 else
6315 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
6316
6317 /*
6318 * The 5 MSB of the AID field are reserved
6319 * (802.11-2016 9.4.1.8 AID field)
6320 */
6321 aid &= 0x7ff;
6322
6323 sdata_info(sdata,
6324 "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
81151ce4 6325 reassoc ? "Rea" : "A", assoc_data->ap_addr,
6911458d
JB		 6326 capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
6327
6328 ifmgd->broken_ap = false;
6329
61513162
JB		 6330 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
6331 elems->timeout_int &&
6332 elems->timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
6333 u32 tu, ms;
1b3a2e49 6334
81151ce4 6335 cfg80211_assoc_comeback(sdata->dev, assoc_data->ap_addr,
61513162 6336 le32_to_cpu(elems->timeout_int->value));
f0706e82 6337
61513162
JB		 6338 tu = le32_to_cpu(elems->timeout_int->value);
6339 ms = tu * 1024 / 1000;
6340 sdata_info(sdata,
6341 "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
81151ce4 6342 assoc_data->ap_addr, tu, ms);
61513162
JB		 6343 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
6344 assoc_data->timeout_started = true;
b133fdf0 6345 assoc_data->comeback = true;
61513162
JB		 6346 if (ms > IEEE80211_ASSOC_TIMEOUT)
6347 run_again(sdata, assoc_data->timeout);
6348 goto notify_driver;
6349 }
5bb644a0 6350
61513162
JB		 6351 if (status_code != WLAN_STATUS_SUCCESS) {
6352 sdata_info(sdata, "%pM denied association (code=%d)\n",
81151ce4 6353 assoc_data->ap_addr, status_code);
61513162
JB		 6354 event.u.mlme.status = MLME_DENIED;
6355 event.u.mlme.reason = status_code;
6356 drv_event_callback(sdata->local, sdata, &event);
6357 } else {
6911458d
JB		 6358 if (aid == 0 || aid > IEEE80211_MAX_AID) {
6359 sdata_info(sdata,
6360 "invalid AID value %d (out of range), turn off PS\n",
6361 aid);
6362 aid = 0;
6363 ifmgd->broken_ap = true;
6364 }
6365
f1871abd 6366 if (ieee80211_vif_is_mld(&sdata->vif)) {
3aca362a
JB		 6367 struct ieee80211_mle_basic_common_info *common;
6368
a286de1a 6369 if (!elems->ml_basic) {
81151ce4 6370 sdata_info(sdata,
3aca362a 6371 "MLO association with %pM but no (basic) multi-link element in response!\n",
81151ce4
JB		 6372 assoc_data->ap_addr);
6373 goto abandon_assoc;
6374 }
6375
3aca362a
JB		 6376 common = (void *)elems->ml_basic->variable;
6377
6378 if (memcmp(assoc_data->ap_addr,
6379 common->mld_mac_addr, ETH_ALEN)) {
81151ce4 6380 sdata_info(sdata,
3aca362a
JB		 6381 "AP MLD MAC address mismatch: got %pM expected %pM\n",
6382 common->mld_mac_addr,
6383 assoc_data->ap_addr);
81151ce4 6384 goto abandon_assoc;
81151ce4 6385 }
a8b65260
JB		 6386
6387 sdata->vif.cfg.eml_cap =
6388 ieee80211_mle_get_eml_cap((const void *)elems->ml_basic);
6389 sdata->vif.cfg.eml_med_sync_delay =
6390 ieee80211_mle_get_eml_med_sync_delay((const void *)elems->ml_basic);
6391 sdata->vif.cfg.mld_capa_op =
6392 ieee80211_mle_get_mld_capa_op((const void *)elems->ml_basic);
81151ce4
JB		 6393 }
6394
6911458d
JB		 6395 sdata->vif.cfg.aid = aid;
6396
81151ce4 6397 if (!ieee80211_assoc_success(sdata, mgmt, elems,
6911458d 6398 elem_start, elem_len)) {
61513162
JB		 6399 /* oops -- internal error -- send timeout for now */
6400 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
6401 goto notify_driver;
6402 }
6403 event.u.mlme.status = MLME_SUCCESS;
6404 drv_event_callback(sdata->local, sdata, &event);
6405 sdata_info(sdata, "associated\n");
f0706e82 6406
81151ce4
JB		 6407 info.success = 1;
6408 }
6409
6410 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
6411 struct ieee80211_link_data *link;
6412
81151ce4
JB		 6413 if (!assoc_data->link[link_id].bss)
6414 continue;
c2d052a3 6415
81151ce4 6416 resp.links[link_id].bss = assoc_data->link[link_id].bss;
234249d8
WG		 6417 ether_addr_copy(resp.links[link_id].addr,
6418 assoc_data->link[link_id].addr);
c2d052a3 6419 resp.links[link_id].status = assoc_data->link[link_id].status;
04ac3c0e 6420
234249d8
WG		 6421 link = sdata_dereference(sdata->link[link_id], sdata);
6422 if (!link)
6423 continue;
6424
81151ce4 6425 /* get uapsd queues configuration - same for all links */
61513162
JB		 6426 resp.uapsd_queues = 0;
6427 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
81151ce4 6428 if (link->tx_conf[ac].uapsd)
61513162 6429 resp.uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
61513162
JB		 6430 }
6431
f1871abd 6432 if (ieee80211_vif_is_mld(&sdata->vif)) {
78a6a43a
JB		 6433 ether_addr_copy(ap_mld_addr, sdata->vif.cfg.ap_addr);
6434 resp.ap_mld_addr = ap_mld_addr;
6435 }
6436
81151ce4
JB		 6437 ieee80211_destroy_assoc_data(sdata,
6438 status_code == WLAN_STATUS_SUCCESS ?
6439 ASSOC_SUCCESS :
6440 ASSOC_REJECTED);
6441
61513162
JB		 6442 resp.buf = (u8 *)mgmt;
6443 resp.len = len;
6444 resp.req_ies = ifmgd->assoc_req_ies;
6445 resp.req_ies_len = ifmgd->assoc_req_ies_len;
6446 cfg80211_rx_assoc_resp(sdata->dev, &resp);
6447notify_driver:
6448 drv_mgd_complete_tx(sdata->local, sdata, &info);
6449 kfree(elems);
81151ce4
JB		 6450 return;
6451abandon_assoc:
6452 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
6453 goto notify_driver;
04ac3c0e
FF		 6454}
6455
61513162
JB		 6456static void ieee80211_rx_bss_info(struct ieee80211_link_data *link,
6457 struct ieee80211_mgmt *mgmt, size_t len,
6458 struct ieee80211_rx_status *rx_status)
66e67e41 6459{
61513162 6460 struct ieee80211_sub_if_data *sdata = link->sdata;
66e67e41 6461 struct ieee80211_local *local = sdata->local;
61513162
JB		 6462 struct ieee80211_bss *bss;
6463 struct ieee80211_channel *channel;
66e67e41 6464
076fc877 6465 lockdep_assert_wiphy(sdata->local->hw.wiphy);
66e67e41 6466
61513162
JB		 6467 channel = ieee80211_get_channel_khz(local->hw.wiphy,
6468 ieee80211_rx_status_to_khz(rx_status));
6469 if (!channel)
6470 return;
66e67e41 6471
61513162
JB		 6472 bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
6473 if (bss) {
6474 link->conf->beacon_rate = bss->beacon_rate;
6475 ieee80211_rx_bss_put(local, bss);
66e67e41 6476 }
61513162 6477}
66e67e41 6478
a1845fc7 6479
61513162
JB		 6480static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_link_data *link,
6481 struct sk_buff *skb)
6482{
6483 struct ieee80211_sub_if_data *sdata = link->sdata;
6484 struct ieee80211_mgmt *mgmt = (void *)skb->data;
6485 struct ieee80211_if_managed *ifmgd;
6486 struct ieee80211_rx_status *rx_status = (void *) skb->cb;
6487 struct ieee80211_channel *channel;
6488 size_t baselen, len = skb->len;
66e67e41 6489
61513162 6490 ifmgd = &sdata->u.mgd;
6b8ece3a 6491
076fc877 6492 lockdep_assert_wiphy(sdata->local->hw.wiphy);
66e67e41 6493
61513162
JB		 6494 /*
6495 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
6496 * "If a 6 GHz AP receives a Probe Request frame and responds with
6497 * a Probe Response frame [..], the Address 1 field of the Probe
6498 * Response frame shall be set to the broadcast address [..]"
6499 * So, on 6GHz band we should also accept broadcast responses.
6500 */
6501 channel = ieee80211_get_channel(sdata->local->hw.wiphy,
6502 rx_status->freq);
6503 if (!channel)
6504 return;
66e67e41 6505
61513162
JB		 6506 if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
6507 (channel->band != NL80211_BAND_6GHZ ||
6508 !is_broadcast_ether_addr(mgmt->da)))
6509 return; /* ignore ProbeResp to foreign address */
66e67e41 6510
61513162
JB		 6511 baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
6512 if (baselen > len)
6513 return;
66e67e41 6514
61513162 6515 ieee80211_rx_bss_info(link, mgmt, len, rx_status);
407879b6 6516
61513162
JB		 6517 if (ifmgd->associated &&
6518 ether_addr_equal(mgmt->bssid, link->u.mgd.bssid))
6519 ieee80211_reset_ap_probe(sdata);
66e67e41
JB		 6520}
6521
61513162
JB		 6522/*
6523 * This is the canonical list of information elements we care about,
6524 * the filter code also gives us all changes to the Microsoft OUI
6525 * (00:50:F2) vendor IE which is used for WMM which we need to track,
6526 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
6527 * changes to requested client power.
6528 *
6529 * We implement beacon filtering in software since that means we can
6530 * avoid processing the frame here and in cfg80211, and userspace
6531 * will not be able to tell whether the hardware supports it or not.
6532 *
6533 * XXX: This list needs to be dynamic -- userspace needs to be able to
6534 * add items it requires. It also needs to be able to tell us to
6535 * look out for other vendor IEs.
6536 */
6537static const u64 care_about_ies =
6538 (1ULL << WLAN_EID_COUNTRY) |
6539 (1ULL << WLAN_EID_ERP_INFO) |
6540 (1ULL << WLAN_EID_CHANNEL_SWITCH) |
6541 (1ULL << WLAN_EID_PWR_CONSTRAINT) |
6542 (1ULL << WLAN_EID_HT_CAPABILITY) |
6543 (1ULL << WLAN_EID_HT_OPERATION) |
6544 (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
6545
6546static void ieee80211_handle_beacon_sig(struct ieee80211_link_data *link,
6547 struct ieee80211_if_managed *ifmgd,
6548 struct ieee80211_bss_conf *bss_conf,
6549 struct ieee80211_local *local,
6550 struct ieee80211_rx_status *rx_status)
66e67e41 6551{
61513162 6552 struct ieee80211_sub_if_data *sdata = link->sdata;
66e67e41 6553
61513162 6554 /* Track average RSSI from the Beacon frames of the current AP */
66e67e41 6555
61513162
JB		 6556 if (!link->u.mgd.tracking_signal_avg) {
6557 link->u.mgd.tracking_signal_avg = true;
6558 ewma_beacon_signal_init(&link->u.mgd.ave_beacon_signal);
6559 link->u.mgd.last_cqm_event_signal = 0;
6560 link->u.mgd.count_beacon_signal = 1;
6561 link->u.mgd.last_ave_beacon_signal = 0;
6562 } else {
6563 link->u.mgd.count_beacon_signal++;
6564 }
6565
6566 ewma_beacon_signal_add(&link->u.mgd.ave_beacon_signal,
6567 -rx_status->signal);
6568
6569 if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
6570 link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
6571 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
6572 int last_sig = link->u.mgd.last_ave_beacon_signal;
6573 struct ieee80211_event event = {
6574 .type = RSSI_EVENT,
6575 };
66e67e41
JB		 6576
6577 /*
61513162
JB		 6578 * if signal crosses either of the boundaries, invoke callback
6579 * with appropriate parameters
66e67e41 6580 */
61513162
JB		 6581 if (sig > ifmgd->rssi_max_thold &&
6582 (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
6583 link->u.mgd.last_ave_beacon_signal = sig;
6584 event.u.rssi.data = RSSI_EVENT_HIGH;
6585 drv_event_callback(local, sdata, &event);
6586 } else if (sig < ifmgd->rssi_min_thold &&
6587 (last_sig >= ifmgd->rssi_max_thold ||
6588 last_sig == 0)) {
6589 link->u.mgd.last_ave_beacon_signal = sig;
6590 event.u.rssi.data = RSSI_EVENT_LOW;
6591 drv_event_callback(local, sdata, &event);
6592 }
6593 }
66e67e41 6594
61513162
JB		 6595 if (bss_conf->cqm_rssi_thold &&
6596 link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
6597 !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
6598 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
6599 int last_event = link->u.mgd.last_cqm_event_signal;
6600 int thold = bss_conf->cqm_rssi_thold;
6601 int hyst = bss_conf->cqm_rssi_hyst;
6602
6603 if (sig < thold &&
6604 (last_event == 0 || sig < last_event - hyst)) {
6605 link->u.mgd.last_cqm_event_signal = sig;
6606 ieee80211_cqm_rssi_notify(
6607 &sdata->vif,
6608 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
6609 sig, GFP_KERNEL);
6610 } else if (sig > thold &&
6611 (last_event == 0 || sig > last_event + hyst)) {
6612 link->u.mgd.last_cqm_event_signal = sig;
6613 ieee80211_cqm_rssi_notify(
6614 &sdata->vif,
6615 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
6616 sig, GFP_KERNEL);
6617 }
66e67e41
JB		 6618 }
6619
61513162
JB		 6620 if (bss_conf->cqm_rssi_low &&
6621 link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
6622 int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
6623 int last_event = link->u.mgd.last_cqm_event_signal;
6624 int low = bss_conf->cqm_rssi_low;
6625 int high = bss_conf->cqm_rssi_high;
66e67e41 6626
61513162
JB		 6627 if (sig < low &&
6628 (last_event == 0 || last_event >= low)) {
6629 link->u.mgd.last_cqm_event_signal = sig;
6630 ieee80211_cqm_rssi_notify(
6631 &sdata->vif,
6632 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
6633 sig, GFP_KERNEL);
6634 } else if (sig > high &&
6635 (last_event == 0 || last_event <= high)) {
6636 link->u.mgd.last_cqm_event_signal = sig;
6637 ieee80211_cqm_rssi_notify(
6638 &sdata->vif,
6639 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
6640 sig, GFP_KERNEL);
6641 }
1672c0e3 6642 }
66e67e41
JB		 6643}
6644
61513162
JB		 6645static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
6646 struct cfg80211_bss *bss)
1672c0e3 6647{
61513162
JB		 6648 if (ether_addr_equal(tx_bssid, bss->bssid))
6649 return true;
6650 if (!bss->transmitted_bss)
6651 return false;
6652 return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
1672c0e3
JB		 6653}
6654
8eb8dd2f
IP		 6655static void ieee80211_ml_reconf_work(struct wiphy *wiphy,
6656 struct wiphy_work *work)
6657{
6658 struct ieee80211_sub_if_data *sdata =
6659 container_of(work, struct ieee80211_sub_if_data,
6660 u.mgd.ml_reconf_work.work);
6661 u16 new_valid_links, new_active_links, new_dormant_links;
6662 int ret;
6663
076fc877 6664 if (!sdata->u.mgd.removed_links)
8eb8dd2f 6665 return;
8eb8dd2f
IP		 6666
6667 sdata_info(sdata,
6668 "MLO Reconfiguration: work: valid=0x%x, removed=0x%x\n",
6669 sdata->vif.valid_links, sdata->u.mgd.removed_links);
6670
6671 new_valid_links = sdata->vif.valid_links & ~sdata->u.mgd.removed_links;
076fc877 6672 if (new_valid_links == sdata->vif.valid_links)
8eb8dd2f 6673 return;
8eb8dd2f
IP		 6674
6675 if (!new_valid_links ||
6676 !(new_valid_links & ~sdata->vif.dormant_links)) {
6677 sdata_info(sdata, "No valid links after reconfiguration\n");
6678 ret = -EINVAL;
6679 goto out;
6680 }
6681
6682 new_active_links = sdata->vif.active_links & ~sdata->u.mgd.removed_links;
6683 if (new_active_links != sdata->vif.active_links) {
6684 if (!new_active_links)
6685 new_active_links =
6686 BIT(ffs(new_valid_links &
6687 ~sdata->vif.dormant_links) - 1);
6688
076fc877 6689 ret = ieee80211_set_active_links(&sdata->vif, new_active_links);
8eb8dd2f
IP		 6690 if (ret) {
6691 sdata_info(sdata,
6692 "Failed setting active links\n");
6693 goto out;
6694 }
6695 }
6696
6697 new_dormant_links = sdata->vif.dormant_links & ~sdata->u.mgd.removed_links;
6698
6699 ret = ieee80211_vif_set_links(sdata, new_valid_links,
6700 new_dormant_links);
6701 if (ret)
6702 sdata_info(sdata, "Failed setting valid links\n");
6703
041a74cb
IP		 6704 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_MLD_VALID_LINKS);
6705
8eb8dd2f
IP		 6706out:
6707 if (!ret)
6708 cfg80211_links_removed(sdata->dev, sdata->u.mgd.removed_links);
6709 else
076fc877 6710 __ieee80211_disconnect(sdata);
8eb8dd2f
IP		 6711
6712 sdata->u.mgd.removed_links = 0;
8eb8dd2f
IP		 6713}
6714
6715static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,
6716 struct ieee802_11_elems *elems)
6717{
8eb8dd2f 6718 const struct element *sub;
8eb8dd2f
IP		 6719 unsigned long removed_links = 0;
6720 u16 link_removal_timeout[IEEE80211_MLD_MAX_NUM_LINKS] = {};
6721 u8 link_id;
6722 u32 delay;
6723
4d70e9c5 6724 if (!ieee80211_vif_is_mld(&sdata->vif) || !elems->ml_reconf)
8eb8dd2f
IP		 6725 return;
6726
8eb8dd2f
IP		 6727 /* Directly parse the sub elements as the common information doesn't
6728 * hold any useful information.
6729 */
4d70e9c5
JB		 6730 for_each_mle_subelement(sub, (const u8 *)elems->ml_reconf,
6731 elems->ml_reconf_len) {
8eb8dd2f
IP		 6732 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
6733 u8 *pos = prof->variable;
6734 u16 control;
6735
6736 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
6737 continue;
6738
6739 if (!ieee80211_mle_reconf_sta_prof_size_ok(sub->data,
6740 sub->datalen))
6741 return;
6742
6743 control = le16_to_cpu(prof->control);
6744 link_id = control & IEEE80211_MLE_STA_RECONF_CONTROL_LINK_ID;
6745
6746 removed_links |= BIT(link_id);
6747
6748 /* the MAC address should not be included, but handle it */
6749 if (control &
6750 IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT)
6751 pos += 6;
6752
6753 /* According to Draft P802.11be_D3.0, the control should
6754 * include the AP Removal Timer present. If the AP Removal Timer
6755 * is not present assume immediate removal.
6756 */
6757 if (control &
c870d66f 6758 IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT)
c53d8a59 6759 link_removal_timeout[link_id] = get_unaligned_le16(pos);
8eb8dd2f
IP		 6760 }
6761
6762 removed_links &= sdata->vif.valid_links;
6763 if (!removed_links) {
6764 /* In case the removal was cancelled, abort it */
6765 if (sdata->u.mgd.removed_links) {
6766 sdata->u.mgd.removed_links = 0;
6767 wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
6768 &sdata->u.mgd.ml_reconf_work);
6769 }
6770 return;
6771 }
6772
6773 delay = 0;
6774 for_each_set_bit(link_id, &removed_links, IEEE80211_MLD_MAX_NUM_LINKS) {
6775 struct ieee80211_bss_conf *link_conf =
6776 sdata_dereference(sdata->vif.link_conf[link_id], sdata);
6777 u32 link_delay;
6778
6779 if (!link_conf) {
6780 removed_links &= ~BIT(link_id);
6781 continue;
6782 }
6783
cb55e08d
JB		 6784 if (link_removal_timeout[link_id] < 1)
6785 link_delay = 0;
6786 else
6787 link_delay = link_conf->beacon_int *
6788 (link_removal_timeout[link_id] - 1);
8eb8dd2f
IP		 6789
6790 if (!delay)
6791 delay = link_delay;
6792 else
6793 delay = min(delay, link_delay);
6794 }
6795
6796 sdata->u.mgd.removed_links = removed_links;
6797 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
6798 &sdata->u.mgd.ml_reconf_work,
6799 TU_TO_JIFFIES(delay));
6800}
6801
8f500fbc
AB		 6802static int ieee80211_ttlm_set_links(struct ieee80211_sub_if_data *sdata,
6803 u16 active_links, u16 dormant_links,
6804 u16 suspended_links)
6805{
6806 u64 changed = 0;
6807 int ret;
6808
6809 if (!active_links) {
6810 ret = -EINVAL;
6811 goto out;
6812 }
6813
6814 /* If there is an active negotiated TTLM, it should be discarded by
6815 * the new negotiated/advertised TTLM.
6816 */
6817 if (sdata->vif.neg_ttlm.valid) {
6818 memset(&sdata->vif.neg_ttlm, 0, sizeof(sdata->vif.neg_ttlm));
6819 sdata->vif.suspended_links = 0;
6820 changed = BSS_CHANGED_MLD_TTLM;
6821 }
6822
6823 if (sdata->vif.active_links != active_links) {
134d715e
AB		 6824 /* usable links are affected when active_links are changed,
6825 * so notify the driver about the status change
6826 */
6827 changed |= BSS_CHANGED_MLD_VALID_LINKS;
6828 active_links &= sdata->vif.active_links;
6829 if (!active_links)
6830 active_links =
6831 BIT(__ffs(sdata->vif.valid_links &
6832 ~dormant_links));
8f500fbc
AB		 6833 ret = ieee80211_set_active_links(&sdata->vif, active_links);
6834 if (ret) {
6835 sdata_info(sdata, "Failed to set TTLM active links\n");
6836 goto out;
6837 }
6838 }
6839
6840 ret = ieee80211_vif_set_links(sdata, sdata->vif.valid_links,
6841 dormant_links);
6842 if (ret) {
6843 sdata_info(sdata, "Failed to set TTLM dormant links\n");
6844 goto out;
6845 }
6846
8f500fbc
AB		 6847 sdata->vif.suspended_links = suspended_links;
6848 if (sdata->vif.suspended_links)
6849 changed |= BSS_CHANGED_MLD_TTLM;
6850
6851 ieee80211_vif_cfg_change_notify(sdata, changed);
6852
6853out:
6854 if (ret)
6855 ieee80211_disconnect(&sdata->vif, false);
6856
6857 return ret;
6858}
6859
702e8047
AB		 6860static void ieee80211_tid_to_link_map_work(struct wiphy *wiphy,
6861 struct wiphy_work *work)
6862{
6863 u16 new_active_links, new_dormant_links;
6864 struct ieee80211_sub_if_data *sdata =
6865 container_of(work, struct ieee80211_sub_if_data,
6866 u.mgd.ttlm_work.work);
702e8047
AB		 6867
6868 new_active_links = sdata->u.mgd.ttlm_info.map &
6869 sdata->vif.valid_links;
6870 new_dormant_links = ~sdata->u.mgd.ttlm_info.map &
6871 sdata->vif.valid_links;
702e8047
AB		 6872
6873 ieee80211_vif_set_links(sdata, sdata->vif.valid_links, 0);
8f500fbc
AB		 6874 if (ieee80211_ttlm_set_links(sdata, new_active_links, new_dormant_links,
6875 0))
6876 return;
702e8047
AB		 6877
6878 sdata->u.mgd.ttlm_info.active = true;
6879 sdata->u.mgd.ttlm_info.switch_time = 0;
702e8047
AB		 6880}
6881
6882static u16 ieee80211_get_ttlm(u8 bm_size, u8 *data)
6883{
6884 if (bm_size == 1)
6885 return *data;
6886 else
6887 return get_unaligned_le16(data);
6888}
6889
6890static int
6891ieee80211_parse_adv_t2l(struct ieee80211_sub_if_data *sdata,
6892 const struct ieee80211_ttlm_elem *ttlm,
6893 struct ieee80211_adv_ttlm_info *ttlm_info)
6894{
6895 /* The element size was already validated in
6896 * ieee80211_tid_to_link_map_size_ok()
6897 */
6898 u8 control, link_map_presence, map_size, tid;
6899 u8 *pos;
6900
6901 memset(ttlm_info, 0, sizeof(*ttlm_info));
6902 pos = (void *)ttlm->optional;
6903 control = ttlm->control;
6904
6905 if ((control & IEEE80211_TTLM_CONTROL_DEF_LINK_MAP) ||
6906 !(control & IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT))
6907 return 0;
6908
6909 if ((control & IEEE80211_TTLM_CONTROL_DIRECTION) !=
6910 IEEE80211_TTLM_DIRECTION_BOTH) {
6911 sdata_info(sdata, "Invalid advertised T2L map direction\n");
6912 return -EINVAL;
6913 }
6914
6915 link_map_presence = *pos;
6916 pos++;
6917
6918 ttlm_info->switch_time = get_unaligned_le16(pos);
b1a23f8a
AB		 6919
6920 /* Since ttlm_info->switch_time == 0 means no switch time, bump it
6921 * by 1.
6922 */
6923 if (!ttlm_info->switch_time)
6924 ttlm_info->switch_time = 1;
6925
702e8047
AB		 6926 pos += 2;
6927
6928 if (control & IEEE80211_TTLM_CONTROL_EXPECTED_DUR_PRESENT) {
6929 ttlm_info->duration = pos[0] | pos[1] << 8 | pos[2] << 16;
6930 pos += 3;
6931 }
6932
6933 if (control & IEEE80211_TTLM_CONTROL_LINK_MAP_SIZE)
6934 map_size = 1;
6935 else
6936 map_size = 2;
6937
6938 /* According to Draft P802.11be_D3.0 clause 35.3.7.1.7, an AP MLD shall
6939 * not advertise a TID-to-link mapping that does not map all TIDs to the
6940 * same link set, reject frame if not all links have mapping
6941 */
6942 if (link_map_presence != 0xff) {
6943 sdata_info(sdata,
6944 "Invalid advertised T2L mapping presence indicator\n");
6945 return -EINVAL;
6946 }
6947
6948 ttlm_info->map = ieee80211_get_ttlm(map_size, pos);
6949 if (!ttlm_info->map) {
6950 sdata_info(sdata,
6951 "Invalid advertised T2L map for TID 0\n");
6952 return -EINVAL;
6953 }
6954
6955 pos += map_size;
6956
6957 for (tid = 1; tid < 8; tid++) {
6958 u16 map = ieee80211_get_ttlm(map_size, pos);
6959
6960 if (map != ttlm_info->map) {
6961 sdata_info(sdata, "Invalid advertised T2L map for tid %d\n",
6962 tid);
6963 return -EINVAL;
6964 }
6965
6966 pos += map_size;
6967 }
6968 return 0;
6969}
6970
6971static void ieee80211_process_adv_ttlm(struct ieee80211_sub_if_data *sdata,
6972 struct ieee802_11_elems *elems,
6973 u64 beacon_ts)
6974{
6975 u8 i;
6976 int ret;
6977
6978 if (!ieee80211_vif_is_mld(&sdata->vif))
6979 return;
6980
6981 if (!elems->ttlm_num) {
6982 if (sdata->u.mgd.ttlm_info.switch_time) {
6983 /* if a planned TID-to-link mapping was cancelled -
6984 * abort it
6985 */
6986 wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
6987 &sdata->u.mgd.ttlm_work);
6988 } else if (sdata->u.mgd.ttlm_info.active) {
6989 /* if no TID-to-link element, set to default mapping in
6990 * which all TIDs are mapped to all setup links
6991 */
6992 ret = ieee80211_vif_set_links(sdata,
6993 sdata->vif.valid_links,
6994 0);
6995 if (ret) {
6996 sdata_info(sdata, "Failed setting valid/dormant links\n");
6997 return;
6998 }
6999 ieee80211_vif_cfg_change_notify(sdata,
7000 BSS_CHANGED_MLD_VALID_LINKS);
7001 }
7002 memset(&sdata->u.mgd.ttlm_info, 0,
7003 sizeof(sdata->u.mgd.ttlm_info));
7004 return;
7005 }
7006
7007 for (i = 0; i < elems->ttlm_num; i++) {
7008 struct ieee80211_adv_ttlm_info ttlm_info;
7009 u32 res;
7010
7011 res = ieee80211_parse_adv_t2l(sdata, elems->ttlm[i],
7012 &ttlm_info);
7013
7014 if (res) {
7015 __ieee80211_disconnect(sdata);
7016 return;
7017 }
7018
7019 if (ttlm_info.switch_time) {
b1a23f8a
AB		 7020 u16 beacon_ts_tu, st_tu, delay;
7021 u32 delay_jiffies;
7022 u64 mask;
702e8047
AB		 7023
7024 /* The t2l map switch time is indicated with a partial
b1a23f8a
AB		 7025 * TSF value (bits 10 to 25), get the partial beacon TS
7026 * as well, and calc the delay to the start time.
7027 */
7028 mask = GENMASK_ULL(25, 10);
7029 beacon_ts_tu = (beacon_ts & mask) >> 10;
7030 st_tu = ttlm_info.switch_time;
7031 delay = st_tu - beacon_ts_tu;
7032
7033 /*
7034 * If the switch time is far in the future, then it
7035 * could also be the previous switch still being
7036 * announced.
7037 * We can simply ignore it for now, if it is a future
7038 * switch the AP will continue to announce it anyway.
702e8047 7039 */
b1a23f8a
AB		 7040 if (delay > IEEE80211_ADV_TTLM_ST_UNDERFLOW)
7041 return;
7042
7043 delay_jiffies = TU_TO_JIFFIES(delay);
7044
7045 /* Link switching can take time, so schedule it
7046 * 100ms before to be ready on time
702e8047 7047 */
b1a23f8a
AB		 7048 if (delay_jiffies > IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS)
7049 delay_jiffies -=
7050 IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS;
702e8047 7051 else
b1a23f8a 7052 delay_jiffies = 0;
702e8047
AB		 7053
7054 sdata->u.mgd.ttlm_info = ttlm_info;
7055 wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
7056 &sdata->u.mgd.ttlm_work);
7057 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
7058 &sdata->u.mgd.ttlm_work,
b1a23f8a 7059 delay_jiffies);
702e8047
AB		 7060 return;
7061 }
7062 }
7063}
7064
7ef8f682
JB		 7065static void
7066ieee80211_mgd_check_cross_link_csa(struct ieee80211_sub_if_data *sdata,
7067 int reporting_link_id,
7068 struct ieee802_11_elems *elems)
7069{
7070 const struct element *sta_profiles[IEEE80211_MLD_MAX_NUM_LINKS] = {};
7071 ssize_t sta_profiles_len[IEEE80211_MLD_MAX_NUM_LINKS] = {};
7072 const struct element *sub;
7073 const u8 *subelems;
7074 size_t subelems_len;
7075 u8 common_size;
7076 int link_id;
7077
7078 if (!ieee80211_mle_size_ok((u8 *)elems->ml_basic, elems->ml_basic_len))
7079 return;
7080
7081 common_size = ieee80211_mle_common_size((u8 *)elems->ml_basic);
7082 subelems = (u8 *)elems->ml_basic + common_size;
7083 subelems_len = elems->ml_basic_len - common_size;
7084
7085 for_each_element_id(sub, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE,
7086 subelems, subelems_len) {
7087 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
7088 struct ieee80211_link_data *link;
7089 ssize_t len;
7090
7091 if (!ieee80211_mle_basic_sta_prof_size_ok(sub->data,
7092 sub->datalen))
7093 continue;
7094
7095 link_id = le16_get_bits(prof->control,
7096 IEEE80211_MLE_STA_CONTROL_LINK_ID);
7097 /* need a valid link ID, but also not our own, both AP bugs */
7098 if (link_id == reporting_link_id ||
7099 link_id >= IEEE80211_MLD_MAX_NUM_LINKS)
7100 continue;
7101
7102 link = sdata_dereference(sdata->link[link_id], sdata);
7103 if (!link)
7104 continue;
7105
7106 len = cfg80211_defragment_element(sub, subelems, subelems_len,
7107 NULL, 0,
7108 IEEE80211_MLE_SUBELEM_FRAGMENT);
7109 if (WARN_ON(len < 0))
7110 continue;
7111
7112 sta_profiles[link_id] = sub;
7113 sta_profiles_len[link_id] = len;
7114 }
7115
7116 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
7117 struct ieee80211_mle_per_sta_profile *prof;
7118 struct ieee802_11_elems *prof_elems;
7119 struct ieee80211_link_data *link;
7120 ssize_t len;
7121
7122 if (link_id == reporting_link_id)
7123 continue;
7124
7125 link = sdata_dereference(sdata->link[link_id], sdata);
7126 if (!link)
7127 continue;
7128
7129 if (!sta_profiles[link_id]) {
7130 prof_elems = NULL;
7131 goto handle;
7132 }
7133
7134 /* we can defragment in-place, won't use the buffer again */
7135 len = cfg80211_defragment_element(sta_profiles[link_id],
7136 subelems, subelems_len,
7137 (void *)sta_profiles[link_id],
7138 sta_profiles_len[link_id],
7139 IEEE80211_MLE_SUBELEM_FRAGMENT);
7140 if (WARN_ON(len != sta_profiles_len[link_id]))
7141 continue;
7142
7143 prof = (void *)sta_profiles[link_id];
7144 prof_elems = ieee802_11_parse_elems(prof->variable +
7145 (prof->sta_info_len - 1),
7146 len -
7147 (prof->sta_info_len - 1),
7148 false, NULL);
7149
7150 /* memory allocation failed - let's hope that's transient */
7151 if (!prof_elems)
7152 continue;
7153
7154handle:
7155 /*
7156 * FIXME: the timings here are obviously incorrect,
7157 * but only older Intel drivers seem to care, and
7158 * those don't have MLO. If you really need this,
7159 * the problem is having to calculate it with the
7160 * TSF offset etc. The device_timestamp is still
7161 * correct, of course.
7162 */
7163 ieee80211_sta_process_chanswitch(link, 0, 0, elems, prof_elems,
7164 IEEE80211_CSA_SOURCE_OTHER_LINK);
7165 kfree(prof_elems);
7166 }
7167}
7168
9cc88678
JB		 7169static bool ieee80211_mgd_ssid_mismatch(struct ieee80211_sub_if_data *sdata,
7170 const struct ieee802_11_elems *elems)
7171{
7172 struct ieee80211_vif_cfg *cfg = &sdata->vif.cfg;
7173 static u8 zero_ssid[IEEE80211_MAX_SSID_LEN];
7174
7175 if (!elems->ssid)
7176 return false;
7177
7178 /* hidden SSID: zero length */
7179 if (elems->ssid_len == 0)
7180 return false;
7181
7182 if (elems->ssid_len != cfg->ssid_len)
7183 return true;
7184
7185 /* hidden SSID: zeroed out */
3e9b4021 7186 if (!memcmp(elems->ssid, zero_ssid, elems->ssid_len))
9cc88678
JB		 7187 return false;
7188
7189 return memcmp(elems->ssid, cfg->ssid, cfg->ssid_len);
7190}
7191
61513162
JB		 7192static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
7193 struct ieee80211_hdr *hdr, size_t len,
7194 struct ieee80211_rx_status *rx_status)
9c6bd790 7195{
61513162 7196 struct ieee80211_sub_if_data *sdata = link->sdata;
1fa57d01 7197 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3f5d7ff7 7198 struct ieee80211_bss_conf *bss_conf = link->conf;
61513162
JB		 7199 struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
7200 struct ieee80211_mgmt *mgmt = (void *) hdr;
c5fd399a 7201 struct ieee80211_ext *ext = NULL;
61513162
JB		 7202 size_t baselen;
7203 struct ieee802_11_elems *elems;
7204 struct ieee80211_local *local = sdata->local;
7205 struct ieee80211_chanctx_conf *chanctx_conf;
0143ea09 7206 struct ieee80211_supported_band *sband;
61513162
JB		 7207 struct ieee80211_channel *chan;
7208 struct link_sta_info *link_sta;
7209 struct sta_info *sta;
aa87cd8b 7210 u64 changed = 0;
61513162
JB		 7211 bool erp_valid;
7212 u8 erp_value = 0;
7213 u32 ncrc = 0;
7214 u8 *bssid, *variable = mgmt->u.beacon.variable;
7215 u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
ea5cba26 7216 struct ieee80211_elems_parse_params parse_params = {
310c8387 7217 .mode = link->u.mgd.conn.mode,
ea5cba26
JB		 7218 .link_id = -1,
7219 .from_ap = true,
7220 };
9c6bd790 7221
5435af6e 7222 lockdep_assert_wiphy(local->hw.wiphy);
77fdaa12 7223
61513162
JB		 7224 /* Process beacon from the current BSS */
7225 bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
7226 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
c5fd399a 7227 ext = (void *)mgmt;
1e1f706f
LH		 7228 variable = ext->u.s1g_beacon.variable +
7229 ieee80211_s1g_optional_len(ext->frame_control);
1672c0e3
JB		 7230 }
7231
61513162
JB		 7232 baselen = (u8 *) variable - (u8 *) mgmt;
7233 if (baselen > len)
7234 return;
66e67e41 7235
ea5cba26
JB		 7236 parse_params.start = variable;
7237 parse_params.len = len - baselen;
7238
61513162 7239 rcu_read_lock();
3f5d7ff7 7240 chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
61513162
JB		 7241 if (!chanctx_conf) {
7242 rcu_read_unlock();
7243 return;
7244 }
66e67e41 7245
61513162
JB		 7246 if (ieee80211_rx_status_to_khz(rx_status) !=
7247 ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
7248 rcu_read_unlock();
7249 return;
7250 }
7251 chan = chanctx_conf->def.chan;
7252 rcu_read_unlock();
66e67e41 7253
61513162 7254 if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
f1871abd 7255 !WARN_ON(ieee80211_vif_is_mld(&sdata->vif)) &&
81151ce4 7256 ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) {
ea5cba26
JB		 7257 parse_params.bss = ifmgd->assoc_data->link[0].bss;
7258 elems = ieee802_11_parse_elems_full(&parse_params);
61513162
JB		 7259 if (!elems)
7260 return;
66e67e41 7261
61513162 7262 ieee80211_rx_bss_info(link, mgmt, len, rx_status);
66e67e41 7263
61513162
JB		 7264 if (elems->dtim_period)
7265 link->u.mgd.dtim_period = elems->dtim_period;
7266 link->u.mgd.have_beacon = true;
7267 ifmgd->assoc_data->need_beacon = false;
d12b9779
RK		 7268 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
7269 !ieee80211_is_s1g_beacon(hdr->frame_control)) {
3f5d7ff7 7270 bss_conf->sync_tsf =
61513162 7271 le64_to_cpu(mgmt->u.beacon.timestamp);
3f5d7ff7 7272 bss_conf->sync_device_ts =
61513162 7273 rx_status->device_timestamp;
3f5d7ff7 7274 bss_conf->sync_dtim_count = elems->dtim_count;
66e67e41 7275 }
66e67e41 7276
61513162
JB		 7277 if (elems->mbssid_config_ie)
7278 bss_conf->profile_periodicity =
7279 elems->mbssid_config_ie->profile_periodicity;
7280 else
7281 bss_conf->profile_periodicity = 0;
a43abf29 7282
61513162
JB		 7283 if (elems->ext_capab_len >= 11 &&
7284 (elems->ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
7285 bss_conf->ema_ap = true;
72a8a3ed 7286 else
61513162
JB		 7287 bss_conf->ema_ap = false;
7288
7289 /* continue assoc process */
7290 ifmgd->assoc_data->timeout = jiffies;
7291 ifmgd->assoc_data->timeout_started = true;
7292 run_again(sdata, ifmgd->assoc_data->timeout);
7293 kfree(elems);
7294 return;
7295 }
7296
7297 if (!ifmgd->associated ||
3f5d7ff7 7298 !ieee80211_rx_our_beacon(bssid, bss_conf->bss))
61513162
JB		 7299 return;
7300 bssid = link->u.mgd.bssid;
7301
7302 if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
7303 ieee80211_handle_beacon_sig(link, ifmgd, bss_conf,
7304 local, rx_status);
7305
7306 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
7307 mlme_dbg_ratelimited(sdata,
7308 "cancelling AP probe due to a received beacon\n");
7309 ieee80211_reset_ap_probe(sdata);
7310 }
7311
7312 /*
7313 * Push the beacon loss detection into the future since
7314 * we are processing a beacon from the AP just now.
7315 */
7316 ieee80211_sta_reset_beacon_monitor(sdata);
7317
7318 /* TODO: CRC urrently not calculated on S1G Beacon Compatibility
7319 * element (which carries the beacon interval). Don't forget to add a
7320 * bit to care_about_ies[] above if mac80211 is interested in a
7321 * changing S1G element.
7322 */
7323 if (!ieee80211_is_s1g_beacon(hdr->frame_control))
7324 ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
3f5d7ff7 7325 parse_params.bss = bss_conf->bss;
ea5cba26
JB		 7326 parse_params.filter = care_about_ies;
7327 parse_params.crc = ncrc;
7328 elems = ieee802_11_parse_elems_full(&parse_params);
61513162
JB		 7329 if (!elems)
7330 return;
9cc88678
JB		 7331
7332 if (rx_status->flag & RX_FLAG_DECRYPTED &&
7333 ieee80211_mgd_ssid_mismatch(sdata, elems)) {
7334 sdata_info(sdata, "SSID mismatch for AP %pM, disconnect\n",
7335 sdata->vif.cfg.ap_addr);
7336 __ieee80211_disconnect(sdata);
7337 return;
7338 }
7339
61513162
JB		 7340 ncrc = elems->crc;
7341
7342 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
7343 ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid)) {
7344 if (local->hw.conf.dynamic_ps_timeout > 0) {
7345 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
7346 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
7347 ieee80211_hw_config(local,
7348 IEEE80211_CONF_CHANGE_PS);
7349 }
7350 ieee80211_send_nullfunc(local, sdata, false);
7351 } else if (!local->pspolling && sdata->u.mgd.powersave) {
7352 local->pspolling = true;
72a8a3ed 7353
b291ba11 7354 /*
61513162
JB		 7355 * Here is assumed that the driver will be
7356 * able to send ps-poll frame and receive a
7357 * response even though power save mode is
7358 * enabled, but some drivers might require
7359 * to disable power save here. This needs
7360 * to be investigated.
b291ba11 7361 */
61513162 7362 ieee80211_send_pspoll(local, sdata);
b291ba11
JB		 7363 }
7364 }
7365
61513162
JB		 7366 if (sdata->vif.p2p ||
7367 sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
7368 struct ieee80211_p2p_noa_attr noa = {};
7369 int ret;
e5593f56 7370
61513162
JB		 7371 ret = cfg80211_get_p2p_attr(variable,
7372 len - baselen,
7373 IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
7374 (u8 *) &noa, sizeof(noa));
7375 if (ret >= 2) {
7376 if (link->u.mgd.p2p_noa_index != noa.index) {
7377 /* valid noa_attr and index changed */
7378 link->u.mgd.p2p_noa_index = noa.index;
7379 memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
7380 changed |= BSS_CHANGED_P2P_PS;
7381 /*
7382 * make sure we update all information, the CRC
7383 * mechanism doesn't look at P2P attributes.
7384 */
7385 link->u.mgd.beacon_crc_valid = false;
7386 }
7387 } else if (link->u.mgd.p2p_noa_index != -1) {
7388 /* noa_attr not found and we had valid noa_attr before */
7389 link->u.mgd.p2p_noa_index = -1;
7390 memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
7391 changed |= BSS_CHANGED_P2P_PS;
7392 link->u.mgd.beacon_crc_valid = false;
7393 }
7394 }
0b91111f 7395
61513162
JB		 7396 /*
7397 * Update beacon timing and dtim count on every beacon appearance. This
7398 * will allow the driver to use the most updated values. Do it before
7399 * comparing this one with last received beacon.
7400 * IMPORTANT: These parameters would possibly be out of sync by the time
7401 * the driver will use them. The synchronized view is currently
7402 * guaranteed only in certain callbacks.
7403 */
7404 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
7405 !ieee80211_is_s1g_beacon(hdr->frame_control)) {
3f5d7ff7 7406 bss_conf->sync_tsf =
61513162 7407 le64_to_cpu(mgmt->u.beacon.timestamp);
3f5d7ff7 7408 bss_conf->sync_device_ts =
61513162 7409 rx_status->device_timestamp;
3f5d7ff7 7410 bss_conf->sync_dtim_count = elems->dtim_count;
61513162 7411 }
b291ba11 7412
61513162 7413 if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) ||
c5fd399a
LH		 7414 (ext && ieee80211_is_s1g_short_beacon(ext->frame_control,
7415 parse_params.start,
7416 parse_params.len)))
61513162
JB		 7417 goto free;
7418 link->u.mgd.beacon_crc = ncrc;
7419 link->u.mgd.beacon_crc_valid = true;
5bd5666d 7420
61513162 7421 ieee80211_rx_bss_info(link, mgmt, len, rx_status);
e5593f56 7422
61513162
JB		 7423 ieee80211_sta_process_chanswitch(link, rx_status->mactime,
7424 rx_status->device_timestamp,
7ef8f682
JB		 7425 elems, elems,
7426 IEEE80211_CSA_SOURCE_BEACON);
7427
7428 /* note that after this elems->ml_basic can no longer be used fully */
7429 ieee80211_mgd_check_cross_link_csa(sdata, rx_status->link_id, elems);
9abf4e49 7430
e21dd758
EG		 7431 ieee80211_mgd_update_bss_param_ch_cnt(sdata, bss_conf, elems);
7432
de86c5f6
IP		 7433 if (!sdata->u.mgd.epcs.enabled &&
7434 !link->u.mgd.disable_wmm_tracking &&
61513162
JB		 7435 ieee80211_sta_wmm_params(local, link, elems->wmm_param,
7436 elems->wmm_param_len,
7437 elems->mu_edca_param_set))
7438 changed |= BSS_CHANGED_QOS;
9abf4e49 7439
61513162
JB		 7440 /*
7441 * If we haven't had a beacon before, tell the driver about the
7442 * DTIM period (and beacon timing if desired) now.
7d73cd94 7443 */
61513162
JB		 7444 if (!link->u.mgd.have_beacon) {
7445 /* a few bogus AP send dtim_period = 0 or no TIM IE */
7446 bss_conf->dtim_period = elems->dtim_period ?: 1;
b291ba11 7447
61513162
JB		 7448 changed |= BSS_CHANGED_BEACON_INFO;
7449 link->u.mgd.have_beacon = true;
b291ba11 7450
61513162 7451 ieee80211_recalc_ps(local);
b291ba11 7452
61513162
JB		 7453 ieee80211_recalc_ps_vif(sdata);
7454 }
ad935687 7455
61513162
JB		 7456 if (elems->erp_info) {
7457 erp_valid = true;
7458 erp_value = elems->erp_info[0];
7459 } else {
7460 erp_valid = false;
ad935687 7461 }
f0706e82 7462
61513162
JB		 7463 if (!ieee80211_is_s1g_beacon(hdr->frame_control))
7464 changed |= ieee80211_handle_bss_capability(link,
7465 le16_to_cpu(mgmt->u.beacon.capab_info),
7466 erp_valid, erp_value);
1a1cb744 7467
61513162 7468 sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
883b8dc1 7469 if (WARN_ON(!sta)) {
61513162 7470 goto free;
883b8dc1 7471 }
61513162 7472 link_sta = rcu_dereference_protected(sta->link[link->link_id],
4d3acf43 7473 lockdep_is_held(&local->hw.wiphy->mtx));
883b8dc1 7474 if (WARN_ON(!link_sta)) {
61513162 7475 goto free;
883b8dc1 7476 }
1a1cb744 7477
3f5d7ff7 7478 if (WARN_ON(!bss_conf->chanreq.oper.chan))
0143ea09
HD		 7479 goto free;
7480
3f5d7ff7 7481 sband = local->hw.wiphy->bands[bss_conf->chanreq.oper.chan->band];
0143ea09
HD		 7482
7483 changed |= ieee80211_recalc_twt_req(sdata, sband, link, link_sta, elems);
c52666ae 7484
69f95565 7485 if (ieee80211_config_bw(link, elems, true, &changed, "beacon")) {
61513162
JB		 7486 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7487 WLAN_REASON_DEAUTH_LEAVING,
7488 true, deauth_buf);
7489 ieee80211_report_disconnect(sdata, deauth_buf,
7490 sizeof(deauth_buf), true,
7491 WLAN_REASON_DEAUTH_LEAVING,
7492 false);
7493 goto free;
1a1cb744
JB		 7494 }
7495
15f9b3ef 7496 if (elems->opmode_notif)
61513162
JB		 7497 ieee80211_vht_handle_opmode(sdata, link_sta,
7498 *elems->opmode_notif,
7499 rx_status->band);
be72afe0 7500
61513162
JB		 7501 changed |= ieee80211_handle_pwr_constr(link, chan, mgmt,
7502 elems->country_elem,
7503 elems->country_elem_len,
7504 elems->pwr_constr_elem,
7505 elems->cisco_dtpc_elem);
be72afe0 7506
8eb8dd2f 7507 ieee80211_ml_reconfiguration(sdata, elems);
702e8047
AB		 7508 ieee80211_process_adv_ttlm(sdata, elems,
7509 le64_to_cpu(mgmt->u.beacon.timestamp));
8eb8dd2f 7510
61513162
JB		 7511 ieee80211_link_info_change_notify(sdata, link, changed);
7512free:
7513 kfree(elems);
1a1cb744
JB		 7514}
7515
8f500fbc
AB		 7516static void ieee80211_apply_neg_ttlm(struct ieee80211_sub_if_data *sdata,
7517 struct ieee80211_neg_ttlm neg_ttlm)
7518{
7519 u16 new_active_links, new_dormant_links, new_suspended_links, map = 0;
7520 u8 i;
7521
7522 for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++)
7523 map |= neg_ttlm.downlink[i] | neg_ttlm.uplink[i];
7524
7525 /* If there is an active TTLM, unset previously suspended links */
7526 if (sdata->vif.neg_ttlm.valid)
7527 sdata->vif.dormant_links &= ~sdata->vif.suspended_links;
7528
7529 /* exclude links that are already disabled by advertised TTLM */
7530 new_active_links =
7531 map & sdata->vif.valid_links & ~sdata->vif.dormant_links;
7532 new_suspended_links =
7533 (~map & sdata->vif.valid_links) & ~sdata->vif.dormant_links;
7534 new_dormant_links = sdata->vif.dormant_links | new_suspended_links;
7535 if (ieee80211_ttlm_set_links(sdata, new_active_links,
7536 new_dormant_links, new_suspended_links))
7537 return;
7538
7539 sdata->vif.neg_ttlm = neg_ttlm;
7540 sdata->vif.neg_ttlm.valid = true;
7541}
7542
f7660b3f
AB		 7543static void ieee80211_neg_ttlm_timeout_work(struct wiphy *wiphy,
7544 struct wiphy_work *work)
7545{
7546 struct ieee80211_sub_if_data *sdata =
7547 container_of(work, struct ieee80211_sub_if_data,
7548 u.mgd.neg_ttlm_timeout_work.work);
7549
7550 sdata_info(sdata,
7551 "No negotiated TTLM response from AP, disconnecting.\n");
7552
7553 __ieee80211_disconnect(sdata);
7554}
7555
8f500fbc
AB		 7556static void
7557ieee80211_neg_ttlm_add_suggested_map(struct sk_buff *skb,
7558 struct ieee80211_neg_ttlm *neg_ttlm)
7559{
7560 u8 i, direction[IEEE80211_TTLM_MAX_CNT];
7561
7562 if (memcmp(neg_ttlm->downlink, neg_ttlm->uplink,
7563 sizeof(neg_ttlm->downlink))) {
7564 direction[0] = IEEE80211_TTLM_DIRECTION_DOWN;
7565 direction[1] = IEEE80211_TTLM_DIRECTION_UP;
7566 } else {
7567 direction[0] = IEEE80211_TTLM_DIRECTION_BOTH;
7568 }
7569
7570 for (i = 0; i < ARRAY_SIZE(direction); i++) {
7571 u8 tid, len, map_ind = 0, *len_pos, *map_ind_pos, *pos;
7572 __le16 map;
7573
7574 len = sizeof(struct ieee80211_ttlm_elem) + 1 + 1;
7575
7576 pos = skb_put(skb, len + 2);
7577 *pos++ = WLAN_EID_EXTENSION;
7578 len_pos = pos++;
7579 *pos++ = WLAN_EID_EXT_TID_TO_LINK_MAPPING;
7580 *pos++ = direction[i];
7581 map_ind_pos = pos++;
7582 for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) {
7583 map = direction[i] == IEEE80211_TTLM_DIRECTION_UP ?
7584 cpu_to_le16(neg_ttlm->uplink[tid]) :
7585 cpu_to_le16(neg_ttlm->downlink[tid]);
7586 if (!map)
7587 continue;
7588
7589 len += 2;
7590 map_ind |= BIT(tid);
7591 skb_put_data(skb, &map, sizeof(map));
7592 }
7593
7594 *map_ind_pos = map_ind;
7595 *len_pos = len;
7596
7597 if (direction[i] == IEEE80211_TTLM_DIRECTION_BOTH)
7598 break;
7599 }
7600}
7601
f7660b3f
AB		 7602static void
7603ieee80211_send_neg_ttlm_req(struct ieee80211_sub_if_data *sdata,
7604 struct ieee80211_neg_ttlm *neg_ttlm,
7605 u8 dialog_token)
7606{
7607 struct ieee80211_local *local = sdata->local;
7608 struct ieee80211_mgmt *mgmt;
7609 struct sk_buff *skb;
7610 int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.ttlm_req);
7611 int ttlm_max_len = 2 + 1 + sizeof(struct ieee80211_ttlm_elem) + 1 +
7612 2 * 2 * IEEE80211_TTLM_NUM_TIDS;
7613
7614 skb = dev_alloc_skb(local->tx_headroom + hdr_len + ttlm_max_len);
7615 if (!skb)
7616 return;
7617
7618 skb_reserve(skb, local->tx_headroom);
7619 mgmt = skb_put_zero(skb, hdr_len);
7620 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
7621 IEEE80211_STYPE_ACTION);
7622 memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
7623 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
7624 memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
7625
7626 mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
7627 mgmt->u.action.u.ttlm_req.action_code =
7628 WLAN_PROTECTED_EHT_ACTION_TTLM_REQ;
7629 mgmt->u.action.u.ttlm_req.dialog_token = dialog_token;
7630 ieee80211_neg_ttlm_add_suggested_map(skb, neg_ttlm);
7631 ieee80211_tx_skb(sdata, skb);
7632}
7633
7634int ieee80211_req_neg_ttlm(struct ieee80211_sub_if_data *sdata,
7635 struct cfg80211_ttlm_params *params)
7636{
7637 struct ieee80211_neg_ttlm neg_ttlm = {};
7638 u8 i;
7639
7640 if (!ieee80211_vif_is_mld(&sdata->vif) ||
7641 !(sdata->vif.cfg.mld_capa_op &
7642 IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP))
7643 return -EINVAL;
7644
7645 for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) {
7646 if ((params->dlink[i] & ~sdata->vif.valid_links) ||
7647 (params->ulink[i] & ~sdata->vif.valid_links))
7648 return -EINVAL;
7649
7650 neg_ttlm.downlink[i] = params->dlink[i];
7651 neg_ttlm.uplink[i] = params->ulink[i];
7652 }
7653
7654 if (drv_can_neg_ttlm(sdata->local, sdata, &neg_ttlm) !=
7655 NEG_TTLM_RES_ACCEPT)
7656 return -EINVAL;
7657
7658 ieee80211_apply_neg_ttlm(sdata, neg_ttlm);
7659 sdata->u.mgd.dialog_token_alloc++;
7660 ieee80211_send_neg_ttlm_req(sdata, &sdata->vif.neg_ttlm,
7661 sdata->u.mgd.dialog_token_alloc);
7662 wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
7663 &sdata->u.mgd.neg_ttlm_timeout_work);
7664 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
7665 &sdata->u.mgd.neg_ttlm_timeout_work,
7666 IEEE80211_NEG_TTLM_REQ_TIMEOUT);
7667 return 0;
7668}
7669
8f500fbc
AB		 7670static void
7671ieee80211_send_neg_ttlm_res(struct ieee80211_sub_if_data *sdata,
7672 enum ieee80211_neg_ttlm_res ttlm_res,
7673 u8 dialog_token,
7674 struct ieee80211_neg_ttlm *neg_ttlm)
7675{
7676 struct ieee80211_local *local = sdata->local;
7677 struct ieee80211_mgmt *mgmt;
7678 struct sk_buff *skb;
7679 int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.ttlm_res);
7680 int ttlm_max_len = 2 + 1 + sizeof(struct ieee80211_ttlm_elem) + 1 +
7681 2 * 2 * IEEE80211_TTLM_NUM_TIDS;
e12a42f6 7682 u16 status_code;
8f500fbc
AB		 7683
7684 skb = dev_alloc_skb(local->tx_headroom + hdr_len + ttlm_max_len);
7685 if (!skb)
7686 return;
7687
7688 skb_reserve(skb, local->tx_headroom);
7689 mgmt = skb_put_zero(skb, hdr_len);
7690 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
7691 IEEE80211_STYPE_ACTION);
7692 memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
7693 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
7694 memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
7695
7696 mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
7697 mgmt->u.action.u.ttlm_res.action_code =
7698 WLAN_PROTECTED_EHT_ACTION_TTLM_RES;
7699 mgmt->u.action.u.ttlm_res.dialog_token = dialog_token;
7700 switch (ttlm_res) {
7701 default:
7702 WARN_ON(1);
7703 fallthrough;
7704 case NEG_TTLM_RES_REJECT:
e12a42f6 7705 status_code = WLAN_STATUS_DENIED_TID_TO_LINK_MAPPING;
8f500fbc
AB		 7706 break;
7707 case NEG_TTLM_RES_ACCEPT:
e12a42f6 7708 status_code = WLAN_STATUS_SUCCESS;
8f500fbc
AB		 7709 break;
7710 case NEG_TTLM_RES_SUGGEST_PREFERRED:
e12a42f6 7711 status_code = WLAN_STATUS_PREF_TID_TO_LINK_MAPPING_SUGGESTED;
8f500fbc
AB		 7712 ieee80211_neg_ttlm_add_suggested_map(skb, neg_ttlm);
7713 break;
7714 }
7715
e12a42f6 7716 mgmt->u.action.u.ttlm_res.status_code = cpu_to_le16(status_code);
8f500fbc
AB		 7717 ieee80211_tx_skb(sdata, skb);
7718}
7719
7720static int
7721ieee80211_parse_neg_ttlm(struct ieee80211_sub_if_data *sdata,
7722 const struct ieee80211_ttlm_elem *ttlm,
7723 struct ieee80211_neg_ttlm *neg_ttlm,
7724 u8 *direction)
7725{
7726 u8 control, link_map_presence, map_size, tid;
7727 u8 *pos;
7728
7729 /* The element size was already validated in
7730 * ieee80211_tid_to_link_map_size_ok()
7731 */
7732 pos = (void *)ttlm->optional;
7733
7734 control = ttlm->control;
7735
7736 /* mapping switch time and expected duration fields are not expected
7737 * in case of negotiated TTLM
7738 */
7739 if (control & (IEEE80211_TTLM_CONTROL_SWITCH_TIME_PRESENT |
7740 IEEE80211_TTLM_CONTROL_EXPECTED_DUR_PRESENT)) {
7741 mlme_dbg(sdata,
7742 "Invalid TTLM element in negotiated TTLM request\n");
7743 return -EINVAL;
7744 }
7745
7746 if (control & IEEE80211_TTLM_CONTROL_DEF_LINK_MAP) {
7747 for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) {
7748 neg_ttlm->downlink[tid] = sdata->vif.valid_links;
7749 neg_ttlm->uplink[tid] = sdata->vif.valid_links;
7750 }
7751 *direction = IEEE80211_TTLM_DIRECTION_BOTH;
7752 return 0;
7753 }
7754
7755 *direction = u8_get_bits(control, IEEE80211_TTLM_CONTROL_DIRECTION);
7756 if (*direction != IEEE80211_TTLM_DIRECTION_DOWN &&
7757 *direction != IEEE80211_TTLM_DIRECTION_UP &&
7758 *direction != IEEE80211_TTLM_DIRECTION_BOTH)
7759 return -EINVAL;
7760
7761 link_map_presence = *pos;
7762 pos++;
7763
7764 if (control & IEEE80211_TTLM_CONTROL_LINK_MAP_SIZE)
7765 map_size = 1;
7766 else
7767 map_size = 2;
7768
7769 for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) {
7770 u16 map;
7771
7772 if (link_map_presence & BIT(tid)) {
7773 map = ieee80211_get_ttlm(map_size, pos);
7774 if (!map) {
7775 mlme_dbg(sdata,
7776 "No active links for TID %d", tid);
7777 return -EINVAL;
7778 }
7779 } else {
7780 map = 0;
7781 }
7782
7783 switch (*direction) {
7784 case IEEE80211_TTLM_DIRECTION_BOTH:
7785 neg_ttlm->downlink[tid] = map;
7786 neg_ttlm->uplink[tid] = map;
7787 break;
7788 case IEEE80211_TTLM_DIRECTION_DOWN:
7789 neg_ttlm->downlink[tid] = map;
7790 break;
7791 case IEEE80211_TTLM_DIRECTION_UP:
7792 neg_ttlm->uplink[tid] = map;
7793 break;
7794 default:
7795 return -EINVAL;
7796 }
7797 pos += map_size;
7798 }
7799 return 0;
7800}
7801
7802void ieee80211_process_neg_ttlm_req(struct ieee80211_sub_if_data *sdata,
7803 struct ieee80211_mgmt *mgmt, size_t len)
7804{
7805 u8 dialog_token, direction[IEEE80211_TTLM_MAX_CNT] = {}, i;
7806 size_t ies_len;
7807 enum ieee80211_neg_ttlm_res ttlm_res = NEG_TTLM_RES_ACCEPT;
7808 struct ieee802_11_elems *elems = NULL;
7809 struct ieee80211_neg_ttlm neg_ttlm = {};
7810
7811 BUILD_BUG_ON(ARRAY_SIZE(direction) != ARRAY_SIZE(elems->ttlm));
7812
7813 if (!ieee80211_vif_is_mld(&sdata->vif))
7814 return;
7815
7816 dialog_token = mgmt->u.action.u.ttlm_req.dialog_token;
7817 ies_len = len - offsetof(struct ieee80211_mgmt,
7818 u.action.u.ttlm_req.variable);
7819 elems = ieee802_11_parse_elems(mgmt->u.action.u.ttlm_req.variable,
7820 ies_len, true, NULL);
7821 if (!elems) {
7822 ttlm_res = NEG_TTLM_RES_REJECT;
7823 goto out;
7824 }
7825
7826 for (i = 0; i < elems->ttlm_num; i++) {
7827 if (ieee80211_parse_neg_ttlm(sdata, elems->ttlm[i],
7828 &neg_ttlm, &direction[i]) ||
7829 (direction[i] == IEEE80211_TTLM_DIRECTION_BOTH &&
7830 elems->ttlm_num != 1)) {
7831 ttlm_res = NEG_TTLM_RES_REJECT;
7832 goto out;
7833 }
7834 }
7835
7836 if (!elems->ttlm_num ||
7837 (elems->ttlm_num == 2 && direction[0] == direction[1])) {
7838 ttlm_res = NEG_TTLM_RES_REJECT;
7839 goto out;
7840 }
7841
7842 for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) {
7843 if ((neg_ttlm.downlink[i] &&
7844 (neg_ttlm.downlink[i] & ~sdata->vif.valid_links)) ||
7845 (neg_ttlm.uplink[i] &&
7846 (neg_ttlm.uplink[i] & ~sdata->vif.valid_links))) {
7847 ttlm_res = NEG_TTLM_RES_REJECT;
7848 goto out;
7849 }
7850 }
7851
7852 ttlm_res = drv_can_neg_ttlm(sdata->local, sdata, &neg_ttlm);
7853
7854 if (ttlm_res != NEG_TTLM_RES_ACCEPT)
7855 goto out;
7856
7857 ieee80211_apply_neg_ttlm(sdata, neg_ttlm);
7858out:
7859 kfree(elems);
7860 ieee80211_send_neg_ttlm_res(sdata, ttlm_res, dialog_token, &neg_ttlm);
7861}
7862
f7660b3f
AB		 7863void ieee80211_process_neg_ttlm_res(struct ieee80211_sub_if_data *sdata,
7864 struct ieee80211_mgmt *mgmt, size_t len)
7865{
7866 if (!ieee80211_vif_is_mld(&sdata->vif) ||
7867 mgmt->u.action.u.ttlm_req.dialog_token !=
7868 sdata->u.mgd.dialog_token_alloc)
7869 return;
7870
7871 wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
7872 &sdata->u.mgd.neg_ttlm_timeout_work);
7873
7874 /* MLD station sends a TID to link mapping request, mainly to handle
7875 * BTM (BSS transition management) request, in which case it needs to
7876 * restrict the active links set.
7877 * In this case it's not expected that the MLD AP will reject the
7878 * negotiated TTLM request.
7879 * This can be better implemented in the future, to handle request
7880 * rejections.
7881 */
e12a42f6 7882 if (le16_to_cpu(mgmt->u.action.u.ttlm_res.status_code) != WLAN_STATUS_SUCCESS)
f7660b3f
AB		 7883 __ieee80211_disconnect(sdata);
7884}
7885
8b8a6731 7886void ieee80211_process_ttlm_teardown(struct ieee80211_sub_if_data *sdata)
a17a58ad
AB		 7887{
7888 u16 new_dormant_links;
a17a58ad
AB		 7889
7890 if (!sdata->vif.neg_ttlm.valid)
7891 return;
7892
7893 memset(&sdata->vif.neg_ttlm, 0, sizeof(sdata->vif.neg_ttlm));
7894 new_dormant_links =
7895 sdata->vif.dormant_links & ~sdata->vif.suspended_links;
7896 sdata->vif.suspended_links = 0;
7897 ieee80211_vif_set_links(sdata, sdata->vif.valid_links,
7898 new_dormant_links);
7899 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_MLD_TTLM |
7900 BSS_CHANGED_MLD_VALID_LINKS);
7901}
7902
8b8a6731
IP		 7903static void ieee80211_teardown_ttlm_work(struct wiphy *wiphy,
7904 struct wiphy_work *work)
7905{
7906 struct ieee80211_sub_if_data *sdata =
7907 container_of(work, struct ieee80211_sub_if_data,
7908 u.mgd.teardown_ttlm_work);
7909
7910 ieee80211_process_ttlm_teardown(sdata);
7911}
7912
a17a58ad
AB		 7913void ieee80211_send_teardown_neg_ttlm(struct ieee80211_vif *vif)
7914{
7915 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7916 struct ieee80211_local *local = sdata->local;
7917 struct ieee80211_mgmt *mgmt;
7918 struct sk_buff *skb;
7919 int frame_len = offsetofend(struct ieee80211_mgmt,
7920 u.action.u.ttlm_tear_down);
7921 struct ieee80211_tx_info *info;
7922
7923 skb = dev_alloc_skb(local->hw.extra_tx_headroom + frame_len);
7924 if (!skb)
7925 return;
7926
7927 skb_reserve(skb, local->hw.extra_tx_headroom);
7928 mgmt = skb_put_zero(skb, frame_len);
7929 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
7930 IEEE80211_STYPE_ACTION);
7931 memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
7932 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
7933 memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
7934
7935 mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
7936 mgmt->u.action.u.ttlm_tear_down.action_code =
7937 WLAN_PROTECTED_EHT_ACTION_TTLM_TEARDOWN;
7938
7939 info = IEEE80211_SKB_CB(skb);
7940 info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
7941 info->status_data = IEEE80211_STATUS_TYPE_NEG_TTLM;
7942 ieee80211_tx_skb(sdata, skb);
7943}
7944EXPORT_SYMBOL(ieee80211_send_teardown_neg_ttlm);
7945
61513162
JB		 7946void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
7947 struct sk_buff *skb)
b8360ab8 7948{
61513162
JB		 7949 struct ieee80211_link_data *link = &sdata->deflink;
7950 struct ieee80211_rx_status *rx_status;
7951 struct ieee80211_hdr *hdr;
7952 u16 fc;
b8360ab8 7953
076fc877
JB		 7954 lockdep_assert_wiphy(sdata->local->hw.wiphy);
7955
61513162
JB		 7956 rx_status = (struct ieee80211_rx_status *) skb->cb;
7957 hdr = (struct ieee80211_hdr *) skb->data;
7958 fc = le16_to_cpu(hdr->frame_control);
7d352ccf 7959
61513162
JB		 7960 switch (fc & IEEE80211_FCTL_STYPE) {
7961 case IEEE80211_STYPE_S1G_BEACON:
7962 ieee80211_rx_mgmt_beacon(link, hdr, skb->len, rx_status);
7963 break;
7d352ccf 7964 }
b8360ab8 7965}
b8360ab8 7966
61513162
JB		 7967void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
7968 struct sk_buff *skb)
94ddc3b5 7969{
61513162
JB		 7970 struct ieee80211_link_data *link = &sdata->deflink;
7971 struct ieee80211_rx_status *rx_status;
b777bdfc 7972 struct ieee802_11_elems *elems;
61513162
JB		 7973 struct ieee80211_mgmt *mgmt;
7974 u16 fc;
7975 int ies_len;
94ddc3b5 7976
076fc877
JB		 7977 lockdep_assert_wiphy(sdata->local->hw.wiphy);
7978
61513162
JB		 7979 rx_status = (struct ieee80211_rx_status *) skb->cb;
7980 mgmt = (struct ieee80211_mgmt *) skb->data;
7981 fc = le16_to_cpu(mgmt->frame_control);
94ddc3b5 7982
4f6c78de
JB		 7983 if (rx_status->link_valid) {
7984 link = sdata_dereference(sdata->link[rx_status->link_id],
7985 sdata);
7986 if (!link)
076fc877 7987 return;
4f6c78de
JB		 7988 }
7989
61513162
JB		 7990 switch (fc & IEEE80211_FCTL_STYPE) {
7991 case IEEE80211_STYPE_BEACON:
7992 ieee80211_rx_mgmt_beacon(link, (void *)mgmt,
7993 skb->len, rx_status);
7994 break;
7995 case IEEE80211_STYPE_PROBE_RESP:
7996 ieee80211_rx_mgmt_probe_resp(link, skb);
7997 break;
7998 case IEEE80211_STYPE_AUTH:
7999 ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
8000 break;
8001 case IEEE80211_STYPE_DEAUTH:
8002 ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
8003 break;
8004 case IEEE80211_STYPE_DISASSOC:
8005 ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
8006 break;
8007 case IEEE80211_STYPE_ASSOC_RESP:
8008 case IEEE80211_STYPE_REASSOC_RESP:
8009 ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
8010 break;
8011 case IEEE80211_STYPE_ACTION:
556f16b8
BB		 8012 if (!sdata->u.mgd.associated ||
8013 !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
8014 break;
8015
b777bdfc
JB		 8016 switch (mgmt->u.action.category) {
8017 case WLAN_CATEGORY_SPECTRUM_MGMT:
61513162
JB		 8018 ies_len = skb->len -
8019 offsetof(struct ieee80211_mgmt,
8020 u.action.u.chan_switch.variable);
f0706e82 8021
61513162
JB		 8022 if (ies_len < 0)
8023 break;
b2e8434f 8024
61513162
JB		 8025 /* CSA IE cannot be overridden, no need for BSSID */
8026 elems = ieee802_11_parse_elems(
8027 mgmt->u.action.u.chan_switch.variable,
8028 ies_len, true, NULL);
b2e8434f 8029
414e090b
JB		 8030 if (elems && !elems->parse_error) {
8031 enum ieee80211_csa_source src =
8032 IEEE80211_CSA_SOURCE_PROT_ACTION;
8033
61513162
JB		 8034 ieee80211_sta_process_chanswitch(link,
8035 rx_status->mactime,
8036 rx_status->device_timestamp,
7ef8f682 8037 elems, elems,
414e090b
JB		 8038 src);
8039 }
61513162 8040 kfree(elems);
b777bdfc
JB		 8041 break;
8042 case WLAN_CATEGORY_PUBLIC:
8043 case WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION:
61513162
JB		 8044 ies_len = skb->len -
8045 offsetof(struct ieee80211_mgmt,
8046 u.action.u.ext_chan_switch.variable);
b2e8434f 8047
61513162
JB		 8048 if (ies_len < 0)
8049 break;
60f8b39c 8050
61513162
JB		 8051 /*
8052 * extended CSA IE can't be overridden, no need for
8053 * BSSID
8054 */
8055 elems = ieee802_11_parse_elems(
8056 mgmt->u.action.u.ext_chan_switch.variable,
8057 ies_len, true, NULL);
8058
8059 if (elems && !elems->parse_error) {
b777bdfc
JB		 8060 enum ieee80211_csa_source src;
8061
8062 if (mgmt->u.action.category ==
8063 WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
8064 src = IEEE80211_CSA_SOURCE_PROT_ACTION;
8065 else
8066 src = IEEE80211_CSA_SOURCE_UNPROT_ACTION;
414e090b 8067
61513162
JB		 8068 /* for the handling code pretend it was an IE */
8069 elems->ext_chansw_ie =
8070 &mgmt->u.action.u.ext_chan_switch.data;
8071
8072 ieee80211_sta_process_chanswitch(link,
8073 rx_status->mactime,
8074 rx_status->device_timestamp,
7ef8f682 8075 elems, elems,
414e090b 8076 src);
61513162
JB		 8077 }
8078
8079 kfree(elems);
b777bdfc 8080 break;
61513162
JB		 8081 }
8082 break;
370bd005 8083 }
77fdaa12 8084}
60f8b39c 8085
61513162 8086static void ieee80211_sta_timer(struct timer_list *t)
f2d9d270 8087{
61513162 8088 struct ieee80211_sub_if_data *sdata =
41cb0855 8089 timer_container_of(sdata, t, u.mgd.timer);
f2d9d270 8090
16114496 8091 wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
61513162 8092}
f2d9d270 8093
61513162
JB		 8094void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
8095 u8 reason, bool tx)
8096{
8097 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
f2d9d270 8098
61513162
JB		 8099 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
8100 tx, frame_buf);
f2d9d270 8101
61513162
JB		 8102 ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
8103 reason, false);
8104}
f2d9d270 8105
61513162
JB		 8106static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
8107{
8108 struct ieee80211_local *local = sdata->local;
8109 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
8110 struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
8111 u32 tx_flags = 0;
8112 u16 trans = 1;
8113 u16 status = 0;
8114 struct ieee80211_prep_tx_info info = {
8115 .subtype = IEEE80211_STYPE_AUTH,
8116 };
8117
076fc877 8118 lockdep_assert_wiphy(sdata->local->hw.wiphy);
f2d9d270 8119
61513162
JB		 8120 if (WARN_ON_ONCE(!auth_data))
8121 return -EINVAL;
f39b7d62 8122
61513162 8123 auth_data->tries++;
f39b7d62 8124
61513162
JB		 8125 if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
8126 sdata_info(sdata, "authentication with %pM timed out\n",
81151ce4 8127 auth_data->ap_addr);
f39b7d62 8128
61513162
JB		 8129 /*
8130 * Most likely AP is not in the range so remove the
8131 * bss struct for that AP.
8132 */
8133 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
f39b7d62 8134
61513162
JB		 8135 return -ETIMEDOUT;
8136 }
f39b7d62 8137
61513162
JB		 8138 if (auth_data->algorithm == WLAN_AUTH_SAE)
8139 info.duration = jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);
f39b7d62 8140
e76f3b4a 8141 info.link_id = auth_data->link_id;
61513162 8142 drv_mgd_prepare_tx(local, sdata, &info);
f39b7d62 8143
61513162 8144 sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
81151ce4 8145 auth_data->ap_addr, auth_data->tries,
61513162 8146 IEEE80211_AUTH_MAX_TRIES);
f39b7d62 8147
61513162 8148 auth_data->expected_transaction = 2;
f39b7d62 8149
61513162
JB		 8150 if (auth_data->algorithm == WLAN_AUTH_SAE) {
8151 trans = auth_data->sae_trans;
8152 status = auth_data->sae_status;
8153 auth_data->expected_transaction = trans;
8154 }
f39b7d62 8155
61513162
JB		 8156 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
8157 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
8158 IEEE80211_TX_INTFL_MLME_CONN_TX;
f39b7d62 8159
61513162
JB		 8160 ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
8161 auth_data->data, auth_data->data_len,
81151ce4
JB		 8162 auth_data->ap_addr, auth_data->ap_addr,
8163 NULL, 0, 0, tx_flags);
f39b7d62 8164
61513162
JB		 8165 if (tx_flags == 0) {
8166 if (auth_data->algorithm == WLAN_AUTH_SAE)
8167 auth_data->timeout = jiffies +
8168 IEEE80211_AUTH_TIMEOUT_SAE;
8169 else
8170 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
8171 } else {
8172 auth_data->timeout =
8173 round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
f39b7d62
MG		 8174 }
8175
61513162
JB		 8176 auth_data->timeout_started = true;
8177 run_again(sdata, auth_data->timeout);
8178
8179 return 0;
f2d9d270
JB		 8180}
8181
61513162 8182static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
97634ef4 8183{
61513162
JB		 8184 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
8185 struct ieee80211_local *local = sdata->local;
8186 int ret;
97634ef4 8187
076fc877 8188 lockdep_assert_wiphy(sdata->local->hw.wiphy);
97634ef4 8189
61513162 8190 assoc_data->tries++;
1524173a 8191 assoc_data->comeback = false;
61513162
JB		 8192 if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
8193 sdata_info(sdata, "association with %pM timed out\n",
81151ce4 8194 assoc_data->ap_addr);
97634ef4 8195
61513162
JB		 8196 /*
8197 * Most likely AP is not in the range so remove the
8198 * bss struct for that AP.
8199 */
81151ce4
JB		 8200 cfg80211_unlink_bss(local->hw.wiphy,
8201 assoc_data->link[assoc_data->assoc_link_id].bss);
97634ef4 8202
61513162 8203 return -ETIMEDOUT;
97634ef4
MG		 8204 }
8205
61513162 8206 sdata_info(sdata, "associate with %pM (try %d/%d)\n",
81151ce4 8207 assoc_data->ap_addr, assoc_data->tries,
61513162
JB		 8208 IEEE80211_ASSOC_MAX_TRIES);
8209 ret = ieee80211_send_assoc(sdata);
8210 if (ret)
8211 return ret;
97634ef4 8212
61513162
JB		 8213 if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
8214 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
8215 assoc_data->timeout_started = true;
8216 run_again(sdata, assoc_data->timeout);
8217 } else {
8218 assoc_data->timeout =
8219 round_jiffies_up(jiffies +
8220 IEEE80211_ASSOC_TIMEOUT_LONG);
8221 assoc_data->timeout_started = true;
8222 run_again(sdata, assoc_data->timeout);
97634ef4
MG		 8223 }
8224
61513162
JB		 8225 return 0;
8226}
97634ef4 8227
61513162
JB		 8228void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
8229 __le16 fc, bool acked)
8230{
8231 struct ieee80211_local *local = sdata->local;
97634ef4 8232
61513162
JB		 8233 sdata->u.mgd.status_fc = fc;
8234 sdata->u.mgd.status_acked = acked;
8235 sdata->u.mgd.status_received = true;
97634ef4 8236
16114496 8237 wiphy_work_queue(local->hw.wiphy, &sdata->work);
61513162 8238}
97634ef4 8239
61513162
JB		 8240void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
8241{
8242 struct ieee80211_local *local = sdata->local;
8243 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
97634ef4 8244
076fc877 8245 lockdep_assert_wiphy(sdata->local->hw.wiphy);
61513162
JB		 8246
8247 if (ifmgd->status_received) {
8248 __le16 fc = ifmgd->status_fc;
8249 bool status_acked = ifmgd->status_acked;
8250
8251 ifmgd->status_received = false;
8252 if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
8253 if (status_acked) {
8254 if (ifmgd->auth_data->algorithm ==
8255 WLAN_AUTH_SAE)
8256 ifmgd->auth_data->timeout =
8257 jiffies +
8258 IEEE80211_AUTH_TIMEOUT_SAE;
8259 else
8260 ifmgd->auth_data->timeout =
8261 jiffies +
8262 IEEE80211_AUTH_TIMEOUT_SHORT;
8263 run_again(sdata, ifmgd->auth_data->timeout);
8264 } else {
8265 ifmgd->auth_data->timeout = jiffies - 1;
8266 }
8267 ifmgd->auth_data->timeout_started = true;
8268 } else if (ifmgd->assoc_data &&
b133fdf0 8269 !ifmgd->assoc_data->comeback &&
61513162
JB		 8270 (ieee80211_is_assoc_req(fc) ||
8271 ieee80211_is_reassoc_req(fc))) {
b133fdf0
JM		 8272 /*
8273 * Update association timeout based on the TX status
8274 * for the (Re)Association Request frame. Skip this if
8275 * we have already processed a (Re)Association Response
8276 * frame that indicated need for association comeback
8277 * at a specific time in the future. This could happen
8278 * if the TX status information is delayed enough for
8279 * the response to be received and processed first.
8280 */
61513162
JB		 8281 if (status_acked) {
8282 ifmgd->assoc_data->timeout =
8283 jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
8284 run_again(sdata, ifmgd->assoc_data->timeout);
8285 } else {
8286 ifmgd->assoc_data->timeout = jiffies - 1;
8287 }
8288 ifmgd->assoc_data->timeout_started = true;
97634ef4
MG		 8289 }
8290 }
8291
61513162
JB		 8292 if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
8293 time_after(jiffies, ifmgd->auth_data->timeout)) {
8294 if (ifmgd->auth_data->done || ifmgd->auth_data->waiting) {
8295 /*
8296 * ok ... we waited for assoc or continuation but
8297 * userspace didn't do it, so kill the auth data
8298 */
8299 ieee80211_destroy_auth_data(sdata, false);
8300 } else if (ieee80211_auth(sdata)) {
81151ce4 8301 u8 ap_addr[ETH_ALEN];
61513162
JB		 8302 struct ieee80211_event event = {
8303 .type = MLME_EVENT,
8304 .u.mlme.data = AUTH_EVENT,
8305 .u.mlme.status = MLME_TIMEOUT,
8306 };
8307
81151ce4 8308 memcpy(ap_addr, ifmgd->auth_data->ap_addr, ETH_ALEN);
97634ef4 8309
61513162 8310 ieee80211_destroy_auth_data(sdata, false);
41cbb0f5 8311
81151ce4 8312 cfg80211_auth_timeout(sdata->dev, ap_addr);
61513162
JB		 8313 drv_event_callback(sdata->local, sdata, &event);
8314 }
8315 } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
8316 run_again(sdata, ifmgd->auth_data->timeout);
41cbb0f5 8317
61513162
JB		 8318 if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
8319 time_after(jiffies, ifmgd->assoc_data->timeout)) {
8320 if ((ifmgd->assoc_data->need_beacon &&
8321 !sdata->deflink.u.mgd.have_beacon) ||
8322 ieee80211_do_assoc(sdata)) {
8323 struct ieee80211_event event = {
8324 .type = MLME_EVENT,
8325 .u.mlme.data = ASSOC_EVENT,
8326 .u.mlme.status = MLME_TIMEOUT,
8327 };
47aa7861 8328
61513162
JB		 8329 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
8330 drv_event_callback(sdata->local, sdata, &event);
8331 }
8332 } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
8333 run_again(sdata, ifmgd->assoc_data->timeout);
41cbb0f5 8334
61513162
JB		 8335 if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
8336 ifmgd->associated) {
8337 u8 *bssid = sdata->deflink.u.mgd.bssid;
8338 int max_tries;
41cbb0f5 8339
61513162
JB		 8340 if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
8341 max_tries = max_nullfunc_tries;
8342 else
8343 max_tries = max_probe_tries;
41cbb0f5 8344
61513162
JB		 8345 /* ACK received for nullfunc probing frame */
8346 if (!ifmgd->probe_send_count)
8347 ieee80211_reset_ap_probe(sdata);
8348 else if (ifmgd->nullfunc_failed) {
8349 if (ifmgd->probe_send_count < max_tries) {
8350 mlme_dbg(sdata,
8351 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
8352 bssid, ifmgd->probe_send_count,
8353 max_tries);
8354 ieee80211_mgd_probe_ap_send(sdata);
8355 } else {
8356 mlme_dbg(sdata,
8357 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
8358 bssid);
8359 ieee80211_sta_connection_lost(sdata,
8360 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
8361 false);
8362 }
8363 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
8364 run_again(sdata, ifmgd->probe_timeout);
8365 else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
8366 mlme_dbg(sdata,
8367 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
8368 bssid, probe_wait_ms);
8369 ieee80211_sta_connection_lost(sdata,
8370 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
8371 } else if (ifmgd->probe_send_count < max_tries) {
8372 mlme_dbg(sdata,
8373 "No probe response from AP %pM after %dms, try %d/%i\n",
8374 bssid, probe_wait_ms,
8375 ifmgd->probe_send_count, max_tries);
8376 ieee80211_mgd_probe_ap_send(sdata);
8377 } else {
41cbb0f5 8378 /*
61513162
JB		 8379 * We actually lost the connection ... or did we?
8380 * Let's make sure!
41cbb0f5 8381 */
61513162
JB		 8382 mlme_dbg(sdata,
8383 "No probe response from AP %pM after %dms, disconnecting.\n",
8384 bssid, probe_wait_ms);
41cbb0f5 8385
61513162
JB		 8386 ieee80211_sta_connection_lost(sdata,
8387 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
8388 }
41cbb0f5 8389 }
41cbb0f5
LC		 8390}
8391
61513162 8392static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
a1cf775d 8393{
61513162 8394 struct ieee80211_sub_if_data *sdata =
41cb0855 8395 timer_container_of(sdata, t, u.mgd.bcn_mon_timer);
37123c3b 8396
f1871abd 8397 if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
61513162 8398 return;
24398e39 8399
61513162 8400 if (sdata->vif.bss_conf.csa_active &&
344d18ce 8401 !sdata->deflink.u.mgd.csa.waiting_bcn)
61513162 8402 return;
f2d9d270 8403
61513162
JB		 8404 if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
8405 return;
75e296e9 8406
61513162 8407 sdata->u.mgd.connection_loss = false;
4b8d43f1
JB		 8408 wiphy_work_queue(sdata->local->hw.wiphy,
8409 &sdata->u.mgd.beacon_connection_loss_work);
61513162 8410}
75e296e9 8411
61513162
JB		 8412static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
8413{
8414 struct ieee80211_sub_if_data *sdata =
41cb0855 8415 timer_container_of(sdata, t, u.mgd.conn_mon_timer);
61513162
JB		 8416 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
8417 struct ieee80211_local *local = sdata->local;
8418 struct sta_info *sta;
8419 unsigned long timeout;
5dca295d 8420
f1871abd 8421 if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
61513162 8422 return;
75e296e9 8423
61513162 8424 if (sdata->vif.bss_conf.csa_active &&
344d18ce 8425 !sdata->deflink.u.mgd.csa.waiting_bcn)
61513162 8426 return;
53b954ee 8427
61513162
JB		 8428 sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
8429 if (!sta)
8430 return;
24398e39 8431
61513162
JB		 8432 timeout = sta->deflink.status_stats.last_ack;
8433 if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx))
8434 timeout = sta->deflink.rx_stats.last_rx;
8435 timeout += IEEE80211_CONNECTION_IDLE_TIME;
08e6effa 8436
61513162
JB		 8437 /* If timeout is after now, then update timer to fire at
8438 * the later date, but do not actually probe at this time.
8439 */
8440 if (time_is_after_jiffies(timeout)) {
8441 mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
8442 return;
24398e39
JB		 8443 }
8444
ac2f7d6f 8445 wiphy_work_queue(local->hw.wiphy, &sdata->u.mgd.monitor_work);
61513162 8446}
41cbb0f5 8447
ac2f7d6f
JB		 8448static void ieee80211_sta_monitor_work(struct wiphy *wiphy,
8449 struct wiphy_work *work)
61513162
JB		 8450{
8451 struct ieee80211_sub_if_data *sdata =
8452 container_of(work, struct ieee80211_sub_if_data,
8453 u.mgd.monitor_work);
63214f02 8454
61513162
JB		 8455 ieee80211_mgd_probe_ap(sdata, false);
8456}
63214f02 8457
61513162
JB		 8458static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
8459{
8460 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
8461 __ieee80211_stop_poll(sdata);
63214f02 8462
61513162
JB		 8463 /* let's probe the connection once */
8464 if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
ac2f7d6f
JB		 8465 wiphy_work_queue(sdata->local->hw.wiphy,
8466 &sdata->u.mgd.monitor_work);
61513162
JB		 8467 }
8468}
63214f02 8469
61513162
JB		 8470#ifdef CONFIG_PM
8471void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
8472{
8473 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
8474 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
63214f02 8475
076fc877 8476 lockdep_assert_wiphy(sdata->local->hw.wiphy);
63214f02 8477
61513162 8478 if (ifmgd->auth_data || ifmgd->assoc_data) {
81151ce4
JB		 8479 const u8 *ap_addr = ifmgd->auth_data ?
8480 ifmgd->auth_data->ap_addr :
8481 ifmgd->assoc_data->ap_addr;
61513162
JB		 8482
8483 /*
8484 * If we are trying to authenticate / associate while suspending,
8485 * cfg80211 won't know and won't actually abort those attempts,
8486 * thus we need to do that ourselves.
8487 */
81151ce4 8488 ieee80211_send_deauth_disassoc(sdata, ap_addr, ap_addr,
61513162
JB		 8489 IEEE80211_STYPE_DEAUTH,
8490 WLAN_REASON_DEAUTH_LEAVING,
8491 false, frame_buf);
8492 if (ifmgd->assoc_data)
8493 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
8494 if (ifmgd->auth_data)
8495 ieee80211_destroy_auth_data(sdata, false);
8496 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
8497 IEEE80211_DEAUTH_FRAME_LEN,
8498 false);
5dca295d
IP		 8499 }
8500
61513162
JB		 8501 /* This is a bit of a hack - we should find a better and more generic
8502 * solution to this. Normally when suspending, cfg80211 will in fact
8503 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
8504 * auth (not so important) or assoc (this is the problem) process.
8505 *
8506 * As a consequence, it can happen that we are in the process of both
8507 * associating and suspending, and receive an association response
8508 * after cfg80211 has checked if it needs to disconnect, but before
8509 * we actually set the flag to drop incoming frames. This will then
8510 * cause the workqueue flush to process the association response in
8511 * the suspend, resulting in a successful association just before it
8512 * tries to remove the interface from the driver, which now though
8513 * has a channel context assigned ... this results in issues.
8514 *
8515 * To work around this (for now) simply deauth here again if we're
8516 * now connected.
5dca295d 8517 */
61513162
JB		 8518 if (ifmgd->associated && !sdata->local->wowlan) {
8519 u8 bssid[ETH_ALEN];
8520 struct cfg80211_deauth_request req = {
8521 .reason_code = WLAN_REASON_DEAUTH_LEAVING,
8522 .bssid = bssid,
8523 };
5dca295d 8524
61513162
JB		 8525 memcpy(bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
8526 ieee80211_mgd_deauth(sdata, &req);
41cbb0f5 8527 }
61513162
JB		 8528}
8529#endif
52a45f38 8530
61513162
JB		 8531void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
8532{
8533 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
8534
076fc877
JB		 8535 lockdep_assert_wiphy(sdata->local->hw.wiphy);
8536
8537 if (!ifmgd->associated)
61513162 8538 return;
52a45f38 8539
61513162
JB		 8540 if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
8541 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
8542 mlme_dbg(sdata, "driver requested disconnect after resume\n");
8543 ieee80211_sta_connection_lost(sdata,
8544 WLAN_REASON_UNSPECIFIED,
8545 true);
61513162 8546 return;
636ccdae 8547 }
52a45f38 8548
61513162
JB		 8549 if (sdata->flags & IEEE80211_SDATA_DISCONNECT_HW_RESTART) {
8550 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_HW_RESTART;
8551 mlme_dbg(sdata, "driver requested disconnect after hardware restart\n");
8552 ieee80211_sta_connection_lost(sdata,
8553 WLAN_REASON_UNSPECIFIED,
8554 true);
61513162 8555 return;
1d00ce80 8556 }
61513162 8557}
04ecd257 8558
1444f589
JB		 8559static void ieee80211_request_smps_mgd_work(struct wiphy *wiphy,
8560 struct wiphy_work *work)
61513162
JB		 8561{
8562 struct ieee80211_link_data *link =
8563 container_of(work, struct ieee80211_link_data,
8564 u.mgd.request_smps_work);
24398e39 8565
61513162
JB		 8566 __ieee80211_request_smps_mgd(link->sdata, link,
8567 link->u.mgd.driver_smps_mode);
61513162 8568}
9caf0364 8569
36e05b0b
IP		 8570static void ieee80211_ml_sta_reconf_timeout(struct wiphy *wiphy,
8571 struct wiphy_work *work)
8572{
8573 struct ieee80211_sub_if_data *sdata =
8574 container_of(work, struct ieee80211_sub_if_data,
8575 u.mgd.reconf.wk.work);
8576
8577 if (!sdata->u.mgd.reconf.added_links &&
8578 !sdata->u.mgd.reconf.removed_links)
8579 return;
8580
8581 sdata_info(sdata,
8582 "mlo: reconf: timeout: added=0x%x, removed=0x%x\n",
8583 sdata->u.mgd.reconf.added_links,
8584 sdata->u.mgd.reconf.removed_links);
8585
8586 __ieee80211_disconnect(sdata);
8587}
8588
61513162
JB		 8589/* interface setup */
8590void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
8591{
8592 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
57fa5e85 8593
ac2f7d6f 8594 wiphy_work_init(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4b8d43f1
JB		 8595 wiphy_work_init(&ifmgd->beacon_connection_loss_work,
8596 ieee80211_beacon_connection_loss_work);
8597 wiphy_work_init(&ifmgd->csa_connection_drop_work,
8598 ieee80211_csa_connection_drop_work);
777b2600
JB		 8599 wiphy_delayed_work_init(&ifmgd->tdls_peer_del_work,
8600 ieee80211_tdls_peer_del_work);
8eb8dd2f
IP		 8601 wiphy_delayed_work_init(&ifmgd->ml_reconf_work,
8602 ieee80211_ml_reconf_work);
36e05b0b
IP		 8603 wiphy_delayed_work_init(&ifmgd->reconf.wk,
8604 ieee80211_ml_sta_reconf_timeout);
61513162
JB		 8605 timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
8606 timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
8607 timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
aca40a5f
JB		 8608 wiphy_delayed_work_init(&ifmgd->tx_tspec_wk,
8609 ieee80211_sta_handle_tspec_ac_params_wk);
702e8047
AB		 8610 wiphy_delayed_work_init(&ifmgd->ttlm_work,
8611 ieee80211_tid_to_link_map_work);
f7660b3f
AB		 8612 wiphy_delayed_work_init(&ifmgd->neg_ttlm_timeout_work,
8613 ieee80211_neg_ttlm_timeout_work);
a17a58ad
AB		 8614 wiphy_work_init(&ifmgd->teardown_ttlm_work,
8615 ieee80211_teardown_ttlm_work);
04ecd257 8616
61513162
JB		 8617 ifmgd->flags = 0;
8618 ifmgd->powersave = sdata->wdev.ps;
8619 ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
8620 ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
8621 /* Setup TDLS data */
8622 spin_lock_init(&ifmgd->teardown_lock);
8623 ifmgd->teardown_skb = NULL;
8624 ifmgd->orig_teardown_skb = NULL;
67625910 8625 ifmgd->mcast_seq_last = IEEE80211_SN_MODULO;
61513162 8626}
0418a445 8627
e3640a82
JB		 8628static void ieee80211_recalc_smps_work(struct wiphy *wiphy,
8629 struct wiphy_work *work)
8630{
8631 struct ieee80211_link_data *link =
8632 container_of(work, struct ieee80211_link_data,
8633 u.mgd.recalc_smps);
8634
8635 ieee80211_recalc_smps(link->sdata, link);
8636}
8637
61513162
JB		 8638void ieee80211_mgd_setup_link(struct ieee80211_link_data *link)
8639{
81151ce4
JB		 8640 struct ieee80211_sub_if_data *sdata = link->sdata;
8641 struct ieee80211_local *local = sdata->local;
8642 unsigned int link_id = link->link_id;
0418a445 8643
61513162 8644 link->u.mgd.p2p_noa_index = -1;
61513162 8645 link->conf->bssid = link->u.mgd.bssid;
86b2dac2 8646 link->smps_mode = IEEE80211_SMPS_OFF;
61513162 8647
1444f589
JB		 8648 wiphy_work_init(&link->u.mgd.request_smps_work,
8649 ieee80211_request_smps_mgd_work);
e3640a82
JB		 8650 wiphy_work_init(&link->u.mgd.recalc_smps,
8651 ieee80211_recalc_smps_work);
61513162
JB		 8652 if (local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
8653 link->u.mgd.req_smps = IEEE80211_SMPS_AUTOMATIC;
8654 else
8655 link->u.mgd.req_smps = IEEE80211_SMPS_OFF;
8656
344d18ce
JB		 8657 wiphy_delayed_work_init(&link->u.mgd.csa.switch_work,
8658 ieee80211_csa_switch_work);
81151ce4 8659
39dc8b8e
JB		 8660 ieee80211_clear_tpe(&link->conf->tpe);
8661
81151ce4
JB		 8662 if (sdata->u.mgd.assoc_data)
8663 ether_addr_copy(link->conf->addr,
8664 sdata->u.mgd.assoc_data->link[link_id].addr);
36e05b0b
IP		 8665 else if (sdata->u.mgd.reconf.add_links_data)
8666 ether_addr_copy(link->conf->addr,
8667 sdata->u.mgd.reconf.add_links_data->link[link_id].addr);
acdc3e47
JB		 8668 else if (!is_valid_ether_addr(link->conf->addr))
8669 eth_random_addr(link->conf->addr);
61513162
JB		 8670}
8671
8672/* scan finished notification */
8673void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
8674{
8675 struct ieee80211_sub_if_data *sdata;
8676
8677 /* Restart STA timers */
8678 rcu_read_lock();
8679 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
8680 if (ieee80211_sdata_running(sdata))
8681 ieee80211_restart_sta_timer(sdata);
d601cd8d 8682 }
61513162 8683 rcu_read_unlock();
b17166a7
JB		 8684}
8685
8686static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
81151ce4
JB		 8687 struct cfg80211_bss *cbss, s8 link_id,
8688 const u8 *ap_mld_addr, bool assoc,
310c8387 8689 struct ieee80211_conn_settings *conn,
8ee0b202
BB		 8690 bool override,
8691 unsigned long *userspace_selectors)
b17166a7
JB		 8692{
8693 struct ieee80211_local *local = sdata->local;
8694 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
8695 struct ieee80211_bss *bss = (void *)cbss->priv;
8696 struct sta_info *new_sta = NULL;
81151ce4 8697 struct ieee80211_link_data *link;
c1041f10 8698 bool have_sta = false;
81151ce4 8699 bool mlo;
b17166a7
JB		 8700 int err;
8701
81151ce4
JB		 8702 if (link_id >= 0) {
8703 mlo = true;
8704 if (WARN_ON(!ap_mld_addr))
8705 return -EINVAL;
6d543b34 8706 err = ieee80211_vif_set_links(sdata, BIT(link_id), 0);
81151ce4
JB		 8707 } else {
8708 if (WARN_ON(ap_mld_addr))
8709 return -EINVAL;
8710 ap_mld_addr = cbss->bssid;
6d543b34 8711 err = ieee80211_vif_set_links(sdata, 0, 0);
81151ce4
JB		 8712 link_id = 0;
8713 mlo = false;
8714 }
8715
8716 if (err)
8717 return err;
8718
8719 link = sdata_dereference(sdata->link[link_id], sdata);
8720 if (WARN_ON(!link)) {
8721 err = -ENOLINK;
8722 goto out_err;
8723 }
8724
81151ce4
JB		 8725 if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) {
8726 err = -EINVAL;
8727 goto out_err;
8728 }
b17166a7 8729
f8860ce8 8730 /* If a reconfig is happening, bail out */
81151ce4
JB		 8731 if (local->in_reconfig) {
8732 err = -EBUSY;
8733 goto out_err;
8734 }
f8860ce8 8735
b17166a7
JB		 8736 if (assoc) {
8737 rcu_read_lock();
81151ce4 8738 have_sta = sta_info_get(sdata, ap_mld_addr);
b17166a7
JB		 8739 rcu_read_unlock();
8740 }
8741
8742 if (!have_sta) {
6d8e0f84 8743 if (mlo)
81151ce4
JB		 8744 new_sta = sta_info_alloc_with_link(sdata, ap_mld_addr,
8745 link_id, cbss->bssid,
8746 GFP_KERNEL);
8747 else
8748 new_sta = sta_info_alloc(sdata, ap_mld_addr, GFP_KERNEL);
8749
8750 if (!new_sta) {
8751 err = -ENOMEM;
8752 goto out_err;
8753 }
bd363ee5 8754
6d8e0f84 8755 new_sta->sta.mlo = mlo;
b17166a7 8756 }
179b8fc7 8757
c87905be
JB		 8758 /*
8759 * Set up the information for the new channel before setting the
8760 * new channel. We can't - completely race-free - change the basic
8761 * rates bitmap and the channel (sband) that it refers to, but if
8762 * we set it up before we at least avoid calling into the driver's
8763 * bss_info_changed() method with invalid information (since we do
8764 * call that from changing the channel - only for IDLE and perhaps
8765 * some others, but ...).
8766 *
8767 * So to avoid that, just set up all the new information before the
8768 * channel, but tell the driver to apply it only afterwards, since
8769 * it might need the new channel for that.
8770 */
13e0c8e3 8771 if (new_sta) {
8cef2c9d 8772 const struct cfg80211_bss_ies *ies;
b18d87f5 8773 struct link_sta_info *link_sta;
81151ce4
JB		 8774
8775 rcu_read_lock();
b18d87f5 8776 link_sta = rcu_dereference(new_sta->link[link_id]);
81151ce4
JB		 8777 if (WARN_ON(!link_sta)) {
8778 rcu_read_unlock();
8779 sta_info_free(local, new_sta);
8780 err = -EINVAL;
8781 goto out_err;
8782 }
5bd5666d 8783
bbe90107
JB		 8784 err = ieee80211_mgd_setup_link_sta(link, new_sta,
8785 link_sta, cbss);
8786 if (err) {
81151ce4 8787 rcu_read_unlock();
302ff8b7 8788 sta_info_free(local, new_sta);
81151ce4 8789 goto out_err;
5d6a1b06
JB		 8790 }
8791
5bd5666d 8792 memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
5d6a1b06 8793
8c358bcd 8794 /* set timing information */
5bd5666d 8795 link->conf->beacon_int = cbss->beacon_interval;
ef429dad
JB		 8796 ies = rcu_dereference(cbss->beacon_ies);
8797 if (ies) {
5bd5666d
JB		 8798 link->conf->sync_tsf = ies->tsf;
8799 link->conf->sync_device_ts =
ef429dad 8800 bss->device_ts_beacon;
78ac51f8
SS		 8801
8802 ieee80211_get_dtim(ies,
5bd5666d 8803 &link->conf->sync_dtim_count,
78ac51f8 8804 NULL);
30686bf7
JB		 8805 } else if (!ieee80211_hw_check(&sdata->local->hw,
8806 TIMING_BEACON_ONLY)) {
ef429dad
JB		 8807 ies = rcu_dereference(cbss->proberesp_ies);
8808 /* must be non-NULL since beacon IEs were NULL */
5bd5666d
JB		 8809 link->conf->sync_tsf = ies->tsf;
8810 link->conf->sync_device_ts =
ef429dad 8811 bss->device_ts_presp;
5bd5666d 8812 link->conf->sync_dtim_count = 0;
ef429dad 8813 } else {
5bd5666d
JB		 8814 link->conf->sync_tsf = 0;
8815 link->conf->sync_device_ts = 0;
8816 link->conf->sync_dtim_count = 0;
ef429dad 8817 }
8cef2c9d 8818 rcu_read_unlock();
c87905be 8819 }
8c358bcd 8820
c87905be 8821 if (new_sta || override) {
310c8387
JB		 8822 /*
8823 * Only set this if we're also going to calculate the AP
8824 * settings etc., otherwise this was set before in a
8825 * previous call. Note override is set to %true in assoc
8826 * if the settings were changed.
8827 */
8828 link->u.mgd.conn = *conn;
8829 err = ieee80211_prep_channel(sdata, link, link->link_id, cbss,
8ee0b202
BB		 8830 mlo, &link->u.mgd.conn,
8831 userspace_selectors);
c87905be
JB		 8832 if (err) {
8833 if (new_sta)
8834 sta_info_free(local, new_sta);
81151ce4 8835 goto out_err;
c87905be 8836 }
310c8387
JB		 8837 /* pass out for use in assoc */
8838 *conn = link->u.mgd.conn;
c87905be
JB		 8839 }
8840
8841 if (new_sta) {
8842 /*
8843 * tell driver about BSSID, basic rates and timing
8844 * this was set up above, before setting the channel
8845 */
5bd5666d 8846 ieee80211_link_info_change_notify(sdata, link,
d8675a63
JB		 8847 BSS_CHANGED_BSSID |
8848 BSS_CHANGED_BASIC_RATES |
8849 BSS_CHANGED_BEACON_INT);
a1cf775d
JB		 8850
8851 if (assoc)
13e0c8e3 8852 sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
a1cf775d 8853
13e0c8e3
JB		 8854 err = sta_info_insert(new_sta);
8855 new_sta = NULL;
a1cf775d 8856 if (err) {
bdcbd8e0
JB		 8857 sdata_info(sdata,
8858 "failed to insert STA entry for the AP (error %d)\n",
8859 err);
2e6bd243 8860 goto out_release_chan;
a1cf775d
JB		 8861 }
8862 } else
5bd5666d 8863 WARN_ON_ONCE(!ether_addr_equal(link->u.mgd.bssid, cbss->bssid));
a1cf775d 8864
7d830a19
DS		 8865 /* Cancel scan to ensure that nothing interferes with connection */
8866 if (local->scanning)
8867 ieee80211_scan_cancel(local);
8868
a1cf775d 8869 return 0;
81151ce4 8870
2e6bd243
JB		 8871out_release_chan:
8872 ieee80211_link_release_channel(link);
81151ce4 8873out_err:
6d543b34 8874 ieee80211_vif_set_links(sdata, 0, 0);
81151ce4 8875 return err;
a1cf775d
JB		 8876}
8877
35e2385d
JB		 8878static bool ieee80211_mgd_csa_present(struct ieee80211_sub_if_data *sdata,
8879 const struct cfg80211_bss_ies *ies,
8880 u8 cur_channel, bool ignore_ecsa)
8881{
8882 const struct element *csa_elem, *ecsa_elem;
8883 struct ieee80211_channel_sw_ie *csa = NULL;
8884 struct ieee80211_ext_chansw_ie *ecsa = NULL;
8885
8886 if (!ies)
8887 return false;
8888
8889 csa_elem = cfg80211_find_elem(WLAN_EID_CHANNEL_SWITCH,
8890 ies->data, ies->len);
8891 if (csa_elem && csa_elem->datalen == sizeof(*csa))
8892 csa = (void *)csa_elem->data;
8893
8894 ecsa_elem = cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN,
8895 ies->data, ies->len);
8896 if (ecsa_elem && ecsa_elem->datalen == sizeof(*ecsa))
8897 ecsa = (void *)ecsa_elem->data;
8898
8899 if (csa && csa->count == 0)
8900 csa = NULL;
8901 if (csa && !csa->mode && csa->new_ch_num == cur_channel)
8902 csa = NULL;
8903
8904 if (ecsa && ecsa->count == 0)
8905 ecsa = NULL;
8906 if (ecsa && !ecsa->mode && ecsa->new_ch_num == cur_channel)
8907 ecsa = NULL;
8908
8909 if (ignore_ecsa && ecsa) {
8910 sdata_info(sdata,
8911 "Ignoring ECSA in probe response - was considered stuck!\n");
8912 return csa;
8913 }
8914
8915 return csa || ecsa;
8916}
8917
8918static bool ieee80211_mgd_csa_in_process(struct ieee80211_sub_if_data *sdata,
8919 struct cfg80211_bss *bss)
8920{
8921 u8 cur_channel;
8922 bool ret;
8923
8924 cur_channel = ieee80211_frequency_to_channel(bss->channel->center_freq);
8925
8926 rcu_read_lock();
8927 if (ieee80211_mgd_csa_present(sdata,
8928 rcu_dereference(bss->beacon_ies),
8929 cur_channel, false)) {
8930 ret = true;
8931 goto out;
8932 }
8933
8934 if (ieee80211_mgd_csa_present(sdata,
8935 rcu_dereference(bss->proberesp_ies),
8936 cur_channel, bss->proberesp_ecsa_stuck)) {
8937 ret = true;
8938 goto out;
8939 }
8940
8941 ret = false;
8942out:
8943 rcu_read_unlock();
8944 return ret;
8945}
8946
8ee0b202
BB		 8947static void ieee80211_parse_cfg_selectors(unsigned long *userspace_selectors,
8948 const u8 *supported_selectors,
8949 u8 supported_selectors_len)
8950{
8951 if (supported_selectors) {
8952 for (int i = 0; i < supported_selectors_len; i++) {
8953 set_bit(supported_selectors[i],
8954 userspace_selectors);
8955 }
8956 } else {
8957 /* Assume SAE_H2E support for backward compatibility. */
8958 set_bit(BSS_MEMBERSHIP_SELECTOR_SAE_H2E,
8959 userspace_selectors);
8960 }
8961}
8962
77fdaa12
JB		 8963/* config hooks */
8964int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
8965 struct cfg80211_auth_request *req)
9c6bd790 8966{
66e67e41
JB		 8967 struct ieee80211_local *local = sdata->local;
8968 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
8969 struct ieee80211_mgd_auth_data *auth_data;
310c8387 8970 struct ieee80211_conn_settings conn;
0f99f087 8971 struct ieee80211_link_data *link;
310c8387
JB		 8972 struct ieee80211_supported_band *sband;
8973 struct ieee80211_bss *bss;
77fdaa12 8974 u16 auth_alg;
66e67e41 8975 int err;
310c8387 8976 bool cont_auth, wmm_used;
66e67e41 8977
0cd8080e
JB		 8978 lockdep_assert_wiphy(sdata->local->hw.wiphy);
8979
66e67e41 8980 /* prepare auth data structure */
9c6bd790 8981
77fdaa12
JB		 8982 switch (req->auth_type) {
8983 case NL80211_AUTHTYPE_OPEN_SYSTEM:
8984 auth_alg = WLAN_AUTH_OPEN;
8985 break;
8986 case NL80211_AUTHTYPE_SHARED_KEY:
5fdb3735 8987 if (fips_enabled)
9dca9c49 8988 return -EOPNOTSUPP;
77fdaa12
JB		 8989 auth_alg = WLAN_AUTH_SHARED_KEY;
8990 break;
8991 case NL80211_AUTHTYPE_FT:
8992 auth_alg = WLAN_AUTH_FT;
8993 break;
8994 case NL80211_AUTHTYPE_NETWORK_EAP:
8995 auth_alg = WLAN_AUTH_LEAP;
8996 break;
6b8ece3a
JM		 8997 case NL80211_AUTHTYPE_SAE:
8998 auth_alg = WLAN_AUTH_SAE;
8999 break;
dbc0c2cb
JM		 9000 case NL80211_AUTHTYPE_FILS_SK:
9001 auth_alg = WLAN_AUTH_FILS_SK;
9002 break;
9003 case NL80211_AUTHTYPE_FILS_SK_PFS:
9004 auth_alg = WLAN_AUTH_FILS_SK_PFS;
9005 break;
9006 case NL80211_AUTHTYPE_FILS_PK:
9007 auth_alg = WLAN_AUTH_FILS_PK;
9008 break;
77fdaa12
JB		 9009 default:
9010 return -EOPNOTSUPP;
60f8b39c 9011 }
77fdaa12 9012
efb543e6 9013 if (ifmgd->assoc_data)
8d7432a2
JM		 9014 return -EBUSY;
9015
35e2385d 9016 if (ieee80211_mgd_csa_in_process(sdata, req->bss)) {
c09c4f31
AB		 9017 sdata_info(sdata, "AP is in CSA process, reject auth\n");
9018 return -EINVAL;
9019 }
c09c4f31 9020
11b6b5a4 9021 auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
6b8ece3a 9022 req->ie_len, GFP_KERNEL);
66e67e41 9023 if (!auth_data)
9c6bd790 9024 return -ENOMEM;
77fdaa12 9025
81151ce4
JB		 9026 memcpy(auth_data->ap_addr,
9027 req->ap_mld_addr ?: req->bss->bssid,
9028 ETH_ALEN);
66e67e41 9029 auth_data->bss = req->bss;
85176a3f 9030 auth_data->link_id = req->link_id;
77fdaa12 9031
11b6b5a4 9032 if (req->auth_data_len >= 4) {
6ec63612
JM		 9033 if (req->auth_type == NL80211_AUTHTYPE_SAE) {
9034 __le16 *pos = (__le16 *) req->auth_data;
9035
9036 auth_data->sae_trans = le16_to_cpu(pos[0]);
9037 auth_data->sae_status = le16_to_cpu(pos[1]);
9038 }
11b6b5a4
JM		 9039 memcpy(auth_data->data, req->auth_data + 4,
9040 req->auth_data_len - 4);
9041 auth_data->data_len += req->auth_data_len - 4;
6b8ece3a
JM		 9042 }
9043
efb543e6
JM		 9044 /* Check if continuing authentication or trying to authenticate with the
9045 * same BSS that we were in the process of authenticating with and avoid
9046 * removal and re-addition of the STA entry in
9047 * ieee80211_prep_connection().
9048 */
85176a3f
JB		 9049 cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss &&
9050 ifmgd->auth_data->link_id == req->link_id;
efb543e6 9051
77fdaa12 9052 if (req->ie && req->ie_len) {
6b8ece3a
JM		 9053 memcpy(&auth_data->data[auth_data->data_len],
9054 req->ie, req->ie_len);
9055 auth_data->data_len += req->ie_len;
9c6bd790 9056 }
77fdaa12 9057
fffd0934 9058 if (req->key && req->key_len) {
66e67e41
JB		 9059 auth_data->key_len = req->key_len;
9060 auth_data->key_idx = req->key_idx;
9061 memcpy(auth_data->key, req->key, req->key_len);
fffd0934
JB		 9062 }
9063
8ee0b202
BB		 9064 ieee80211_parse_cfg_selectors(auth_data->userspace_selectors,
9065 req->supported_selectors,
9066 req->supported_selectors_len);
9067
66e67e41 9068 auth_data->algorithm = auth_alg;
60f8b39c 9069
66e67e41 9070 /* try to authenticate/probe */
2a33bee2 9071
efb543e6
JM		 9072 if (ifmgd->auth_data) {
9073 if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
9074 auth_data->peer_confirmed =
9075 ifmgd->auth_data->peer_confirmed;
9076 }
9077 ieee80211_destroy_auth_data(sdata, cont_auth);
9078 }
2a33bee2 9079
66e67e41
JB		 9080 /* prep auth_data so we don't go into idle on disassoc */
9081 ifmgd->auth_data = auth_data;
af6b6374 9082
efb543e6
JM		 9083 /* If this is continuation of an ongoing SAE authentication exchange
9084 * (i.e., request to send SAE Confirm) and the peer has already
9085 * confirmed, mark authentication completed since we are about to send
9086 * out SAE Confirm.
9087 */
9088 if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
9089 auth_data->peer_confirmed && auth_data->sae_trans == 2)
a857c21e 9090 ieee80211_mark_sta_auth(sdata);
efb543e6 9091
7b119dc0
JB		 9092 if (ifmgd->associated) {
9093 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
9094
89f774e6
JB		 9095 sdata_info(sdata,
9096 "disconnect from AP %pM for new auth to %pM\n",
81151ce4 9097 sdata->vif.cfg.ap_addr, auth_data->ap_addr);
7b119dc0
JB		 9098 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
9099 WLAN_REASON_UNSPECIFIED,
9100 false, frame_buf);
9101
a90faa9d
EG		 9102 ieee80211_report_disconnect(sdata, frame_buf,
9103 sizeof(frame_buf), true,
3f8a39ff
JB		 9104 WLAN_REASON_UNSPECIFIED,
9105 false);
7b119dc0 9106 }
af6b6374 9107
4ca04ed3
JB		 9108 /* needed for transmitting the auth frame(s) properly */
9109 memcpy(sdata->vif.cfg.ap_addr, auth_data->ap_addr, ETH_ALEN);
9110
310c8387
JB		 9111 bss = (void *)req->bss->priv;
9112 wmm_used = bss->wmm_used && (local->hw.queues >= IEEE80211_NUM_ACS);
9113
9114 sband = local->hw.wiphy->bands[req->bss->channel->band];
9115
9116 ieee80211_determine_our_sta_mode_auth(sdata, sband, req, wmm_used,
9117 &conn);
9118
81151ce4 9119 err = ieee80211_prep_connection(sdata, req->bss, req->link_id,
310c8387 9120 req->ap_mld_addr, cont_auth,
8ee0b202
BB		 9121 &conn, false,
9122 auth_data->userspace_selectors);
a1cf775d 9123 if (err)
66e67e41 9124 goto err_clear;
af6b6374 9125
e1032281 9126 if (req->link_id >= 0)
0f99f087
IP		 9127 link = sdata_dereference(sdata->link[req->link_id], sdata);
9128 else
e1032281 9129 link = &sdata->deflink;
0f99f087
IP		 9130
9131 if (WARN_ON(!link)) {
9132 err = -ENOLINK;
9133 goto err_clear;
9134 }
9135
9136 sdata_info(sdata, "authenticate with %pM (local address=%pM)\n",
9137 auth_data->ap_addr, link->conf->addr);
9138
46cad4b7 9139 err = ieee80211_auth(sdata);
66e67e41 9140 if (err) {
81151ce4 9141 sta_info_destroy_addr(sdata, auth_data->ap_addr);
66e67e41
JB		 9142 goto err_clear;
9143 }
9144
9145 /* hold our own reference */
5b112d3d 9146 cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
8d61ffa5 9147 return 0;
66e67e41
JB		 9148
9149 err_clear:
f1871abd 9150 if (!ieee80211_vif_is_mld(&sdata->vif)) {
81151ce4
JB		 9151 eth_zero_addr(sdata->deflink.u.mgd.bssid);
9152 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
9153 BSS_CHANGED_BSSID);
81151ce4 9154 ieee80211_link_release_channel(&sdata->deflink);
81151ce4 9155 }
66e67e41 9156 ifmgd->auth_data = NULL;
66e67e41 9157 kfree(auth_data);
66e67e41 9158 return err;
af6b6374
JB		 9159}
9160
310c8387 9161static void
1845c1d4
JB		 9162ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
9163 struct ieee80211_mgd_assoc_data *assoc_data,
9164 struct cfg80211_assoc_request *req,
310c8387 9165 struct ieee80211_conn_settings *conn,
81151ce4 9166 unsigned int link_id)
1845c1d4
JB		 9167{
9168 struct ieee80211_local *local = sdata->local;
90668e32 9169 const struct cfg80211_bss_ies *bss_ies;
1845c1d4 9170 struct ieee80211_supported_band *sband;
81151ce4
JB		 9171 struct ieee80211_link_data *link;
9172 struct cfg80211_bss *cbss;
9173 struct ieee80211_bss *bss;
1845c1d4 9174
81151ce4
JB		 9175 cbss = assoc_data->link[link_id].bss;
9176 if (WARN_ON(!cbss))
310c8387 9177 return;
81151ce4
JB		 9178
9179 bss = (void *)cbss->priv;
9180
1845c1d4
JB		 9181 sband = local->hw.wiphy->bands[cbss->channel->band];
9182 if (WARN_ON(!sband))
310c8387 9183 return;
81151ce4
JB		 9184
9185 link = sdata_dereference(sdata->link[link_id], sdata);
9186 if (WARN_ON(!link))
310c8387 9187 return;
1845c1d4 9188
81151ce4
JB		 9189 /* for MLO connections assume advertising all rates is OK */
9190 if (!req->ap_mld_addr) {
9191 assoc_data->supp_rates = bss->supp_rates;
9192 assoc_data->supp_rates_len = bss->supp_rates_len;
9193 }
9194
9195 /* copy and link elems for the STA profile */
9196 if (req->links[link_id].elems_len) {
9197 memcpy(assoc_data->ie_pos, req->links[link_id].elems,
9198 req->links[link_id].elems_len);
9199 assoc_data->link[link_id].elems = assoc_data->ie_pos;
9200 assoc_data->link[link_id].elems_len = req->links[link_id].elems_len;
9201 assoc_data->ie_pos += req->links[link_id].elems_len;
9202 }
1845c1d4 9203
1845c1d4
JB		 9204 link->u.mgd.beacon_crc_valid = false;
9205 link->u.mgd.dtim_period = 0;
9206 link->u.mgd.have_beacon = false;
9207
310c8387
JB		 9208 /* override HT configuration only if the AP and we support it */
9209 if (conn->mode >= IEEE80211_CONN_MODE_HT) {
1845c1d4
JB		 9210 struct ieee80211_sta_ht_cap sta_ht_cap;
9211
9212 memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
9213 ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
9214 }
9215
9216 rcu_read_lock();
90668e32
JB		 9217 bss_ies = rcu_dereference(cbss->beacon_ies);
9218 if (bss_ies) {
1845c1d4
JB		 9219 u8 dtim_count = 0;
9220
90668e32 9221 ieee80211_get_dtim(bss_ies, &dtim_count,
1845c1d4
JB		 9222 &link->u.mgd.dtim_period);
9223
9224 sdata->deflink.u.mgd.have_beacon = true;
9225
9226 if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
90668e32 9227 link->conf->sync_tsf = bss_ies->tsf;
1845c1d4
JB		 9228 link->conf->sync_device_ts = bss->device_ts_beacon;
9229 link->conf->sync_dtim_count = dtim_count;
9230 }
90668e32
JB		 9231 } else {
9232 bss_ies = rcu_dereference(cbss->ies);
9233 }
9234
9235 if (bss_ies) {
90668e32 9236 const struct element *elem;
1845c1d4
JB		 9237
9238 elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
90668e32 9239 bss_ies->data, bss_ies->len);
1845c1d4
JB		 9240 if (elem && elem->datalen >= 3)
9241 link->conf->profile_periodicity = elem->data[2];
9242 else
9243 link->conf->profile_periodicity = 0;
9244
9245 elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
90668e32 9246 bss_ies->data, bss_ies->len);
1845c1d4
JB		 9247 if (elem && elem->datalen >= 11 &&
9248 (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
9249 link->conf->ema_ap = true;
9250 else
9251 link->conf->ema_ap = false;
9252 }
9253 rcu_read_unlock();
9254
9255 if (bss->corrupt_data) {
9256 char *corrupt_type = "data";
9257
9258 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
9259 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
9260 corrupt_type = "beacon and probe response";
9261 else
9262 corrupt_type = "beacon";
9263 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) {
9264 corrupt_type = "probe response";
9265 }
9266 sdata_info(sdata, "associating to AP %pM with corrupt %s\n",
9267 cbss->bssid, corrupt_type);
9268 }
9269
9270 if (link->u.mgd.req_smps == IEEE80211_SMPS_AUTOMATIC) {
9271 if (sdata->u.mgd.powersave)
9272 link->smps_mode = IEEE80211_SMPS_DYNAMIC;
9273 else
9274 link->smps_mode = IEEE80211_SMPS_OFF;
9275 } else {
9276 link->smps_mode = link->u.mgd.req_smps;
9277 }
1845c1d4
JB		 9278}
9279
7d8b0259
JB		 9280static int
9281ieee80211_mgd_get_ap_ht_vht_capa(struct ieee80211_sub_if_data *sdata,
9282 struct ieee80211_mgd_assoc_data *assoc_data,
9283 int link_id)
9284{
9285 struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
9286 enum nl80211_band band = cbss->channel->band;
9287 struct ieee80211_supported_band *sband;
9288 const struct element *elem;
9289 int err;
9290
9291 /* neither HT nor VHT elements used on 6 GHz */
9292 if (band == NL80211_BAND_6GHZ)
9293 return 0;
9294
9295 if (assoc_data->link[link_id].conn.mode < IEEE80211_CONN_MODE_HT)
9296 return 0;
9297
9298 rcu_read_lock();
9299 elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_OPERATION);
9300 if (!elem || elem->datalen < sizeof(struct ieee80211_ht_operation)) {
9301 mlme_link_id_dbg(sdata, link_id, "no HT operation on BSS %pM\n",
9302 cbss->bssid);
9303 err = -EINVAL;
9304 goto out_rcu;
9305 }
9306 assoc_data->link[link_id].ap_ht_param =
9307 ((struct ieee80211_ht_operation *)(elem->data))->ht_param;
9308 rcu_read_unlock();
9309
9310 if (assoc_data->link[link_id].conn.mode < IEEE80211_CONN_MODE_VHT)
9311 return 0;
9312
9313 /* some drivers want to support VHT on 2.4 GHz even */
9314 sband = sdata->local->hw.wiphy->bands[band];
9315 if (!sband->vht_cap.vht_supported)
9316 return 0;
9317
9318 rcu_read_lock();
9319 elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
9320 /* but even then accept it not being present on the AP */
9321 if (!elem && band == NL80211_BAND_2GHZ) {
9322 err = 0;
9323 goto out_rcu;
9324 }
9325 if (!elem || elem->datalen < sizeof(struct ieee80211_vht_cap)) {
9326 mlme_link_id_dbg(sdata, link_id, "no VHT capa on BSS %pM\n",
9327 cbss->bssid);
9328 err = -EINVAL;
9329 goto out_rcu;
9330 }
9331 memcpy(&assoc_data->link[link_id].ap_vht_cap, elem->data,
9332 sizeof(struct ieee80211_vht_cap));
9333 rcu_read_unlock();
9334
9335 return 0;
9336out_rcu:
9337 rcu_read_unlock();
9338 return err;
9339}
9340
77fdaa12
JB		 9341int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
9342 struct cfg80211_assoc_request *req)
f0706e82 9343{
81151ce4 9344 unsigned int assoc_link_id = req->link_id < 0 ? 0 : req->link_id;
66e67e41 9345 struct ieee80211_local *local = sdata->local;
77fdaa12 9346 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
66e67e41 9347 struct ieee80211_mgd_assoc_data *assoc_data;
35e2385d 9348 const struct element *ssid_elem;
81151ce4 9349 struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
81151ce4
JB		 9350 struct ieee80211_link_data *link;
9351 struct cfg80211_bss *cbss;
310c8387
JB		 9352 bool override, uapsd_supported;
9353 bool match_auth;
81151ce4
JB		 9354 int i, err;
9355 size_t size = sizeof(*assoc_data) + req->ie_len;
9356
9357 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++)
9358 size += req->links[i].elems_len;
9359
90703ba9
JB		 9360 /* FIXME: no support for 4-addr MLO yet */
9361 if (sdata->u.mgd.use_4addr && req->link_id >= 0)
9362 return -EOPNOTSUPP;
9363
81151ce4 9364 assoc_data = kzalloc(size, GFP_KERNEL);
66e67e41
JB		 9365 if (!assoc_data)
9366 return -ENOMEM;
9367
81151ce4
JB		 9368 cbss = req->link_id < 0 ? req->bss : req->links[req->link_id].bss;
9369
35e2385d
JB		 9370 if (ieee80211_mgd_csa_in_process(sdata, cbss)) {
9371 sdata_info(sdata, "AP is in CSA process, reject assoc\n");
310c8387
JB		 9372 err = -EINVAL;
9373 goto err_free;
9caf0364 9374 }
c09c4f31 9375
35e2385d
JB		 9376 rcu_read_lock();
9377 ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
9378 if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) {
c09c4f31 9379 rcu_read_unlock();
310c8387
JB		 9380 err = -EINVAL;
9381 goto err_free;
c09c4f31
AB		 9382 }
9383
f2622138
JB		 9384 memcpy(assoc_data->ssid, ssid_elem->data, ssid_elem->datalen);
9385 assoc_data->ssid_len = ssid_elem->datalen;
9caf0364
JB		 9386 rcu_read_unlock();
9387
310c8387
JB		 9388 if (req->ap_mld_addr)
9389 memcpy(assoc_data->ap_addr, req->ap_mld_addr, ETH_ALEN);
9390 else
9391 memcpy(assoc_data->ap_addr, cbss->bssid, ETH_ALEN);
81151ce4 9392
96d4311c
JB		 9393 assoc_data->ext_mld_capa_ops = cpu_to_le16(req->ext_mld_capa_ops);
9394
7b119dc0
JB		 9395 if (ifmgd->associated) {
9396 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
9397
89f774e6
JB		 9398 sdata_info(sdata,
9399 "disconnect from AP %pM for new assoc to %pM\n",
81151ce4 9400 sdata->vif.cfg.ap_addr, assoc_data->ap_addr);
7b119dc0
JB		 9401 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
9402 WLAN_REASON_UNSPECIFIED,
9403 false, frame_buf);
9404
a90faa9d
EG		 9405 ieee80211_report_disconnect(sdata, frame_buf,
9406 sizeof(frame_buf), true,
3f8a39ff
JB		 9407 WLAN_REASON_UNSPECIFIED,
9408 false);
7b119dc0 9409 }
66e67e41 9410
80834e7d
JB		 9411 memset(sdata->u.mgd.userspace_selectors, 0,
9412 sizeof(sdata->u.mgd.userspace_selectors));
9413 ieee80211_parse_cfg_selectors(sdata->u.mgd.userspace_selectors,
8ee0b202
BB		 9414 req->supported_selectors,
9415 req->supported_selectors_len);
9416
310c8387
JB		 9417 memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
9418 memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
9419 sizeof(ifmgd->ht_capa_mask));
77fdaa12 9420
310c8387
JB		 9421 memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
9422 memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
9423 sizeof(ifmgd->vht_capa_mask));
77fdaa12 9424
310c8387
JB		 9425 memcpy(&ifmgd->s1g_capa, &req->s1g_capa, sizeof(ifmgd->s1g_capa));
9426 memcpy(&ifmgd->s1g_capa_mask, &req->s1g_capa_mask,
9427 sizeof(ifmgd->s1g_capa_mask));
66e67e41 9428
310c8387 9429 /* keep some setup (AP STA, channel, ...) if matching */
01ad6b7b
JB		 9430 match_auth = ifmgd->auth_data &&
9431 ether_addr_equal(ifmgd->auth_data->ap_addr,
9432 assoc_data->ap_addr) &&
9433 ifmgd->auth_data->link_id == req->link_id;
6b398f1c 9434
310c8387
JB		 9435 if (req->ap_mld_addr) {
9436 uapsd_supported = true;
2a33bee2 9437
0dfedd48
BB		 9438 if (req->flags & (ASSOC_REQ_DISABLE_HT |
9439 ASSOC_REQ_DISABLE_VHT |
9440 ASSOC_REQ_DISABLE_HE |
9441 ASSOC_REQ_DISABLE_EHT)) {
9442 err = -EINVAL;
9443 goto err_free;
9444 }
9445
310c8387
JB		 9446 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
9447 struct ieee80211_supported_band *sband;
9448 struct cfg80211_bss *link_cbss = req->links[i].bss;
9449 struct ieee80211_bss *bss;
095d81ce 9450
310c8387
JB		 9451 if (!link_cbss)
9452 continue;
095d81ce 9453
310c8387 9454 bss = (void *)link_cbss->priv;
3b220ed8 9455
310c8387
JB		 9456 if (!bss->wmm_used) {
9457 err = -EINVAL;
0dfedd48 9458 req->links[i].error = err;
310c8387
JB		 9459 goto err_free;
9460 }
9461
9462 if (link_cbss->channel->band == NL80211_BAND_S1GHZ) {
9463 err = -EINVAL;
0dfedd48 9464 req->links[i].error = err;
310c8387
JB		 9465 goto err_free;
9466 }
9467
9468 link = sdata_dereference(sdata->link[i], sdata);
9469 if (link)
9470 ether_addr_copy(assoc_data->link[i].addr,
9471 link->conf->addr);
9472 else
9473 eth_random_addr(assoc_data->link[i].addr);
9474 sband = local->hw.wiphy->bands[link_cbss->channel->band];
9475
2a705bc3 9476 if (match_auth && i == assoc_link_id && link)
310c8387
JB		 9477 assoc_data->link[i].conn = link->u.mgd.conn;
9478 else
9479 assoc_data->link[i].conn =
9480 ieee80211_conn_settings_unlimited;
9481 ieee80211_determine_our_sta_mode_assoc(sdata, sband,
9482 req, true, i,
9483 &assoc_data->link[i].conn);
9484 assoc_data->link[i].bss = link_cbss;
9485 assoc_data->link[i].disabled = req->links[i].disabled;
9486
9487 if (!bss->uapsd_supported)
9488 uapsd_supported = false;
9489
9490 if (assoc_data->link[i].conn.mode < IEEE80211_CONN_MODE_EHT) {
9491 err = -EINVAL;
9492 req->links[i].error = err;
9493 goto err_free;
9494 }
7d8b0259
JB		 9495
9496 err = ieee80211_mgd_get_ap_ht_vht_capa(sdata,
9497 assoc_data, i);
9498 if (err) {
9499 err = -EINVAL;
9500 req->links[i].error = err;
9501 goto err_free;
9502 }
1c4cb928 9503 }
77fdaa12 9504
310c8387
JB		 9505 assoc_data->wmm = true;
9506 } else {
9507 struct ieee80211_supported_band *sband;
9508 struct ieee80211_bss *bss = (void *)cbss->priv;
d545daba 9509
310c8387
JB		 9510 memcpy(assoc_data->link[0].addr, sdata->vif.addr, ETH_ALEN);
9511 assoc_data->s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
1845c1d4 9512
310c8387
JB		 9513 assoc_data->wmm = bss->wmm_used &&
9514 (local->hw.queues >= IEEE80211_NUM_ACS);
9515
9516 if (cbss->channel->band == NL80211_BAND_6GHZ &&
9517 req->flags & (ASSOC_REQ_DISABLE_HT |
9518 ASSOC_REQ_DISABLE_VHT |
9519 ASSOC_REQ_DISABLE_HE)) {
9520 err = -EINVAL;
9521 goto err_free;
9522 }
9523
9524 sband = local->hw.wiphy->bands[cbss->channel->band];
9525
9526 assoc_data->link[0].bss = cbss;
9527
9528 if (match_auth)
9529 assoc_data->link[0].conn = sdata->deflink.u.mgd.conn;
9530 else
9531 assoc_data->link[0].conn =
9532 ieee80211_conn_settings_unlimited;
9533 ieee80211_determine_our_sta_mode_assoc(sdata, sband, req,
9534 assoc_data->wmm, 0,
9535 &assoc_data->link[0].conn);
1845c1d4 9536
310c8387 9537 uapsd_supported = bss->uapsd_supported;
7d8b0259
JB		 9538
9539 err = ieee80211_mgd_get_ap_ht_vht_capa(sdata, assoc_data, 0);
9540 if (err)
9541 goto err_free;
1845c1d4
JB		 9542 }
9543
310c8387 9544 assoc_data->spp_amsdu = req->flags & ASSOC_REQ_SPP_AMSDU;
81151ce4 9545
310c8387
JB		 9546 if (ifmgd->auth_data && !ifmgd->auth_data->done) {
9547 err = -EBUSY;
9548 goto err_free;
9549 }
ef96a842 9550
310c8387
JB		 9551 if (ifmgd->assoc_data) {
9552 err = -EBUSY;
9553 goto err_free;
9554 }
dd5ecfea 9555
310c8387
JB		 9556 /* Cleanup is delayed if auth_data matches */
9557 if (ifmgd->auth_data && !match_auth)
9558 ieee80211_destroy_auth_data(sdata, false);
7957c6c8 9559
77fdaa12 9560 if (req->ie && req->ie_len) {
66e67e41
JB		 9561 memcpy(assoc_data->ie, req->ie, req->ie_len);
9562 assoc_data->ie_len = req->ie_len;
81151ce4
JB		 9563 assoc_data->ie_pos = assoc_data->ie + assoc_data->ie_len;
9564 } else {
9565 assoc_data->ie_pos = assoc_data->ie;
66e67e41 9566 }
f679f65d 9567
39404fee
JM		 9568 if (req->fils_kek) {
9569 /* should already be checked in cfg80211 - so warn */
9570 if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
9571 err = -EINVAL;
9572 goto err_free;
9573 }
9574 memcpy(assoc_data->fils_kek, req->fils_kek,
9575 req->fils_kek_len);
9576 assoc_data->fils_kek_len = req->fils_kek_len;
9577 }
9578
9579 if (req->fils_nonces)
9580 memcpy(assoc_data->fils_nonces, req->fils_nonces,
9581 2 * FILS_NONCE_LEN);
9582
1845c1d4
JB		 9583 /* default timeout */
9584 assoc_data->timeout = jiffies;
9585 assoc_data->timeout_started = true;
9586
81151ce4
JB		 9587 assoc_data->assoc_link_id = assoc_link_id;
9588
9589 if (req->ap_mld_addr) {
81151ce4 9590 /* if there was no authentication, set up the link */
6d543b34 9591 err = ieee80211_vif_set_links(sdata, BIT(assoc_link_id), 0);
81151ce4
JB		 9592 if (err)
9593 goto err_clear;
81151ce4
JB		 9594 }
9595
9596 link = sdata_dereference(sdata->link[assoc_link_id], sdata);
9597 if (WARN_ON(!link)) {
9598 err = -EINVAL;
9599 goto err_clear;
9600 }
9601
310c8387
JB		 9602 override = link->u.mgd.conn.mode !=
9603 assoc_data->link[assoc_link_id].conn.mode ||
9604 link->u.mgd.conn.bw_limit !=
9605 assoc_data->link[assoc_link_id].conn.bw_limit;
9606 link->u.mgd.conn = assoc_data->link[assoc_link_id].conn;
9607
9608 ieee80211_setup_assoc_link(sdata, assoc_data, req, &link->u.mgd.conn,
9609 assoc_link_id);
63f170e0 9610
848955cc 9611 if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
30686bf7 9612 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
848955cc
JB		 9613 "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
9614 sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
9615
310c8387 9616 if (assoc_data->wmm && uapsd_supported &&
848955cc 9617 (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
76f0303d 9618 assoc_data->uapsd = true;
ab13315a
KV		 9619 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
9620 } else {
76f0303d 9621 assoc_data->uapsd = false;
ab13315a
KV		 9622 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
9623 }
9624
77fdaa12 9625 if (req->prev_bssid)
81151ce4 9626 memcpy(assoc_data->prev_ap_addr, req->prev_bssid, ETH_ALEN);
77fdaa12
JB		 9627
9628 if (req->use_mfp) {
9629 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
9630 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
9631 } else {
9632 ifmgd->mfp = IEEE80211_MFP_DISABLED;
9633 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
9634 }
9635
cd2f5dd7
AK		 9636 if (req->flags & ASSOC_REQ_USE_RRM)
9637 ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
9638 else
9639 ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
9640
77fdaa12
JB		 9641 if (req->crypto.control_port)
9642 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
9643 else
9644 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
9645
a621fa4d
JB		 9646 sdata->control_port_protocol = req->crypto.control_port_ethertype;
9647 sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
018f6fbf
DK		 9648 sdata->control_port_over_nl80211 =
9649 req->crypto.control_port_over_nl80211;
7f3f96ce 9650 sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
a621fa4d 9651
66e67e41 9652 /* kick off associate process */
66e67e41 9653 ifmgd->assoc_data = assoc_data;
b6db0f89 9654
81151ce4
JB		 9655 for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
9656 if (!assoc_data->link[i].bss)
9657 continue;
9658 if (i == assoc_data->assoc_link_id)
9659 continue;
310c8387
JB		 9660 /* only calculate the mode, hence link == NULL */
9661 err = ieee80211_prep_channel(sdata, NULL, i,
1228c749 9662 assoc_data->link[i].bss, true,
8ee0b202 9663 &assoc_data->link[i].conn,
80834e7d 9664 sdata->u.mgd.userspace_selectors);
4aa06448
BB		 9665 if (err) {
9666 req->links[i].error = err;
81151ce4 9667 goto err_clear;
4aa06448 9668 }
81151ce4 9669 }
1ca98016 9670
310c8387
JB		 9671 memcpy(vif_cfg->ssid, assoc_data->ssid, assoc_data->ssid_len);
9672 vif_cfg->ssid_len = assoc_data->ssid_len;
9673
4ca04ed3
JB		 9674 /* needed for transmitting the assoc frames properly */
9675 memcpy(sdata->vif.cfg.ap_addr, assoc_data->ap_addr, ETH_ALEN);
9676
81151ce4 9677 err = ieee80211_prep_connection(sdata, cbss, req->link_id,
310c8387
JB		 9678 req->ap_mld_addr, true,
9679 &assoc_data->link[assoc_link_id].conn,
8ee0b202 9680 override,
80834e7d 9681 sdata->u.mgd.userspace_selectors);
a1cf775d
JB		 9682 if (err)
9683 goto err_clear;
66e67e41 9684
74e1309a
JB		 9685 if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC)) {
9686 const struct cfg80211_bss_ies *beacon_ies;
826262c3 9687
74e1309a
JB		 9688 rcu_read_lock();
9689 beacon_ies = rcu_dereference(req->bss->beacon_ies);
a0b4f229 9690 if (!beacon_ies) {
74e1309a
JB		 9691 /*
9692 * Wait up to one beacon interval ...
9693 * should this be more if we miss one?
9694 */
9695 sdata_info(sdata, "waiting for beacon from %pM\n",
9696 link->u.mgd.bssid);
9697 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
9698 assoc_data->timeout_started = true;
9699 assoc_data->need_beacon = true;
9700 }
9701 rcu_read_unlock();
66e67e41 9702 }
c65dd147 9703
8d61ffa5 9704 run_again(sdata, assoc_data->timeout);
66e67e41 9705
6b398f1c
BB		 9706 /* We are associating, clean up auth_data */
9707 if (ifmgd->auth_data)
9708 ieee80211_destroy_auth_data(sdata, true);
9709
8d61ffa5 9710 return 0;
66e67e41 9711 err_clear:
6b398f1c
BB		 9712 if (!ifmgd->auth_data) {
9713 eth_zero_addr(sdata->deflink.u.mgd.bssid);
9714 ieee80211_link_info_change_notify(sdata, &sdata->deflink,
9715 BSS_CHANGED_BSSID);
9716 }
66e67e41
JB		 9717 ifmgd->assoc_data = NULL;
9718 err_free:
9719 kfree(assoc_data);
66e67e41 9720 return err;
f0706e82
JB		 9721}
9722
77fdaa12 9723int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
63c9c5e7 9724 struct cfg80211_deauth_request *req)
f0706e82 9725{
46900298 9726 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6ae16775 9727 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6863255b 9728 bool tx = !req->local_state_change;
15fae341
JB		 9729 struct ieee80211_prep_tx_info info = {
9730 .subtype = IEEE80211_STYPE_DEAUTH,
9731 };
f0706e82 9732
c9c3a060 9733 if (ifmgd->auth_data &&
81151ce4 9734 ether_addr_equal(ifmgd->auth_data->ap_addr, req->bssid)) {
c9c3a060
JB		 9735 sdata_info(sdata,
9736 "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
9737 req->bssid, req->reason_code,
9738 ieee80211_get_reason_code_string(req->reason_code));
0ff71613 9739
e76f3b4a 9740 info.link_id = ifmgd->auth_data->link_id;
15fae341 9741 drv_mgd_prepare_tx(sdata->local, sdata, &info);
4b08d1b6 9742 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
37ad3888 9743 IEEE80211_STYPE_DEAUTH,
6863255b 9744 req->reason_code, tx,
37ad3888 9745 frame_buf);
86552017 9746 ieee80211_destroy_auth_data(sdata, false);
a90faa9d
EG		 9747 ieee80211_report_disconnect(sdata, frame_buf,
9748 sizeof(frame_buf), true,
3f8a39ff 9749 req->reason_code, false);
15fae341 9750 drv_mgd_complete_tx(sdata->local, sdata, &info);
c9c3a060 9751 return 0;
8c7d857c
EG		 9752 }
9753
a64cba3c 9754 if (ifmgd->assoc_data &&
81151ce4 9755 ether_addr_equal(ifmgd->assoc_data->ap_addr, req->bssid)) {
a64cba3c
AO		 9756 sdata_info(sdata,
9757 "aborting association with %pM by local choice (Reason: %u=%s)\n",
9758 req->bssid, req->reason_code,
9759 ieee80211_get_reason_code_string(req->reason_code));
9760
e76f3b4a 9761 info.link_id = ifmgd->assoc_data->assoc_link_id;
15fae341 9762 drv_mgd_prepare_tx(sdata->local, sdata, &info);
4b08d1b6 9763 ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
a64cba3c
AO		 9764 IEEE80211_STYPE_DEAUTH,
9765 req->reason_code, tx,
9766 frame_buf);
afa2d659 9767 ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
a64cba3c
AO		 9768 ieee80211_report_disconnect(sdata, frame_buf,
9769 sizeof(frame_buf), true,
3f8a39ff 9770 req->reason_code, false);
c042600c 9771 drv_mgd_complete_tx(sdata->local, sdata, &info);
a64cba3c
AO		 9772 return 0;
9773 }
9774
86552017 9775 if (ifmgd->associated &&
b65567b0 9776 ether_addr_equal(sdata->vif.cfg.ap_addr, req->bssid)) {
c9c3a060
JB		 9777 sdata_info(sdata,
9778 "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
9779 req->bssid, req->reason_code,
9780 ieee80211_get_reason_code_string(req->reason_code));
9781
86552017
JB		 9782 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
9783 req->reason_code, tx, frame_buf);
a90faa9d
EG		 9784 ieee80211_report_disconnect(sdata, frame_buf,
9785 sizeof(frame_buf), true,
3f8a39ff 9786 req->reason_code, false);
c9c3a060
JB		 9787 return 0;
9788 }
86552017 9789
c9c3a060 9790 return -ENOTCONN;
f0706e82 9791}
84363e6e 9792
77fdaa12 9793int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
63c9c5e7 9794 struct cfg80211_disassoc_request *req)
9c6bd790 9795{
6ae16775 9796 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
9c6bd790 9797
8f6e0dfc
JB		 9798 if (!sdata->u.mgd.associated ||
9799 memcmp(sdata->vif.cfg.ap_addr, req->ap_addr, ETH_ALEN))
9800 return -ENOTCONN;
77fdaa12 9801
bdcbd8e0 9802 sdata_info(sdata,
dfa1ad29 9803 "disassociating from %pM by local choice (Reason: %u=%s)\n",
8f6e0dfc
JB		 9804 req->ap_addr, req->reason_code,
9805 ieee80211_get_reason_code_string(req->reason_code));
0ff71613 9806
37ad3888
JB		 9807 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
9808 req->reason_code, !req->local_state_change,
9809 frame_buf);
10f644a4 9810
a90faa9d 9811 ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
3f8a39ff 9812 req->reason_code, false);
bc83b681 9813
10f644a4
JB		 9814 return 0;
9815}
026331c4 9816
b2e8434f
JB		 9817void ieee80211_mgd_stop_link(struct ieee80211_link_data *link)
9818{
1444f589
JB		 9819 wiphy_work_cancel(link->sdata->local->hw.wiphy,
9820 &link->u.mgd.request_smps_work);
e3640a82
JB		 9821 wiphy_work_cancel(link->sdata->local->hw.wiphy,
9822 &link->u.mgd.recalc_smps);
ec3252bf 9823 wiphy_delayed_work_cancel(link->sdata->local->hw.wiphy,
344d18ce 9824 &link->u.mgd.csa.switch_work);
b2e8434f
JB		 9825}
9826
afa762f6 9827void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
54e4ffb2
JB		 9828{
9829 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
9830
49921859
BG		 9831 /*
9832 * Make sure some work items will not run after this,
9833 * they will not do anything but might not have been
9834 * cancelled when disconnecting.
9835 */
ac2f7d6f
JB		 9836 wiphy_work_cancel(sdata->local->hw.wiphy,
9837 &ifmgd->monitor_work);
4b8d43f1
JB		 9838 wiphy_work_cancel(sdata->local->hw.wiphy,
9839 &ifmgd->beacon_connection_loss_work);
9840 wiphy_work_cancel(sdata->local->hw.wiphy,
9841 &ifmgd->csa_connection_drop_work);
777b2600
JB		 9842 wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
9843 &ifmgd->tdls_peer_del_work);
49921859 9844
afa2d659
JB		 9845 if (ifmgd->assoc_data)
9846 ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
54e4ffb2
JB		 9847 if (ifmgd->auth_data)
9848 ieee80211_destroy_auth_data(sdata, false);
1277b4a9
LK		 9849 spin_lock_bh(&ifmgd->teardown_lock);
9850 if (ifmgd->teardown_skb) {
9851 kfree_skb(ifmgd->teardown_skb);
9852 ifmgd->teardown_skb = NULL;
9853 ifmgd->orig_teardown_skb = NULL;
9854 }
4d9ec73d
JM		 9855 kfree(ifmgd->assoc_req_ies);
9856 ifmgd->assoc_req_ies = NULL;
9857 ifmgd->assoc_req_ies_len = 0;
1277b4a9 9858 spin_unlock_bh(&ifmgd->teardown_lock);
8fa7292f 9859 timer_delete_sync(&ifmgd->timer);
54e4ffb2
JB		 9860}
9861
a97c13c3
JO		 9862void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
9863 enum nl80211_cqm_rssi_threshold_event rssi_event,
769f07d8 9864 s32 rssi_level,
a97c13c3
JO		 9865 gfp_t gfp)
9866{
9867 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
9868
769f07d8 9869 trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
b5878a2d 9870
bee427b8 9871 cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
a97c13c3
JO		 9872}
9873EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
98f03342
JB		 9874
9875void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
9876{
9877 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
9878
9879 trace_api_cqm_beacon_loss_notify(sdata->local, sdata);
9880
9881 cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
9882}
9883EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);
f344c58c
JB		 9884
9885static void _ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data *sdata,
9886 int rssi_min_thold,
9887 int rssi_max_thold)
9888{
9889 trace_api_enable_rssi_reports(sdata, rssi_min_thold, rssi_max_thold);
9890
9891 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
9892 return;
9893
9894 /*
9895 * Scale up threshold values before storing it, as the RSSI averaging
9896 * algorithm uses a scaled up value as well. Change this scaling
9897 * factor if the RSSI averaging algorithm changes.
9898 */
9899 sdata->u.mgd.rssi_min_thold = rssi_min_thold*16;
9900 sdata->u.mgd.rssi_max_thold = rssi_max_thold*16;
9901}
9902
9903void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
9904 int rssi_min_thold,
9905 int rssi_max_thold)
9906{
9907 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
9908
9909 WARN_ON(rssi_min_thold == rssi_max_thold ||
9910 rssi_min_thold > rssi_max_thold);
9911
9912 _ieee80211_enable_rssi_reports(sdata, rssi_min_thold,
9913 rssi_max_thold);
9914}
9915EXPORT_SYMBOL(ieee80211_enable_rssi_reports);
9916
9917void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
9918{
9919 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
9920
9921 _ieee80211_enable_rssi_reports(sdata, 0, 0);
9922}
9923EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
36e05b0b 9924
36e05b0b
IP		 9925void ieee80211_process_ml_reconf_resp(struct ieee80211_sub_if_data *sdata,
9926 struct ieee80211_mgmt *mgmt, size_t len)
9927{
9928 struct ieee80211_local *local = sdata->local;
9929 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
9930 struct ieee80211_mgd_assoc_data *add_links_data =
9931 ifmgd->reconf.add_links_data;
9932 struct sta_info *sta;
9933 struct cfg80211_mlo_reconf_done_data done_data = {};
9934 u16 sta_changed_links = sdata->u.mgd.reconf.added_links |
9935 sdata->u.mgd.reconf.removed_links;
9936 u16 link_mask, valid_links;
9937 unsigned int link_id;
36e05b0b
IP		 9938 size_t orig_len = len;
9939 u8 i, group_key_data_len;
9940 u8 *pos;
9941
9942 if (!ieee80211_vif_is_mld(&sdata->vif) ||
9943 len < offsetofend(typeof(*mgmt), u.action.u.ml_reconf_resp) ||
9944 mgmt->u.action.u.ml_reconf_resp.dialog_token !=
9945 sdata->u.mgd.reconf.dialog_token ||
9946 !sta_changed_links)
9947 return;
9948
9949 pos = mgmt->u.action.u.ml_reconf_resp.variable;
9950 len -= offsetofend(typeof(*mgmt), u.action.u.ml_reconf_resp);
9951
9952 /* each status duple is 3 octets */
9953 if (len < mgmt->u.action.u.ml_reconf_resp.count * 3) {
9954 sdata_info(sdata,
9955 "mlo: reconf: unexpected len=%zu, count=%u\n",
9956 len, mgmt->u.action.u.ml_reconf_resp.count);
9957 goto disconnect;
9958 }
9959
9960 link_mask = sta_changed_links;
9961 for (i = 0; i < mgmt->u.action.u.ml_reconf_resp.count; i++) {
9962 u16 status = get_unaligned_le16(pos + 1);
9963
9964 link_id = *pos;
9965
9966 if (!(link_mask & BIT(link_id))) {
9967 sdata_info(sdata,
9968 "mlo: reconf: unexpected link: %u, changed=0x%x\n",
9969 link_id, sta_changed_links);
9970 goto disconnect;
9971 }
9972
9973 /* clear the corresponding link, to detect the case that
9974 * the same link was included more than one time
9975 */
9976 link_mask &= ~BIT(link_id);
9977
9978 /* Handle failure to remove links here. Failure to remove added
9979 * links will be done later in the flow.
9980 */
9981 if (status != WLAN_STATUS_SUCCESS) {
9982 sdata_info(sdata,
9983 "mlo: reconf: failed on link=%u, status=%u\n",
9984 link_id, status);
9985
9986 /* The AP MLD failed to remove a link that was already
9987 * removed locally. As this is not expected behavior,
9988 * disconnect
9989 */
9990 if (sdata->u.mgd.reconf.removed_links & BIT(link_id))
9991 goto disconnect;
9992
9993 /* The AP MLD failed to add a link. Remove it from the
9994 * added links.
9995 */
9996 sdata->u.mgd.reconf.added_links &= ~BIT(link_id);
9997 }
9998
9999 pos += 3;
10000 len -= 3;
10001 }
10002
10003 if (link_mask) {
10004 sdata_info(sdata,
10005 "mlo: reconf: no response for links=0x%x\n",
10006 link_mask);
10007 goto disconnect;
10008 }
10009
10010 if (!sdata->u.mgd.reconf.added_links)
10011 goto out;
10012
10013 if (len < 1 || len < 1 + *pos) {
10014 sdata_info(sdata,
10015 "mlo: reconf: invalid group key data length");
10016 goto disconnect;
10017 }
10018
10019 /* The Group Key Data field must be present when links are added. This
10020 * field should be processed by userland.
10021 */
10022 group_key_data_len = *pos++;
10023
10024 pos += group_key_data_len;
10025 len -= group_key_data_len + 1;
10026
10027 /* Process the information for the added links */
10028 sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
10029 if (WARN_ON(!sta))
10030 goto disconnect;
10031
10032 valid_links = sdata->vif.valid_links;
10033 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
10034 if (!add_links_data->link[link_id].bss ||
10035 !(sdata->u.mgd.reconf.added_links & BIT(link_id)))
10036
10037 continue;
10038
10039 valid_links |= BIT(link_id);
10040 if (ieee80211_sta_allocate_link(sta, link_id))
10041 goto disconnect;
10042 }
10043
10044 ieee80211_vif_set_links(sdata, valid_links, sdata->vif.dormant_links);
36e05b0b
IP		 10045 link_mask = 0;
10046 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
10047 struct cfg80211_bss *cbss = add_links_data->link[link_id].bss;
10048 struct ieee80211_link_data *link;
10049 struct link_sta_info *link_sta;
10050 u64 changed = 0;
10051
10052 if (!cbss)
10053 continue;
10054
10055 link = sdata_dereference(sdata->link[link_id], sdata);
10056 if (WARN_ON(!link))
10057 goto disconnect;
10058
10059 link_info(link,
10060 "mlo: reconf: local address %pM, AP link address %pM\n",
10061 add_links_data->link[link_id].addr,
10062 add_links_data->link[link_id].bss->bssid);
10063
10064 link_sta = rcu_dereference_protected(sta->link[link_id],
10065 lockdep_is_held(&local->hw.wiphy->mtx));
10066 if (WARN_ON(!link_sta))
10067 goto disconnect;
10068
10069 if (!link->u.mgd.have_beacon) {
10070 const struct cfg80211_bss_ies *ies;
10071
10072 rcu_read_lock();
10073 ies = rcu_dereference(cbss->beacon_ies);
10074 if (ies)
10075 link->u.mgd.have_beacon = true;
10076 else
10077 ies = rcu_dereference(cbss->ies);
10078 ieee80211_get_dtim(ies,
10079 &link->conf->sync_dtim_count,
10080 &link->u.mgd.dtim_period);
10081 link->conf->beacon_int = cbss->beacon_interval;
10082 rcu_read_unlock();
10083 }
10084
10085 link->conf->dtim_period = link->u.mgd.dtim_period ?: 1;
10086
10087 link->u.mgd.conn = add_links_data->link[link_id].conn;
10088 if (ieee80211_prep_channel(sdata, link, link_id, cbss,
10089 true, &link->u.mgd.conn,
80834e7d 10090 sdata->u.mgd.userspace_selectors)) {
36e05b0b
IP		 10091 link_info(link, "mlo: reconf: prep_channel failed\n");
10092 goto disconnect;
10093 }
10094
10095 if (ieee80211_mgd_setup_link_sta(link, sta, link_sta,
10096 add_links_data->link[link_id].bss))
10097 goto disconnect;
10098
10099 if (!ieee80211_assoc_config_link(link, link_sta,
10100 add_links_data->link[link_id].bss,
10101 mgmt, pos, len,
10102 &changed))
10103 goto disconnect;
10104
10105 /* The AP MLD indicated success for this link, but the station
10106 * profile status indicated otherwise. Since there is an
10107 * inconsistency in the ML reconfiguration response, disconnect
10108 */
10109 if (add_links_data->link[link_id].status != WLAN_STATUS_SUCCESS)
10110 goto disconnect;
10111
10112 ieee80211_sta_init_nss(link_sta);
10113 if (ieee80211_sta_activate_link(sta, link_id))
10114 goto disconnect;
10115
10116 changed |= ieee80211_link_set_associated(link, cbss);
10117 ieee80211_link_info_change_notify(sdata, link, changed);
10118
10119 ieee80211_recalc_smps(sdata, link);
10120 link_mask |= BIT(link_id);
10121 }
10122
10123 sdata_info(sdata,
10124 "mlo: reconf: current valid_links=0x%x, added=0x%x\n",
10125 valid_links, link_mask);
10126
10127 /* links might have changed due to rejected ones, set them again */
10128 ieee80211_vif_set_links(sdata, valid_links, sdata->vif.dormant_links);
10129 ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_MLD_VALID_LINKS);
10130
10131 ieee80211_recalc_ps(local);
10132 ieee80211_recalc_ps_vif(sdata);
10133
10134 done_data.buf = (const u8 *)mgmt;
10135 done_data.len = orig_len;
10136 done_data.added_links = link_mask;
10137
2160998d 10138 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
36e05b0b 10139 done_data.links[link_id].bss = add_links_data->link[link_id].bss;
2160998d
IP		 10140 done_data.links[link_id].addr =
10141 add_links_data->link[link_id].addr;
10142 }
36e05b0b
IP		 10143
10144 cfg80211_mlo_reconf_add_done(sdata->dev, &done_data);
10145 kfree(sdata->u.mgd.reconf.add_links_data);
10146 sdata->u.mgd.reconf.add_links_data = NULL;
10147out:
10148 ieee80211_ml_reconf_reset(sdata);
10149 return;
10150
10151disconnect:
10152 __ieee80211_disconnect(sdata);
10153}
10154
10155static struct sk_buff *
10156ieee80211_build_ml_reconf_req(struct ieee80211_sub_if_data *sdata,
10157 struct ieee80211_mgd_assoc_data *add_links_data,
96d4311c 10158 u16 removed_links, __le16 ext_mld_capa_ops)
36e05b0b
IP		 10159{
10160 struct ieee80211_local *local = sdata->local;
10161 struct ieee80211_mgmt *mgmt;
10162 struct ieee80211_multi_link_elem *ml_elem;
10163 struct ieee80211_mle_basic_common_info *common;
10164 enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
10165 struct sk_buff *skb;
10166 size_t size;
10167 unsigned int link_id;
10168 __le16 eml_capa = 0, mld_capa_ops = 0;
10169 struct ieee80211_tx_info *info;
10170 u8 common_size, var_common_size;
10171 u8 *ml_elem_len;
10172 u16 capab = 0;
10173
10174 size = local->hw.extra_tx_headroom + sizeof(*mgmt);
10175
10176 /* Consider the maximal length of the reconfiguration ML element */
10177 size += sizeof(struct ieee80211_multi_link_elem);
10178
10179 /* The Basic ML element and the Reconfiguration ML element have the same
10180 * fixed common information fields in the context of ML reconfiguration
10181 * action frame. The AP MLD MAC address must always be present
10182 */
10183 common_size = sizeof(*common);
10184
10185 /* when adding links, the MLD capabilities must be present */
10186 var_common_size = 0;
10187 if (add_links_data) {
10188 const struct wiphy_iftype_ext_capab *ift_ext_capa =
10189 cfg80211_get_iftype_ext_capa(local->hw.wiphy,
10190 ieee80211_vif_type_p2p(&sdata->vif));
10191
10192 if (ift_ext_capa) {
10193 eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities);
10194 mld_capa_ops =
10195 cpu_to_le16(ift_ext_capa->mld_capa_and_ops);
10196 }
10197
10198 /* MLD capabilities and operation */
10199 var_common_size += 2;
10200
10201 /* EML capabilities */
10202 if (eml_capa & cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |
10203 IEEE80211_EML_CAP_EMLMR_SUPPORT)))
10204 var_common_size += 2;
10205 }
10206
96d4311c
JB		 10207 if (ext_mld_capa_ops)
10208 var_common_size += 2;
10209
36e05b0b
IP		 10210 /* Add the common information length */
10211 size += common_size + var_common_size;
10212
10213 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
10214 struct cfg80211_bss *cbss;
10215 size_t elems_len;
10216
10217 if (removed_links & BIT(link_id)) {
10218 size += sizeof(struct ieee80211_mle_per_sta_profile) +
10219 ETH_ALEN;
10220 continue;
10221 }
10222
10223 if (!add_links_data || !add_links_data->link[link_id].bss)
10224 continue;
10225
10226 elems_len = add_links_data->link[link_id].elems_len;
10227 cbss = add_links_data->link[link_id].bss;
10228
10229 /* should be the same across all BSSes */
10230 if (cbss->capability & WLAN_CAPABILITY_PRIVACY)
10231 capab |= WLAN_CAPABILITY_PRIVACY;
10232
10233 size += 2 + sizeof(struct ieee80211_mle_per_sta_profile) +
10234 ETH_ALEN;
10235
899da183
JB		 10236 /* WMM */
10237 size += 9;
36e05b0b
IP		 10238 size += ieee80211_link_common_elems_size(sdata, iftype, cbss,
10239 elems_len);
10240 }
10241
10242 skb = alloc_skb(size, GFP_KERNEL);
10243 if (!skb)
10244 return NULL;
10245
10246 skb_reserve(skb, local->hw.extra_tx_headroom);
10247 mgmt = skb_put_zero(skb, offsetofend(struct ieee80211_mgmt,
10248 u.action.u.ml_reconf_req));
10249
10250 /* Add the MAC header */
10251 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
10252 IEEE80211_STYPE_ACTION);
10253 memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
10254 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
10255 memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
10256
10257 /* Add the action frame fixed fields */
10258 mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
10259 mgmt->u.action.u.ml_reconf_req.action_code =
10260 WLAN_PROTECTED_EHT_ACTION_LINK_RECONFIG_REQ;
10261
10262 /* allocate a dialog token and store it */
10263 sdata->u.mgd.reconf.dialog_token = ++sdata->u.mgd.dialog_token_alloc;
10264 mgmt->u.action.u.ml_reconf_req.dialog_token =
10265 sdata->u.mgd.reconf.dialog_token;
10266
10267 /* Add the ML reconfiguration element and the common information */
10268 skb_put_u8(skb, WLAN_EID_EXTENSION);
10269 ml_elem_len = skb_put(skb, 1);
10270 skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK);
10271 ml_elem = skb_put(skb, sizeof(*ml_elem));
10272 ml_elem->control =
10273 cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_RECONF |
10274 IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR);
10275 common = skb_put(skb, common_size);
10276 common->len = common_size + var_common_size;
10277 memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN);
10278
10279 if (add_links_data) {
10280 if (eml_capa &
10281 cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |
10282 IEEE80211_EML_CAP_EMLMR_SUPPORT))) {
10283 ml_elem->control |=
10284 cpu_to_le16(IEEE80211_MLC_RECONF_PRES_EML_CAPA);
10285 skb_put_data(skb, &eml_capa, sizeof(eml_capa));
10286 }
10287
10288 ml_elem->control |=
10289 cpu_to_le16(IEEE80211_MLC_RECONF_PRES_MLD_CAPA_OP);
10290
10291 skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops));
10292 }
10293
96d4311c
JB		 10294 if (ext_mld_capa_ops) {
10295 ml_elem->control |=
10296 cpu_to_le16(IEEE80211_MLC_RECONF_PRES_EXT_MLD_CAPA_OP);
10297 skb_put_data(skb, &ext_mld_capa_ops, sizeof(ext_mld_capa_ops));
10298 }
10299
36e05b0b
IP		 10300 if (sdata->u.mgd.flags & IEEE80211_STA_ENABLE_RRM)
10301 capab |= WLAN_CAPABILITY_RADIO_MEASURE;
10302
10303 /* Add the per station profile */
10304 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
10305 u8 *subelem_len = NULL;
10306 u16 ctrl;
10307 const u8 *addr;
10308
10309 /* Skip links that are not changing */
10310 if (!(removed_links & BIT(link_id)) &&
10311 (!add_links_data || !add_links_data->link[link_id].bss))
10312 continue;
10313
10314 ctrl = link_id |
10315 IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT;
10316
10317 if (removed_links & BIT(link_id)) {
10318 struct ieee80211_bss_conf *conf =
10319 sdata_dereference(sdata->vif.link_conf[link_id],
10320 sdata);
10321 if (!conf)
10322 continue;
10323
10324 addr = conf->addr;
10325 ctrl |= u16_encode_bits(IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_DEL_LINK,
10326 IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE);
10327 } else {
10328 addr = add_links_data->link[link_id].addr;
10329 ctrl |= IEEE80211_MLE_STA_RECONF_CONTROL_COMPLETE_PROFILE |
10330 u16_encode_bits(IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_ADD_LINK,
10331 IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE);
10332 }
10333
10334 skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE);
10335 subelem_len = skb_put(skb, 1);
10336
10337 put_unaligned_le16(ctrl, skb_put(skb, sizeof(ctrl)));
10338 skb_put_u8(skb, 1 + ETH_ALEN);
10339 skb_put_data(skb, addr, ETH_ALEN);
10340
10341 if (!(removed_links & BIT(link_id))) {
10342 u16 link_present_elems[PRESENT_ELEMS_MAX] = {};
10343 size_t extra_used;
10344 void *capab_pos;
10345 u8 qos_info;
10346
10347 capab_pos = skb_put(skb, 2);
10348
36e05b0b
IP		 10349 extra_used =
10350 ieee80211_add_link_elems(sdata, skb, &capab, NULL,
10351 add_links_data->link[link_id].elems,
10352 add_links_data->link[link_id].elems_len,
10353 link_id, NULL,
10354 link_present_elems,
10355 add_links_data);
10356
10357 if (add_links_data->link[link_id].elems)
10358 skb_put_data(skb,
10359 add_links_data->link[link_id].elems +
10360 extra_used,
10361 add_links_data->link[link_id].elems_len -
10362 extra_used);
10363 if (sdata->u.mgd.flags & IEEE80211_STA_UAPSD_ENABLED) {
10364 qos_info = sdata->u.mgd.uapsd_queues;
10365 qos_info |= (sdata->u.mgd.uapsd_max_sp_len <<
10366 IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
10367 } else {
10368 qos_info = 0;
10369 }
10370
10371 ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
10372 put_unaligned_le16(capab, capab_pos);
10373 }
10374
10375 ieee80211_fragment_element(skb, subelem_len,
10376 IEEE80211_MLE_SUBELEM_FRAGMENT);
10377 }
10378
10379 ieee80211_fragment_element(skb, ml_elem_len, WLAN_EID_FRAGMENT);
10380
10381 info = IEEE80211_SKB_CB(skb);
10382 info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
10383
10384 return skb;
10385}
10386
10387int ieee80211_mgd_assoc_ml_reconf(struct ieee80211_sub_if_data *sdata,
a096a860 10388 struct cfg80211_ml_reconf_req *req)
36e05b0b
IP		 10389{
10390 struct ieee80211_local *local = sdata->local;
10391 struct ieee80211_mgd_assoc_data *data = NULL;
10392 struct sta_info *sta;
10393 struct sk_buff *skb;
10394 u16 added_links, new_valid_links;
10395 int link_id, err;
10396
10397 if (!ieee80211_vif_is_mld(&sdata->vif) ||
10398 !(sdata->vif.cfg.mld_capa_op &
10399 IEEE80211_MLD_CAP_OP_LINK_RECONF_SUPPORT))
10400 return -EINVAL;
10401
10402 /* No support for concurrent ML reconfiguration operation */
10403 if (sdata->u.mgd.reconf.added_links ||
10404 sdata->u.mgd.reconf.removed_links)
10405 return -EBUSY;
10406
10407 added_links = 0;
a096a860
JB		 10408 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
10409 if (!req->add_links[link_id].bss)
36e05b0b
IP		 10410 continue;
10411
10412 added_links |= BIT(link_id);
10413 }
10414
10415 sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
10416 if (WARN_ON(!sta))
10417 return -ENOLINK;
10418
36e05b0b
IP		 10419 /* Adding links to the set of valid link is done only after a successful
10420 * ML reconfiguration frame exchange. Here prepare the data for the ML
10421 * reconfiguration frame construction and allocate the required
10422 * resources
10423 */
10424 if (added_links) {
10425 bool uapsd_supported;
36e05b0b
IP		 10426
10427 data = kzalloc(sizeof(*data), GFP_KERNEL);
10428 if (!data)
10429 return -ENOMEM;
10430
c3171bed 10431 data->assoc_link_id = -1;
ff4d8998 10432 data->wmm = true;
c3171bed 10433
36e05b0b 10434 uapsd_supported = true;
36e05b0b
IP		 10435 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
10436 link_id++) {
10437 struct ieee80211_supported_band *sband;
a096a860
JB		 10438 struct cfg80211_bss *link_cbss =
10439 req->add_links[link_id].bss;
36e05b0b
IP		 10440 struct ieee80211_bss *bss;
10441
10442 if (!link_cbss)
10443 continue;
10444
10445 bss = (void *)link_cbss->priv;
10446
10447 if (!bss->wmm_used) {
10448 err = -EINVAL;
10449 goto err_free;
10450 }
10451
10452 if (link_cbss->channel->band == NL80211_BAND_S1GHZ) {
10453 err = -EINVAL;
10454 goto err_free;
10455 }
10456
10457 eth_random_addr(data->link[link_id].addr);
10458 data->link[link_id].conn =
10459 ieee80211_conn_settings_unlimited;
10460 sband =
10461 local->hw.wiphy->bands[link_cbss->channel->band];
10462
10463 ieee80211_determine_our_sta_mode(sdata, sband,
10464 NULL, true, link_id,
10465 &data->link[link_id].conn);
10466
10467 data->link[link_id].bss = link_cbss;
10468 data->link[link_id].disabled =
a096a860 10469 req->add_links[link_id].disabled;
36e05b0b 10470 data->link[link_id].elems =
a096a860 10471 (u8 *)req->add_links[link_id].elems;
36e05b0b 10472 data->link[link_id].elems_len =
a096a860 10473 req->add_links[link_id].elems_len;
36e05b0b
IP		 10474
10475 if (!bss->uapsd_supported)
10476 uapsd_supported = false;
10477
10478 if (data->link[link_id].conn.mode <
10479 IEEE80211_CONN_MODE_EHT) {
10480 err = -EINVAL;
10481 goto err_free;
10482 }
10483
10484 err = ieee80211_mgd_get_ap_ht_vht_capa(sdata, data,
10485 link_id);
10486 if (err) {
10487 err = -EINVAL;
10488 goto err_free;
10489 }
10490 }
10491
7a6a740b
JB		 10492 /* Require U-APSD support if we enabled it */
10493 if (sdata->u.mgd.flags & IEEE80211_STA_UAPSD_ENABLED &&
10494 !uapsd_supported) {
36e05b0b 10495 err = -EINVAL;
7a6a740b 10496 sdata_info(sdata, "U-APSD on but not available on (all) new links\n");
36e05b0b
IP		 10497 goto err_free;
10498 }
10499
10500 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
10501 link_id++) {
10502 if (!data->link[link_id].bss)
10503 continue;
10504
10505 /* only used to verify the mode, nothing is allocated */
10506 err = ieee80211_prep_channel(sdata, NULL, link_id,
10507 data->link[link_id].bss,
10508 true,
10509 &data->link[link_id].conn,
80834e7d 10510 sdata->u.mgd.userspace_selectors);
36e05b0b
IP		 10511 if (err)
10512 goto err_free;
10513 }
10514 }
10515
10516 /* link removal is done before the ML reconfiguration frame exchange so
10517 * that these links will not be used between their removal by the AP MLD
10518 * and before the station got the ML reconfiguration response. Based on
10519 * Section 35.3.6.4 in Draft P802.11be_D7.0 the AP MLD should accept the
10520 * link removal request.
10521 */
a096a860
JB		 10522 if (req->rem_links) {
10523 u16 new_active_links =
10524 sdata->vif.active_links & ~req->rem_links;
36e05b0b 10525
a096a860 10526 new_valid_links = sdata->vif.valid_links & ~req->rem_links;
36e05b0b
IP		 10527
10528 /* Should not be left with no valid links to perform the
10529 * ML reconfiguration
10530 */
10531 if (!new_valid_links ||
10532 !(new_valid_links & ~sdata->vif.dormant_links)) {
10533 sdata_info(sdata, "mlo: reconf: no valid links\n");
10534 err = -EINVAL;
10535 goto err_free;
10536 }
10537
10538 if (new_active_links != sdata->vif.active_links) {
10539 if (!new_active_links)
10540 new_active_links =
10541 BIT(__ffs(new_valid_links &
10542 ~sdata->vif.dormant_links));
10543
10544 err = ieee80211_set_active_links(&sdata->vif,
10545 new_active_links);
10546 if (err) {
10547 sdata_info(sdata,
10548 "mlo: reconf: failed set active links\n");
10549 goto err_free;
10550 }
10551 }
10552 }
10553
10554 /* Build the SKB before the link removal as the construction of the
10555 * station info for removed links requires the local address.
10556 * Invalidate the removed links, so that the transmission of the ML
10557 * reconfiguration request frame would not be done using them, as the AP
10558 * is expected to send the ML reconfiguration response frame on the link
10559 * on which the request was received.
10560 */
96d4311c
JB		 10561 skb = ieee80211_build_ml_reconf_req(sdata, data, req->rem_links,
10562 cpu_to_le16(req->ext_mld_capa_ops));
a4058dc1
DC		 10563 if (!skb) {
10564 err = -ENOMEM;
10565 goto err_free;
10566 }
36e05b0b 10567
a096a860
JB		 10568 if (req->rem_links) {
10569 u16 new_dormant_links =
10570 sdata->vif.dormant_links & ~req->rem_links;
36e05b0b
IP		 10571
10572 err = ieee80211_vif_set_links(sdata, new_valid_links,
10573 new_dormant_links);
10574 if (err) {
10575 sdata_info(sdata,
10576 "mlo: reconf: failed set valid links\n");
10577 kfree_skb(skb);
10578 goto err_free;
10579 }
10580
10581 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
10582 link_id++) {
a096a860 10583 if (!(req->rem_links & BIT(link_id)))
36e05b0b
IP		 10584 continue;
10585
10586 ieee80211_sta_remove_link(sta, link_id);
10587 }
10588
10589 /* notify the driver and upper layers */
10590 ieee80211_vif_cfg_change_notify(sdata,
10591 BSS_CHANGED_MLD_VALID_LINKS);
a096a860 10592 cfg80211_links_removed(sdata->dev, req->rem_links);
36e05b0b
IP		 10593 }
10594
10595 sdata_info(sdata, "mlo: reconf: adding=0x%x, removed=0x%x\n",
a096a860 10596 added_links, req->rem_links);
36e05b0b
IP		 10597
10598 ieee80211_tx_skb(sdata, skb);
10599
10600 sdata->u.mgd.reconf.added_links = added_links;
10601 sdata->u.mgd.reconf.add_links_data = data;
a096a860 10602 sdata->u.mgd.reconf.removed_links = req->rem_links;
36e05b0b
IP		 10603 wiphy_delayed_work_queue(sdata->local->hw.wiphy,
10604 &sdata->u.mgd.reconf.wk,
10605 IEEE80211_ASSOC_TIMEOUT_SHORT);
10606 return 0;
10607
10608 err_free:
10609 kfree(data);
10610 return err;
10611}
de86c5f6
IP		 10612
10613static bool ieee80211_mgd_epcs_supp(struct ieee80211_sub_if_data *sdata)
10614{
10615 unsigned long valid_links = sdata->vif.valid_links;
10616 u8 link_id;
10617
10618 lockdep_assert_wiphy(sdata->local->hw.wiphy);
10619
10620 if (!ieee80211_vif_is_mld(&sdata->vif))
10621 return false;
10622
10623 for_each_set_bit(link_id, &valid_links, IEEE80211_MLD_MAX_NUM_LINKS) {
10624 struct ieee80211_bss_conf *bss_conf =
10625 sdata_dereference(sdata->vif.link_conf[link_id], sdata);
10626
10627 if (WARN_ON(!bss_conf) || !bss_conf->epcs_support)
10628 return false;
10629 }
10630
10631 return true;
10632}
10633
10634int ieee80211_mgd_set_epcs(struct ieee80211_sub_if_data *sdata, bool enable)
10635{
10636 struct ieee80211_local *local = sdata->local;
10637 struct ieee80211_mgmt *mgmt;
10638 struct sk_buff *skb;
10639 int frame_len = offsetofend(struct ieee80211_mgmt,
10640 u.action.u.epcs) + (enable ? 1 : 0);
10641
10642 if (!ieee80211_mgd_epcs_supp(sdata))
10643 return -EINVAL;
10644
10645 if (sdata->u.mgd.epcs.enabled == enable &&
10646 !sdata->u.mgd.epcs.dialog_token)
10647 return 0;
10648
10649 /* Do not allow enabling EPCS if the AP didn't respond yet.
10650 * However, allow disabling EPCS in such a case.
10651 */
10652 if (sdata->u.mgd.epcs.dialog_token && enable)
10653 return -EALREADY;
10654
10655 skb = dev_alloc_skb(local->hw.extra_tx_headroom + frame_len);
10656 if (!skb)
10657 return -ENOBUFS;
10658
10659 skb_reserve(skb, local->hw.extra_tx_headroom);
10660 mgmt = skb_put_zero(skb, frame_len);
10661 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
10662 IEEE80211_STYPE_ACTION);
10663 memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
10664 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
10665 memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
10666
10667 mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
10668 if (enable) {
10669 u8 *pos = mgmt->u.action.u.epcs.variable;
10670
10671 mgmt->u.action.u.epcs.action_code =
10672 WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_REQ;
10673
10674 *pos = ++sdata->u.mgd.dialog_token_alloc;
10675 sdata->u.mgd.epcs.dialog_token = *pos;
10676 } else {
10677 mgmt->u.action.u.epcs.action_code =
10678 WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_TEARDOWN;
10679
10680 ieee80211_epcs_teardown(sdata);
10681 ieee80211_epcs_changed(sdata, false);
10682 }
10683
10684 ieee80211_tx_skb(sdata, skb);
10685 return 0;
10686}
10687
10688static void ieee80211_ml_epcs(struct ieee80211_sub_if_data *sdata,
10689 struct ieee802_11_elems *elems)
10690{
10691 const struct element *sub;
10692 size_t scratch_len = elems->ml_epcs_len;
10693 u8 *scratch __free(kfree) = kzalloc(scratch_len, GFP_KERNEL);
10694
10695 lockdep_assert_wiphy(sdata->local->hw.wiphy);
10696
10697 if (!ieee80211_vif_is_mld(&sdata->vif) || !elems->ml_epcs)
10698 return;
10699
10700 if (WARN_ON(!scratch))
10701 return;
10702
10703 /* Directly parse the sub elements as the common information doesn't
10704 * hold any useful information.
10705 */
10706 for_each_mle_subelement(sub, (const u8 *)elems->ml_epcs,
10707 elems->ml_epcs_len) {
a0669173 10708 struct ieee802_11_elems *link_elems __free(kfree) = NULL;
de86c5f6 10709 struct ieee80211_link_data *link;
de86c5f6
IP		 10710 u8 *pos = (void *)sub->data;
10711 u16 control;
10712 ssize_t len;
10713 u8 link_id;
10714
10715 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
10716 continue;
10717
10718 if (sub->datalen < sizeof(control))
10719 break;
10720
10721 control = get_unaligned_le16(pos);
10722 link_id = control & IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID;
10723
10724 link = sdata_dereference(sdata->link[link_id], sdata);
10725 if (!link)
10726 continue;
10727
10728 len = cfg80211_defragment_element(sub, (u8 *)elems->ml_epcs,
10729 elems->ml_epcs_len,
10730 scratch, scratch_len,
10731 IEEE80211_MLE_SUBELEM_FRAGMENT);
ebf9944b 10732 if (len < (ssize_t)sizeof(control))
de86c5f6
IP		 10733 continue;
10734
10735 pos = scratch + sizeof(control);
10736 len -= sizeof(control);
10737
10738 link_elems = ieee802_11_parse_elems(pos, len, false, NULL);
10739 if (!link_elems)
10740 continue;
10741
10742 if (ieee80211_sta_wmm_params(sdata->local, link,
10743 link_elems->wmm_param,
10744 link_elems->wmm_param_len,
10745 link_elems->mu_edca_param_set))
10746 ieee80211_link_info_change_notify(sdata, link,
10747 BSS_CHANGED_QOS);
10748 }
10749}
10750
10751void ieee80211_process_epcs_ena_resp(struct ieee80211_sub_if_data *sdata,
10752 struct ieee80211_mgmt *mgmt, size_t len)
10753{
10754 struct ieee802_11_elems *elems __free(kfree) = NULL;
10755 size_t ies_len;
10756 u16 status_code;
10757 u8 *pos, dialog_token;
10758
10759 if (!ieee80211_mgd_epcs_supp(sdata))
10760 return;
10761
10762 /* Handle dialog token and status code */
10763 pos = mgmt->u.action.u.epcs.variable;
10764 dialog_token = *pos;
10765 status_code = get_unaligned_le16(pos + 1);
10766
10767 /* An EPCS enable response with dialog token == 0 is an unsolicited
10768 * notification from the AP MLD. In such a case, EPCS should already be
10769 * enabled and status must be success
10770 */
10771 if (!dialog_token &&
10772 (!sdata->u.mgd.epcs.enabled ||
10773 status_code != WLAN_STATUS_SUCCESS))
10774 return;
10775
10776 if (sdata->u.mgd.epcs.dialog_token != dialog_token)
10777 return;
10778
10779 sdata->u.mgd.epcs.dialog_token = 0;
10780
10781 if (status_code != WLAN_STATUS_SUCCESS)
10782 return;
10783
10784 pos += IEEE80211_EPCS_ENA_RESP_BODY_LEN;
10785 ies_len = len - offsetof(struct ieee80211_mgmt,
10786 u.action.u.epcs.variable) -
10787 IEEE80211_EPCS_ENA_RESP_BODY_LEN;
10788
10789 elems = ieee802_11_parse_elems(pos, ies_len, true, NULL);
10790 if (!elems)
10791 return;
10792
10793 ieee80211_ml_epcs(sdata, elems);
10794 ieee80211_epcs_changed(sdata, true);
10795}
10796
10797void ieee80211_process_epcs_teardown(struct ieee80211_sub_if_data *sdata,
10798 struct ieee80211_mgmt *mgmt, size_t len)
10799{
10800 if (!ieee80211_vif_is_mld(&sdata->vif) ||
10801 !sdata->u.mgd.epcs.enabled)
10802 return;
10803
10804 ieee80211_epcs_teardown(sdata);
10805 ieee80211_epcs_changed(sdata, false);
10806}
Linux 6.x block layer and io_uring tree(s)